edje: unset animator pointer after free in _edje_file_del()
authorMike Blumenkrantz <zmike@osg.samsung.com>
Wed, 24 Feb 2016 16:52:56 +0000 (11:52 -0500)
committerMike Blumenkrantz <zmike@osg.samsung.com>
Wed, 24 Feb 2016 16:53:53 +0000 (11:53 -0500)
this function may be called repeatedly with no other animator created
in between, leading to invalid object access

@fix

src/lib/edje/edje_load.c

index c431ac4..be94d78 100644 (file)
@@ -1720,6 +1720,7 @@ _edje_file_del(Edje *ed)
    _edje_animators = eina_list_remove(_edje_animators, ed);
    eo_do(ed->obj, eo_event_callback_del(EFL_CORE_ANIMATOR_EVENT_ANIMATOR_TICK, _edje_timer_cb, ed));
    ecore_animator_del(ed->animator);
+   ed->animator = NULL;
 
    if (ed->pending_actions)
      {