From: Seunggyun Kim <sgyun.kim@samsung.com>

Subject: [E-devel]  elm_genlist - bug fix about del callback

I found one bug in elm_genlist_clear.

In case append lots of items in genlist, some items are still in genlist
item queue before it is processed in _item_queue.

At that time, if application calls elm_genlist_item_del api that has item in
genlist queue and elm_genlist_clear is called at once, "func.del" callback
is called twice.

If application frees some memory in "func.del" callback, It occurs
double free memory problem.

For example, some application has many items. and all items are deleted. but
all items are not proceed in queue. then application is terminated.
In that case, double free problem is occured in application.

So, I fixed elm_genlist_clear code and made a patch.

git-svn-id: https://svn.enlightenment.org/svn/e/trunk/elementary@57371 7cbeb6ba-43b4-40fd-8cce-4c39aea84d33

diff --git a/src/lib/elm_genlist.c b/src/lib/elm_genlist.c
index ddc0804..2d32454 100644 (file)
--- a/src/lib/elm_genlist.c
+++ b/src/lib/elm_genlist.c
@@ -3153,7 +3153,6 @@ elm_genlist_clear(Evas_Object *obj)
         }
         return;
      }
-   wd->clear_me = EINA_FALSE;
    while (wd->items)
      {
         Elm_Genlist_Item *it = ELM_GENLIST_ITEM_FROM_INLIST(wd->items);
@@ -3170,12 +3169,13 @@ elm_genlist_clear(Evas_Object *obj)
           it->wd->group_items = eina_list_remove(it->wd->group_items, it);
         elm_widget_item_pre_notify_del(it);
         if (it->realized) _item_unrealize(it);
-        if (it->itc->func.del)
+        if (((wd->clear_me) || (!it->delete_me)) && (it->itc->func.del)) 
           it->itc->func.del((void *)it->base.data, it->base.widget);
         if (it->long_timer) ecore_timer_del(it->long_timer);
         if (it->swipe_timer) ecore_timer_del(it->swipe_timer);
         elm_widget_item_del(it);
      }
+   wd->clear_me = EINA_FALSE;
    wd->anchor_item = NULL;
    while (wd->blocks)
      {