From 3d028e14938337f45a31a97812064043f1973f8a Mon Sep 17 00:00:00 2001
From: Hermet Park <hermet@hermet.pe.kr>
Date: Sat, 2 Jan 2016 21:46:53 +0900
Subject: [PATCH] tooltip : prevent blowing memory up in the middle of
 function.

user may remove a tooltip in their callbacks.
this patch is just a sort of the defensive code.
---
 legacy/elementary/src/lib/els_tooltip.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/legacy/elementary/src/lib/els_tooltip.c b/legacy/elementary/src/lib/els_tooltip.c
index 32a8dcada8..3cf56e6b8b 100644
--- a/legacy/elementary/src/lib/els_tooltip.c
+++ b/legacy/elementary/src/lib/els_tooltip.c
@@ -58,11 +58,13 @@ struct _Elm_Tooltip
      } rel_pos;
    Elm_Tooltip_Orient       orient; /** orientation for tooltip */
    int                      move_freeze;
+   unsigned short           ref;
 
    double                   hide_timeout; /* from theme */
    Eina_Bool                visible_lock:1;
    Eina_Bool                changed_style:1;
    Eina_Bool                free_size : 1;
+   Eina_Bool                unset_me : 1;
 };
 
 static void _elm_tooltip_reconfigure(Elm_Tooltip *tt);
@@ -73,6 +75,7 @@ static void _elm_tooltip_hide_anim_stop(Elm_Tooltip *tt);
 static void _elm_tooltip_show_timer_stop(Elm_Tooltip *tt);
 static void _elm_tooltip_hide(Elm_Tooltip *tt);
 static void _elm_tooltip_data_clean(Elm_Tooltip *tt);
+static void _elm_tooltip_unset(Elm_Tooltip *tt);
 
 static void
 _elm_tooltip_content_changed_hints_cb(void *data, Evas *e EINA_UNUSED, Evas_Object *obj EINA_UNUSED, void *event_info EINA_UNUSED)
@@ -354,7 +357,15 @@ _elm_tooltip_reconfigure(Elm_Tooltip *tt)
 
    if (!tt->content)
      {
+        tt->ref++;
         tt->content = tt->func((void *)tt->data, tt->owner, tt->tt_win ? : tt->owner);
+        tt->ref--;
+        if (tt->unset_me)
+          {
+             _elm_tooltip_unset(tt);
+             return;
+          }
+
         if (!tt->content)
           {
              WRN("could not create tooltip content!");
@@ -697,6 +708,11 @@ static void _elm_tooltip_obj_free_cb(void *data, Evas *e  EINA_UNUSED, Evas_Obje
 static void
 _elm_tooltip_unset(Elm_Tooltip *tt)
 {
+   if (tt->ref > 0)
+     {
+        tt->unset_me = EINA_TRUE;
+        return;
+     }
    tt->visible_lock = EINA_FALSE;
    _elm_tooltip_hide(tt);
    _elm_tooltip_data_clean(tt);