[gimp/gimp-2-8] Bug 722975 - crash when removing tag from palette while filtering by same tag

[Michael Natterer <mitch src gnome org>]

commit 2ec7e24d805d1f524fe455ed08ac641c5244a6e6
Author: Michael Natterer <mitch gimp org>
Date:   Sun Jan 26 21:03:28 2014 +0100

    Bug 722975 - crash when removing tag from palette while filtering by same tag
    
    Each of the following cleans up tag refcounting, fixes access to
    released memory, or other small glitches. Not sure which change
    actually fixed the bug:
    
    gimp_data_remove_tag(): remove the found tag, not the passed in tag
    (which is to be treated only as a value for comparison).
    
    gimp_tagged_remove_tag(): don't continue the loop after the tag to
    remove has been found, there can only be one matching tag, and the
    list element has become invalid.
    
    gimptagentry.c: keep references around for the members of
    entry->common_tags, and make sure the references are always dropped
    properly. In assign_tags(), reference the "add" and "remove" lists for
    paranoia and safety reasons.
    
    (cherry picked from commit 7fca15c27dd944890a67bb6db90c0b1fd4238f2f)

 app/core/gimpdata.c        |    2 +-
 app/core/gimptagged.c      |    2 ++
 app/widgets/gimptagentry.c |   26 ++++++++++++++------------
 3 files changed, 17 insertions(+), 13 deletions(-)
---
diff --git a/app/core/gimpdata.c b/app/core/gimpdata.c
index 711d38f..76806ff 100644
--- a/app/core/gimpdata.c
+++ b/app/core/gimpdata.c
@@ -421,7 +421,7 @@ gimp_data_remove_tag (GimpTagged *tagged,
       if (gimp_tag_equals (tag, this))
         {
           private->tags = g_list_delete_link (private->tags, list);
-          g_object_unref (tag);
+          g_object_unref (this);
           return TRUE;
         }
     }
diff --git a/app/core/gimptagged.c b/app/core/gimptagged.c
index 9c44940..b04304a 100644
--- a/app/core/gimptagged.c
+++ b/app/core/gimptagged.c
@@ -153,6 +153,8 @@ gimp_tagged_remove_tag (GimpTagged *tagged,
             }
 
           g_object_unref (tag_ref);
+
+          return;
         }
     }
 }
diff --git a/app/widgets/gimptagentry.c b/app/widgets/gimptagentry.c
index 5593801..73227e1 100644
--- a/app/widgets/gimptagentry.c
+++ b/app/widgets/gimptagentry.c
@@ -227,7 +227,7 @@ gimp_tag_entry_dispose (GObject *object)
 
   if (entry->common_tags)
     {
-      g_list_free (entry->common_tags);
+      g_list_free_full (entry->common_tags, (GDestroyNotify) g_object_unref);
       entry->common_tags = NULL;
     }
 
@@ -761,7 +761,7 @@ gimp_tag_entry_assign_tags (GimpTagEntry *tag_entry)
             }
           else
             {
-              add_list = g_list_prepend (add_list, tag);
+              add_list = g_list_prepend (add_list, g_object_ref (tag));
             }
 
           common_tags = g_list_prepend (common_tags, tag);
@@ -778,7 +778,8 @@ gimp_tag_entry_assign_tags (GimpTagEntry *tag_entry)
       if (! g_list_find_custom (dont_remove_list, tag_iter->data,
                                 gimp_tag_compare_func))
         {
-          remove_list = g_list_prepend (remove_list, tag_iter->data);
+          remove_list = g_list_prepend (remove_list,
+                                        g_object_ref (tag_iter->data));
         }
     }
 
@@ -792,20 +793,20 @@ gimp_tag_entry_assign_tags (GimpTagEntry *tag_entry)
 
       for (tag_iter = remove_list; tag_iter; tag_iter = g_list_next (tag_iter))
         {
-          gimp_tagged_remove_tag (tagged, GIMP_TAG (tag_iter->data));
+          gimp_tagged_remove_tag (tagged, tag_iter->data);
         }
 
       for (tag_iter = add_list; tag_iter; tag_iter = g_list_next (tag_iter))
         {
-          gimp_tagged_add_tag (tagged, GIMP_TAG (tag_iter->data));
+          gimp_tagged_add_tag (tagged, tag_iter->data);
         }
     }
 
-  g_list_free (add_list);
-  g_list_free (remove_list);
+  g_list_free_full (add_list, (GDestroyNotify) g_object_unref);
+  g_list_free_full (remove_list, (GDestroyNotify) g_object_unref);
 
   /* common tags list with changes applied. */
-  g_list_free (tag_entry->common_tags);
+  g_list_free_full (tag_entry->common_tags, (GDestroyNotify) g_object_unref);
   tag_entry->common_tags = common_tags;
 }
 
@@ -903,7 +904,7 @@ gimp_tag_entry_set_selected_items (GimpTagEntry *tag_entry,
 
   if (tag_entry->common_tags)
     {
-      g_list_free (tag_entry->common_tags);
+      g_list_free_full (tag_entry->common_tags, (GDestroyNotify) g_object_unref);
       tag_entry->common_tags = NULL;
     }
 
@@ -956,7 +957,7 @@ gimp_tag_entry_load_selection (GimpTagEntry *tag_entry,
         }
     }
 
-  g_hash_table_foreach (refcounts, gimp_tag_entry_find_common_tags,tag_entry);
+  g_hash_table_foreach (refcounts, gimp_tag_entry_find_common_tags, tag_entry);
 
   g_hash_table_destroy (refcounts);
 
@@ -996,7 +997,8 @@ gimp_tag_entry_find_common_tags (gpointer key,
   /* FIXME: more efficient list length */
   if (ref_count == g_list_length (tag_entry->selected_items))
     {
-      tag_entry->common_tags = g_list_prepend (tag_entry->common_tags, key);
+      tag_entry->common_tags = g_list_prepend (tag_entry->common_tags,
+                                               g_object_ref (key));
     }
 }
 
@@ -1215,7 +1217,7 @@ gimp_tag_entry_container_changed (GimpContainer *container,
         {
           if (gimp_tagged_get_tags (GIMP_TAGGED (list->data)) &&
               gimp_container_have (GIMP_CONTAINER (tag_entry->container),
-                                   GIMP_OBJECT(list->data)))
+                                   GIMP_OBJECT (list->data)))
             {
               break;
             }