elementary: fix erroneous memory access.

One more pack of beer for the Valgrind developer !

SVN revision: 74202

diff --git a/src/lib/elm_colorselector.c b/src/lib/elm_colorselector.c
index cd81d48..8a4278a 100644 (file)
--- a/src/lib/elm_colorselector.c
+++ b/src/lib/elm_colorselector.c
@@ -1167,6 +1167,7 @@ static void
 _elm_colorselector_smart_del(Evas_Object *obj)
 {
    int i = 0;
+   void *tmp[4];
 
    ELM_COLORSELECTOR_DATA_GET(obj, sd);
 
@@ -1174,10 +1175,14 @@ _elm_colorselector_smart_del(Evas_Object *obj)
    if (sd->palette_name) eina_stringshare_del(sd->palette_name);
 
    _items_del(sd);
+   /* This cb_data are used during the destruction process of base.del */
    for (i = 0; i < 4; i++)
-     free(sd->cb_data[i]);
+     tmp[i] = sd->cb_data[i];
 
    ELM_WIDGET_CLASS(_elm_colorselector_parent_sc)->base.del(obj);
+
+   for (i = 0; i < 4; i++)
+     free(tmp[i]);
 }
 
 static Eina_Bool

diff --git a/src/lib/elm_layout.c b/src/lib/elm_layout.c
index 9d661e1..63990a5 100644 (file)
--- a/src/lib/elm_layout.c
+++ b/src/lib/elm_layout.c
@@ -964,12 +964,6 @@ _sub_box_remove(Evas_Object *obj,
    Evas_Object *child = sub_d->obj; /* sub_d will die in
                                      * _elm_layout_smart_sub_object_del */
 
-   if (!elm_widget_sub_object_del(obj, child))
-     {
-        ERR("could not remove sub object %p from %p", child, obj);
-        return NULL;
-     }
-
    if (sub_d->type == BOX_INSERT_BEFORE)
      evas_object_event_callback_del_full
        ((Evas_Object *)sub_d->p.box.reference,
@@ -978,6 +972,12 @@ _sub_box_remove(Evas_Object *obj,
    edje_object_part_box_remove
      (ELM_WIDGET_DATA(sd)->resize_obj, sub_d->part, child);
 
+   if (!elm_widget_sub_object_del(obj, child))
+     {
+        ERR("could not remove sub object %p from %p", child, obj);
+        return NULL;
+     }
+
    return child;
 }
 
@@ -1107,15 +1107,15 @@ _sub_table_remove(Evas_Object *obj,
 
    child = sub_d->obj; /* sub_d will die in _elm_layout_smart_sub_object_del */
 
+   edje_object_part_table_unpack
+     (ELM_WIDGET_DATA(sd)->resize_obj, sub_d->part, child);
+
    if (!elm_widget_sub_object_del(obj, child))
      {
         ERR("could not remove sub object %p from %p", child, obj);
         return NULL;
      }
 
-   edje_object_part_table_unpack
-     (ELM_WIDGET_DATA(sd)->resize_obj, sub_d->part, child);
-
    return child;
 }
 

diff --git a/src/lib/elm_list.c b/src/lib/elm_list.c
index 2a02bea..36b6856 100644 (file)
--- a/src/lib/elm_list.c
+++ b/src/lib/elm_list.c
@@ -468,7 +468,8 @@ _elm_list_deletions_process(Elm_List_Smart_Data *sd)
 static void
 _elm_list_smart_sizing_eval(Evas_Object *obj)
 {
-   Evas_Coord vw, vh, minw, minh, maxw, maxh, w, h, vmw, vmh;
+   Evas_Coord vw = 0, vh = 0;
+   Evas_Coord minw, minh, maxw, maxh, w, h, vmw, vmh;
    double xw, yw;
 
    ELM_LIST_DATA_GET(obj, sd);

diff --git a/src/lib/elm_win.c b/src/lib/elm_win.c
index f8690f4..a227319 100644 (file)
--- a/src/lib/elm_win.c
+++ b/src/lib/elm_win.c
@@ -1196,6 +1196,15 @@ _elm_win_smart_del(Evas_Object *obj)
    if (sd->role) eina_stringshare_del(sd->role);
    if (sd->icon) evas_object_del(sd->icon);
 
+   /* Don't let callback in the air that point to sd */
+   ecore_evas_callback_delete_request_set(sd->ee, NULL);
+   ecore_evas_callback_resize_set(sd->ee, NULL);
+   ecore_evas_callback_mouse_in_set(sd->ee, NULL);
+   ecore_evas_callback_focus_in_set(sd->ee, NULL);
+   ecore_evas_callback_focus_out_set(sd->ee, NULL);
+   ecore_evas_callback_move_set(sd->ee, NULL);
+   ecore_evas_callback_state_change_set(sd->ee, NULL);
+
    _elm_win_parent_sc->base.del(obj); /* handles freeing sd */
 
    if ((!_elm_win_list) &&