--david
--- Without this patch the following sequence of events can happen, with dire consequences (segfaults...):1) gtk_handle_idle starts running the idle_functions list.
2) One of the idle functions (call it A) queues a second idle function (B) for removal (on either remove_idles or remove_idles_by_data) (via a call to gtk_idle_remove, or gtk_idle_remove_by_data).
Note that when this is done, the corresponding object for B is deref'ed. This may have been the last reference to the object, and so, subsequently, its memory may get freed and then reallocated.
3) If the idle function which was queued for removal hadn't been run yet --- this happens if B came after A in on the idle_functions list --- gtk_handle_idle will eventually call idle function B. Idle function B will try to do stuff with B's object, causing problems if B's objects memory has already been reused.
Cheers, Geoffrey T. Dairiki <dairiki@alumni.caltech.edu>
diff -ru gtk+971025/gdk/gdk.c gtk+971025-gtd/gdk/gdk.c --- gtk+971025/gdk/gdk.c Fri Oct 17 11:44:27 1997 +++ gtk+971025-gtd/gdk/gdk.c Fri Oct 31 13:19:23 1997 @@ -207,7 +207,7 @@ int argc_orig = *argc; char **argv_orig; - argv_orig = malloc (argc_orig * sizeof(char*)); + argv_orig = malloc ((argc_orig + 1) * sizeof(char*)); for (i = 0; i < argc_orig; i++) argv_orig[i] = g_strdup ((*argv)[i]); argv_orig[argc_orig] = NULL;
diff -ru gtk+971025/gtk/gtkmain.c gtk+971025-gtd/gtk/gtkmain.c --- gtk+971025/gtk/gtkmain.c Thu Oct 2 23:15:31 1997 +++ gtk+971025-gtd/gtk/gtkmain.c Fri Oct 31 19:45:53 1997 @@ -932,9 +932,24 @@ tmp_list = idle_functions; while (tmp_list) { + GList *rp = 0; + idlef = tmp_list->data; - if (gtk_idle_invoke_function (idlef) == FALSE) + /* Search the remove_ lists to see if the current idlef has + * been added (since we started running the idle_functions + * list). If it's been added, skip it. (We'll remove it + * from the list later --- see below... + */ + for (rp = remove_idles; rp; rp = rp->next) + if (*(gint*)rp->data == idlef->tag) + break; + if (!rp && remove_idles_by_data) + for (rp = remove_idles_by_data; rp; rp = rp->next) + if (*(gpointer*)tmp_list->data == idlef->data) + break; + + if (!rp && gtk_idle_invoke_function (idlef) == FALSE) { tmp_list2 = tmp_list; tmp_list = tmp_list->next;
-- Source code, list archive, and docs: http://www.mostang.com/sane/ To unsubscribe: echo unsubscribe sane-devel | mail majordomo@mostang.com