From 7e3db6fdd36960fca0ae0e7e078b448b5f8b220a Mon Sep 17 00:00:00 2001
From: Mike Gorse <mgorse@suse.com>
Date: Fri, 30 Aug 2013 09:13:39 -0500
Subject: [PATCH] a11y: Check whether a widget is mapped before querying its
 parent

Call gtk_widget_get_mapped() in a couple of places before looking at the
widget's parent, since it might be set to a widget that has been
finalized, causing an invalid read.
---
 gtk/a11y/gtkwidgetaccessible.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/gtk/a11y/gtkwidgetaccessible.c b/gtk/a11y/gtkwidgetaccessible.c
index 841ae14e3c..dbb7a5b2f5 100644
--- a/gtk/a11y/gtkwidgetaccessible.c
+++ b/gtk/a11y/gtkwidgetaccessible.c
@@ -174,6 +174,9 @@ gtk_widget_accessible_get_parent (AtkObject *accessible)
   if (parent != NULL)
     return parent;
 
+  if (!gtk_widget_get_mapped (widget))
+    return NULL;
+
   parent_widget = gtk_widget_get_parent (widget);
   if (parent_widget == NULL)
     return NULL;
@@ -237,7 +240,7 @@ find_label (GtkWidget *widget)
       temp_widget = label;
       while (temp_widget)
         {
-          if (temp_widget == widget)
+          if (temp_widget == widget || !gtk_widget_get_mapped (temp_widget))
             {
               label = NULL;
               break;
@@ -271,7 +274,7 @@ gtk_widget_accessible_ref_relation_set (AtkObject *obj)
       label = find_label (widget);
       if (label == NULL)
         {
-          if (GTK_IS_BUTTON (widget))
+          if (GTK_IS_BUTTON (widget) && gtk_widget_get_mapped (widget))
             /*
              * Handle the case where GnomeIconEntry is the mnemonic widget.
              * The GtkButton which is a grandchild of the GnomeIconEntry
@@ -293,7 +296,7 @@ gtk_widget_accessible_ref_relation_set (AtkObject *obj)
                     }
                 }
             }
-          else if (GTK_IS_COMBO_BOX (widget))
+          else if (GTK_IS_COMBO_BOX (widget) && gtk_widget_get_mapped (widget))
             /*
              * Handle the case when GtkFileChooserButton is the mnemonic
              * widget.  The GtkComboBox which is a child of the
@@ -440,7 +443,7 @@ gtk_widget_accessible_get_index_in_parent (AtkObject *accessible)
         }
     }
 
-  if (!GTK_IS_WIDGET (widget))
+  if (!GTK_IS_WIDGET (widget) || !gtk_widget_get_mapped (widget))
     return -1;
   parent_widget = gtk_widget_get_parent (widget);
   if (!GTK_IS_CONTAINER (parent_widget))
@@ -781,6 +784,9 @@ gtk_widget_accessible_on_screen (GtkWidget *widget)
 
   gtk_widget_get_allocation (widget, &allocation);
 
+  if (!gtk_widget_get_mapped (widget))
+    return FALSE;
+
   viewport = gtk_widget_get_ancestor (widget, GTK_TYPE_VIEWPORT);
   if (viewport)
     {