From 39fe4f085bfb371f29d6be167ff773099bbd5fb8 Mon Sep 17 00:00:00 2001 From: Seunggyun Kim Date: Sun, 27 Feb 2011 11:11:05 +0000 Subject: [PATCH] From: Seunggyun Kim Subject: [E-devel] elm_genlist - bug fix about del callback I found one bug in elm_genlist_clear. In case append lots of items in genlist, some items are still in genlist item queue before it is processed in _item_queue. At that time, if application calls elm_genlist_item_del api that has item in genlist queue and elm_genlist_clear is called at once, "func.del" callback is called twice. If application frees some memory in "func.del" callback, It occurs double free memory problem. For example, some application has many items. and all items are deleted. but all items are not proceed in queue. then application is terminated. In that case, double free problem is occured in application. So, I fixed elm_genlist_clear code and made a patch. SVN revision: 57371 --- legacy/elementary/src/lib/elm_genlist.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/legacy/elementary/src/lib/elm_genlist.c b/legacy/elementary/src/lib/elm_genlist.c index ddc0804c2b..2d32454bd7 100644 --- a/legacy/elementary/src/lib/elm_genlist.c +++ b/legacy/elementary/src/lib/elm_genlist.c @@ -3153,7 +3153,6 @@ elm_genlist_clear(Evas_Object *obj) } return; } - wd->clear_me = EINA_FALSE; while (wd->items) { Elm_Genlist_Item *it = ELM_GENLIST_ITEM_FROM_INLIST(wd->items); @@ -3170,12 +3169,13 @@ elm_genlist_clear(Evas_Object *obj) it->wd->group_items = eina_list_remove(it->wd->group_items, it); elm_widget_item_pre_notify_del(it); if (it->realized) _item_unrealize(it); - if (it->itc->func.del) + if (((wd->clear_me) || (!it->delete_me)) && (it->itc->func.del)) it->itc->func.del((void *)it->base.data, it->base.widget); if (it->long_timer) ecore_timer_del(it->long_timer); if (it->swipe_timer) ecore_timer_del(it->swipe_timer); elm_widget_item_del(it); } + wd->clear_me = EINA_FALSE; wd->anchor_item = NULL; while (wd->blocks) {