From a52ee9ee22ed7b2ae564b5b9dc8cc31c16ceb336 Mon Sep 17 00:00:00 2001
From: Matthias Clasen <mclasen@redhat.com>
Date: Mon, 22 Aug 2022 11:51:20 -0400
Subject: [PATCH] css: Fix freeing of calc values

We were getting our memory allocations mixed
up here.

Fixes: #5130
---
 gtk/gtkcssnumbervalue.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/gtk/gtkcssnumbervalue.c b/gtk/gtkcssnumbervalue.c
index 78e11b86ee..cd8c942c01 100644
--- a/gtk/gtkcssnumbervalue.c
+++ b/gtk/gtkcssnumbervalue.c
@@ -28,6 +28,7 @@
 static GtkCssValue *        gtk_css_calc_value_new         (guint n_terms);
 static GtkCssValue *        gtk_css_calc_value_new_sum     (GtkCssValue *a,
                                                             GtkCssValue *b);
+static gsize                gtk_css_value_calc_get_size    (gsize n_terms);
 
 enum {
   TYPE_CALC = 0,
@@ -78,9 +79,13 @@ gtk_css_value_number_free (GtkCssValue *number)
 
       for (guint i = 0; i < n_terms; i++)
         _gtk_css_value_unref (number->calc.terms[i]);
-    }
 
-  g_slice_free (GtkCssValue, number);
+      g_slice_free1 (gtk_css_value_calc_get_size (n_terms), number);
+    }
+  else
+    {
+      g_slice_free (GtkCssValue, number);
+    }
 }
 
 static double