From f90f3434a3b24b591a602143bf71a7f45bd2c55c Mon Sep 17 00:00:00 2001 From: cnook Date: Thu, 22 Mar 2012 05:58:49 +0000 Subject: [PATCH] From: cnook Subject: [E-devel] [Patch][elm_list] bug fix: crash occurs when container which contains the elm_list is deleted on the "elm_list item clicked" callback I have resolved the elm_list issue(goto ELM_LIST_CRASH_ISSUE_MAIL below, I sent mail but I cannot find the previous mail -_-;). It would be related with double free issue. In the "sub-obejct-del" callback which name is _sub_del() sets item->icon to NULL. And in the EVAS_CALLBACK_MOUSE_UP callback funtion which name is _mouse_up() calls evas_object_unref(); It would try to free the item->icon but the item->icon is already set to NULL. So.. the crash would occur.. SVN revision: 69555 --- src/lib/elm_list.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/src/lib/elm_list.c b/src/lib/elm_list.c index 722b3cb..5a8d78d 100644 --- a/src/lib/elm_list.c +++ b/src/lib/elm_list.c @@ -444,8 +444,25 @@ static void _del_pre_hook(Evas_Object *obj) { Widget_Data *wd = elm_widget_data_get(obj); + const Eina_List *l; + Elm_List_Item *it; + + evas_object_smart_callback_del(obj, "sub-object-del", _sub_del); + if (!wd) return; + EINA_LIST_FOREACH(wd->items, l, it) + { + if (it->icon) + evas_object_event_callback_del(it->icon, + EVAS_CALLBACK_CHANGED_SIZE_HINTS, + _changed_size_hints); + if (it->end) + evas_object_event_callback_del(it->end, + EVAS_CALLBACK_CHANGED_SIZE_HINTS, + _changed_size_hints); + } + evas_object_event_callback_del(wd->scr, EVAS_CALLBACK_CHANGED_SIZE_HINTS, _changed_size_hints); -- 2.7.4