listitemmanager: Don't doubly-recycle widget

When there is a duplicate item in the hash table of deleted items, we:

1. Unparent the unparent the old `widget` value (gtk_widget_unparent is
   passed as `GDestroyNotify value_destroy_func` for the hastable).
2. Set the new `widget` value in the hashtable.
3. Also set the same `widget` in the recycled queue.

This means the same widget is found in the 2 containers and, therefore,
the same widget may be returned twice by gtk_list_item_change_get().
Alternatively, this means we may reuse the item by taking it from the
hashtable and reassigning it to a tile, but then it ends up getting
unparented by gtk_list_item_change_finish(). Or we don't take it at
all and end up calling gtk_widget_unparent()` on it twice, which may
result in use-after-free on the second call the parent was holding the
last reference.

This was introduced by 76d601631d

Previously, gtk_list_item_manager_release_list_item() would just emit
the warning but otherwise do nothing. Let's restore that behavior.
This commit is contained in:
António Fernandes 2024-01-24 12:44:50 +00:00
parent b05000d8bd
commit 3d88c44803

View File

@ -117,7 +117,6 @@ gtk_list_item_change_release (GtkListItemChange *change,
if (!g_hash_table_replace (change->deleted_items, gtk_list_item_base_get_item (GTK_LIST_ITEM_BASE (widget)), widget))
{
g_warning ("Duplicate item detected in list. Picking one randomly.");
gtk_list_item_change_recycle (change, widget);
}
}