[list] opensource merge (r69555)

From: cnook <kimcinoo@gmail.com>
Subject: [E-devel] [Patch][elm_list] bug fix: crash occurs when
container which contains the elm_list is deleted on the "elm_list item
clicked" callback

I have resolved the elm_list issue(goto ELM_LIST_CRASH_ISSUE_MAIL below, I
sent mail but I cannot find the previous mail -_-;).
It would be related with double free issue. In the "sub-obejct-del"
callback which name is _sub_del() sets item->icon to NULL.
And in the EVAS_CALLBACK_MOUSE_UP callback funtion which name is
_mouse_up() calls evas_object_unref();
It would try to free the item->icon but the item->icon is already set to
NULL. So.. the crash would occur..

git-svn-id: svn+ssh://svn.enlightenment.org/var/svn/e/trunk/elementary@69555 7cbeb6ba-43b4-40fd-8cce-4c39aea84d33
Change-Id: I6abbe50623da890aba28f6a24c4f301800264c87

diff --git a/src/lib/elm_list.c b/src/lib/elm_list.c
index dd6e939..f938611 100644 (file)
--- a/src/lib/elm_list.c
+++ b/src/lib/elm_list.c
@@ -444,8 +444,25 @@ static void
 _del_pre_hook(Evas_Object *obj)
 {
    Widget_Data *wd = elm_widget_data_get(obj);
+   const Eina_List *l;
+   Elm_List_Item *it;
+
+   evas_object_smart_callback_del(obj, "sub-object-del", _sub_del);
+
    if (!wd) return;
 
+   EINA_LIST_FOREACH(wd->items, l, it)
+     {
+        if (it->icon)
+           evas_object_event_callback_del(it->icon,
+                                          EVAS_CALLBACK_CHANGED_SIZE_HINTS,
+                                          _changed_size_hints);
+        if (it->end)
+           evas_object_event_callback_del(it->end,
+                                          EVAS_CALLBACK_CHANGED_SIZE_HINTS,
+                                          _changed_size_hints);
+     }
+
    evas_object_event_callback_del(wd->scr,
                                   EVAS_CALLBACK_CHANGED_SIZE_HINTS,
                                   _changed_size_hints);