flowbox: Don't use a removed and destroyed child
gtk_flow_box_remove() crashes because the GtkFlowBoxChild is accessed after it has been unparented.
gtk_widget_unparent (GTK_WIDGET (child));
g_sequence_remove (CHILD_PRIV (child)->iter);
gtk_widget_unparent() drops child's last reference. It's destroyed, and CHILD_PRIV (child)->iter is NULL in the call to g_sequence_remove().
I found this bug when running an example program in gtkmm-documentation. It can also be triggered with gtk's tests/testflowbox.
- Start tests/testflowbox
- Open the
Test item controls
combo box - Select e.g.
Focus
Result: Many messages of type
(testflowbox:6480): GLib-CRITICAL **: 10:43:48.189: g_sequence_remove: assertion 'iter != NULL' failed
and segmentation fault.
Calling g_sequence_remove() before gtk_widget_unparent() fixes the bug.
Edited by Kjell Ahlstedt