diff pidgin/gtklog.c @ 28844:ee1ed5d16235

Save the event source ID for search_find_cb so that it's removed when the log dialog is closed. This fixes a double free which might be caused by having a large logset (and maybe pressing Close multiple times). It looks something like this, with a few variations: == Invalid read of size 8 == at 0x483001: search_find_cb (gtklog.c:425) == by 0xBB91E50: g_main_context_dispatch (gmain.c:1824) == by 0xBB953E7: g_main_context_iterate (gmain.c:2455) == by 0xBB958BC: g_main_loop_run (gmain.c:2663) == by 0x63AF606: gtk_main (gtkmain.c:1205) == by 0x485ADF: main (gtkmain.c:978) == Address 0x1b469860 is 56 bytes inside a block of size 72 free'd == at 0x4C239EF: free (vg_replace_malloc.c:323) == by 0x483A6C: destroy_cb (gtklog.c:223) == by 0xAB9B12C: g_closure_invoke (gclosure.c:767) == by 0xABB02B1: signal_emit_unlocked_R (gsignal.c:3247) == by 0xABB1806: g_signal_emit_valist (gsignal.c:2980) == by 0xABB1CD2: g_signal_emit (gsignal.c:3037) == by 0xAB9B12C: g_closure_invoke (gclosure.c:767) == by 0xABB02B1: signal_emit_unlocked_R (gsignal.c:3247) == by 0xABB1806: g_signal_emit_valist (gsignal.c:2980) == by 0xABB1CD2: g_signal_emit (gsignal.c:3037) == by 0x630ECB4: gtk_real_button_released (gtkbutton.c:1707) == by 0xAB9B12C: g_closure_invoke (gclosure.c:767) == Fixes #11071.

--- a/pidgin/gtklog.c	Mon Jan 04 00:17:02 2010 +0000
+++ b/pidgin/gtklog.c	Tue Jan 05 06:43:18 2010 +0000
@@ -423,6 +423,7 @@
 {
 	PidginLogViewer *viewer = data;
 	gtk_imhtml_search_find(GTK_IMHTML(viewer->imhtml), viewer->search);
+	g_object_steal_data(G_OBJECT(viewer->entry), "search-find-cb");
 	return FALSE;
 }
 
@@ -475,8 +476,11 @@
 	g_free(read);
 
 	if (viewer->search != NULL) {
+		guint source;
 		gtk_imhtml_search_clear(GTK_IMHTML(viewer->imhtml));
-		g_idle_add(search_find_cb, viewer);
+		source = g_idle_add(search_find_cb, viewer);
+		g_object_set_data_full(G_OBJECT(viewer->entry), "search-find-cb",
+		                       GINT_TO_POINTER(source), (GDestroyNotify)g_source_remove);
 	}
 
 	pidgin_clear_cursor(viewer->window);