From: Tom Hacohen <tom@stosb.com>
Date: Tue, 19 Nov 2013 17:13:31 +0000 (+0000)
Subject: Hoversel: Fix access to already deleted object.
X-Git-Tag: upstream/1.20.0~7116^2~14^2~3723
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=28fee48f353d0a8effc3c4c937b913de2c888519;p=platform%2Fupstream%2Fefl.git

Hoversel: Fix access to already deleted object.

Thank you eo pointer indirection for detecting this.
The issue is a mix of design choices (will discuss on the ML) and
a bug in hoversel which was probably caused because of the confusing design
choices.
The problem is that while widget_item->view is set by whoever created
the item, it's automatically deleted by elm_widget_item_del. This means
that objects that decided to delete their views, but were too sloppy to
update the widget_item->view pointer to NULL, would trigger an attempt
to deleted an already deleted object. This does not happen in 1.7
because widget_item->view was introduced in 1.8.
The automatic view deletion is problematic, as smart subobjects are
already deleted when the parent subobject (the widget) is deleted. So
clearing the views is redundant. However if the widget item is manually
deleted, the view should be deleted. This causes this mixture of cases
that are problematic at best.

Indication error:
Error:
 ERR<5394>:eo lib/eo/eo_ptr_indirection.x:275 eo_obj_pointer_get()
    obj_id 0x8000002900000149 is not pointing to a valid object. Maybe
    it has already been freed.

This fixes T500.
---

diff --git a/legacy/elementary/src/lib/elc_hoversel.c b/legacy/elementary/src/lib/elc_hoversel.c
index d5153ca..6299606 100644
--- a/legacy/elementary/src/lib/elc_hoversel.c
+++ b/legacy/elementary/src/lib/elc_hoversel.c
@@ -418,12 +418,18 @@ elm_hoversel_hover_end(Evas_Object *obj)
 static void
 _hover_end(Eo *obj, void *_pd, va_list *list EINA_UNUSED)
 {
+   Elm_Object_Item *it;
+   Eina_List *l;
    Elm_Hoversel_Smart_Data *sd = _pd;
 
    if (!sd->hover) return;
 
    sd->expanded = EINA_FALSE;
 
+   EINA_LIST_FOREACH(sd->items, l, it)
+     {
+        VIEW(it) = NULL;
+     }
    evas_object_del(sd->hover);
    sd->hover = NULL;