pidgin.2.6.5: 545b0231: *** Plucked rev b0c392df480480c0a511e96f...

[datallah at pidgin.im]

-----------------------------------------------------------------
Revision: 545b0231b60f11482e2b146a4f5a5e140bc06691
Ancestor: c13d954bc23d9f3c9b3837b83d50ce7db7edeeed
Author: datallah at pidgin.im
Date: 2010-01-07T23:48:06
Branch: im.pidgin.pidgin.2.6.5
URL: http://d.pidgin.im/viewmtn/revision/info/545b0231b60f11482e2b146a4f5a5e140bc06691

Modified files:
        pidgin/gtklog.c

ChangeLog: 

*** Plucked rev b0c392df480480c0a511e96fc7b2eb7f827e6efb (bcc0147bab874ca52c55ad4900545e17528bf8fd):
Save the event source ID for search_find_cb so that it's removed when the
log dialog is closed. This fixes a double free which might be caused by
having a large logset (and maybe pressing Close multiple times).

It looks something like this, with a few variations:
== Invalid read of size 8
==    at 0x483001: search_find_cb (gtklog.c:425)
==    by 0xBB91E50: g_main_context_dispatch (gmain.c:1824)
==    by 0xBB953E7: g_main_context_iterate (gmain.c:2455)
==    by 0xBB958BC: g_main_loop_run (gmain.c:2663)
==    by 0x63AF606: gtk_main (gtkmain.c:1205)
==    by 0x485ADF: main (gtkmain.c:978)
==  Address 0x1b469860 is 56 bytes inside a block of size 72 free'd
==    at 0x4C239EF: free (vg_replace_malloc.c:323)
==    by 0x483A6C: destroy_cb (gtklog.c:223)
==    by 0xAB9B12C: g_closure_invoke (gclosure.c:767)
==    by 0xABB02B1: signal_emit_unlocked_R (gsignal.c:3247)
==    by 0xABB1806: g_signal_emit_valist (gsignal.c:2980)
==    by 0xABB1CD2: g_signal_emit (gsignal.c:3037)
==    by 0xAB9B12C: g_closure_invoke (gclosure.c:767)
==    by 0xABB02B1: signal_emit_unlocked_R (gsignal.c:3247)
==    by 0xABB1806: g_signal_emit_valist (gsignal.c:2980)
==    by 0xABB1CD2: g_signal_emit (gsignal.c:3037)
==    by 0x630ECB4: gtk_real_button_released (gtkbutton.c:1707)
==    by 0xAB9B12C: g_closure_invoke (gclosure.c:767)
== 

Fixes #11071.



-------------- next part --------------
============================================================
--- pidgin/gtklog.c	145805ca4e43bb75ee6f1180928a1106dcae1c13
+++ pidgin/gtklog.c	660c8f9069b794854cecd7bd4052195a2589e2a8
@@ -423,6 +423,7 @@ static gboolean search_find_cb(gpointer 
 {
 	PidginLogViewer *viewer = data;
 	gtk_imhtml_search_find(GTK_IMHTML(viewer->imhtml), viewer->search);
+	g_object_steal_data(G_OBJECT(viewer->entry), "search-find-cb");
 	return FALSE;
 }
 
@@ -475,8 +476,11 @@ static void log_select_cb(GtkTreeSelecti
 	g_free(read);
 
 	if (viewer->search != NULL) {
+		guint source;
 		gtk_imhtml_search_clear(GTK_IMHTML(viewer->imhtml));
-		g_idle_add(search_find_cb, viewer);
+		source = g_idle_add(search_find_cb, viewer);
+		g_object_set_data_full(G_OBJECT(viewer->entry), "search-find-cb",
+		                       GINT_TO_POINTER(source), (GDestroyNotify)g_source_remove);
 	}
 
 	pidgin_clear_cursor(viewer->window);