From 7597f6b594172d189bd52d6c73bf7ea26e1d47d1 Mon Sep 17 00:00:00 2001
From: Benjamin Otte <otte@redhat.com>
Date: Fri, 21 Feb 2020 18:30:13 +0100
Subject: [PATCH] transform: Don't crash for gsk_transform_transform (id, id)

See attached tests
---
 gsk/gsktransform.c        |  4 +++-
 testsuite/gsk/transform.c | 19 +++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/gsk/gsktransform.c b/gsk/gsktransform.c
index 19aa543b23..2d94d7e7a5 100644
--- a/gsk/gsktransform.c
+++ b/gsk/gsktransform.c
@@ -1624,8 +1624,10 @@ gsk_transform_transform (GskTransform *next,
 
   if (gsk_transform_is_identity (next))
     {
+      /* ref before unref to avoid catastrophe when other == next */
+      other = gsk_transform_ref (other);
       gsk_transform_unref (next);
-      return gsk_transform_ref (other);
+      return other;
     }
 
   next = gsk_transform_transform (next, other->next);
diff --git a/testsuite/gsk/transform.c b/testsuite/gsk/transform.c
index 71ade76a49..b90e4f4bc0 100644
--- a/testsuite/gsk/transform.c
+++ b/testsuite/gsk/transform.c
@@ -336,12 +336,30 @@ static void
 test_identity_equal (void)
 {
   GskTransform *id = gsk_transform_new ();
+  GskTransform *t;
 
   g_assert_true (gsk_transform_equal (NULL, NULL));
   g_assert_true (gsk_transform_equal (id, NULL));
   g_assert_true (gsk_transform_equal (NULL, id));
   g_assert_true (gsk_transform_equal (id, id));
 
+  t = gsk_transform_transform (NULL, NULL);
+  g_assert_true (gsk_transform_equal (t, NULL));
+  gsk_transform_unref (t);
+  t = gsk_transform_transform (gsk_transform_new (), NULL);
+  g_assert_true (gsk_transform_equal (t, NULL));
+  gsk_transform_unref (t);
+  t = gsk_transform_transform (NULL, id);
+  g_assert_true (gsk_transform_equal (t, NULL));
+  gsk_transform_unref (t);
+  t = gsk_transform_transform (gsk_transform_new (), id);
+  g_assert_true (gsk_transform_equal (t, NULL));
+  gsk_transform_unref (t);
+  t = gsk_transform_new ();
+  t = gsk_transform_transform (t, t);
+  g_assert_true (gsk_transform_equal (t, NULL));
+  gsk_transform_unref (t);
+
   gsk_transform_unref (id);
 }
 
@@ -394,6 +412,7 @@ main (int   argc,
   g_test_add_func ("/transform/conversions/simple", test_conversions_simple);
   g_test_add_func ("/transform/conversions/transformed", test_conversions_transformed);
   g_test_add_func ("/transform/identity", test_identity);
+  g_test_add_func ("/transform/identity-equal", test_identity_equal);
   g_test_add_func ("/transform/invert", test_invert);
   g_test_add_func ("/transform/print-parse", test_print_parse);
 
-- 
2.30.2