Skip to content

flowbox: Don't use a removed and destroyed child

Kjell Ahlstedt requested to merge kjellahl/flowboxremove into master

gtk_flow_box_remove() crashes because the GtkFlowBoxChild is accessed after it has been unparented.

  gtk_widget_unparent (GTK_WIDGET (child));
  g_sequence_remove (CHILD_PRIV (child)->iter);

gtk_widget_unparent() drops child's last reference. It's destroyed, and CHILD_PRIV (child)->iter is NULL in the call to g_sequence_remove().

I found this bug when running an example program in gtkmm-documentation. It can also be triggered with gtk's tests/testflowbox.

  • Start tests/testflowbox
  • Open the Test item controls combo box
  • Select e.g. Focus

Result: Many messages of type

(testflowbox:6480): GLib-CRITICAL **: 10:43:48.189: g_sequence_remove: assertion 'iter != NULL' failed

and segmentation fault.

Calling g_sequence_remove() before gtk_widget_unparent() fixes the bug.

Edited by Kjell Ahlstedt

Merge request reports