[Pidgin] #8069: Crash (tooltips race) #2

[Pidgin]

#8069: Crash (tooltips race) #2
--------------------------+-------------------------------------------------
Reporter:  jankratochvil  |        Type:  defect      
  Status:  new            |   Component:  pidgin (gtk)
 Version:  2.5.3          |    Keywords:              
--------------------------+-------------------------------------------------
 This problem was already reported as Ticket #6229 but its fix is
 incomplete.
 {{{
 #10 <signal handler called>
 #11 0x000000a800000018 in ?? ()
 #12 0x00000000004bbd82 in pidgin_tooltip_draw () at pidgintooltip.c:238
 #13 pidgin_tooltip_timeout (data=0x7ff8784e5220) at pidgintooltip.c:299
 #14 0x00000035dbc37f5b in g_timeout_dispatch (source=0x7ff878193970,
     callback=0x7ff878156ba0, user_data=0x7fff8f81eb00) at gmain.c:3589
 }}}

 pidgin_tooltip_setup_for_widget() uses only g_free() for the "destroy"
 signal.  But the `wdata' struct may have been already scheduled for
 pidgin_tooltip_timeout() in pidgin_tooltip.timeout by widget_motion_cb().

 If "destroy" happens before the tooltip timeouts it crashes.  There must
 be a removal of the tooltip timeout (not just g_free()) on the "destroy"
 signal.

-- 
Ticket URL: <http://developer.pidgin.im/ticket/8069>
Pidgin <http://pidgin.im>
Pidgin