[gimp/gimp-2-10] Issue #2227 - GIMP 2.10.6 crashes with assertion GIMP_IS_TAGGED in...

[Michael Natterer <mitch src gnome org>]

commit 0731fa3f357f25ad46932424ee4a21a620793d21
Author: Michael Natterer <mitch gimp org>
Date:   Wed Jan 1 00:22:54 2020 +0100

    Issue #2227 - GIMP 2.10.6 crashes with assertion GIMP_IS_TAGGED in...
    
    ...MyPaint brushes dialog
    
    In gimp_tag_entry_assign_tags(), don't add/remove tags while iterating
    tag_entry->selected_items, because that might change the list. Instead,
    make a temporary deep copy of the list and iterate the copy. Spotted
    by Massimo.
    
    (cherry picked from commit ff32fe9f5d6aab977cd024fdad7d4049635813a7)

 app/widgets/gimptagentry.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)
---
diff --git a/app/widgets/gimptagentry.c b/app/widgets/gimptagentry.c
index 85f46b2567..578899fce0 100644
--- a/app/widgets/gimptagentry.c
+++ b/app/widgets/gimptagentry.c
@@ -736,6 +736,7 @@ gimp_tag_entry_assign_tags (GimpTagEntry *tag_entry)
   gint    i;
   GList  *resource_iter;
   GList  *tag_iter;
+  GList  *selected_items;
   GList  *dont_remove_list = NULL;
   GList  *remove_list      = NULL;
   GList  *add_list         = NULL;
@@ -781,7 +782,14 @@ gimp_tag_entry_assign_tags (GimpTagEntry *tag_entry)
 
   g_list_free (dont_remove_list);
 
-  for (resource_iter = tag_entry->selected_items;
+  /* duplicate tag_entry->selected_items for the add/remove loop
+   * because adding/removing can change tag_entry->selected_items.
+   * See Issue #2227.
+   */
+  selected_items = g_list_copy_deep (tag_entry->selected_items,
+                                     (GCopyFunc) g_object_ref, NULL);
+
+  for (resource_iter = selected_items;
        resource_iter;
        resource_iter = g_list_next (resource_iter))
     {
@@ -798,6 +806,8 @@ gimp_tag_entry_assign_tags (GimpTagEntry *tag_entry)
         }
     }
 
+  g_list_free_full (selected_items, (GDestroyNotify) g_object_unref);
+
   g_list_free_full (add_list,    (GDestroyNotify) g_object_unref);
   g_list_free_full (remove_list, (GDestroyNotify) g_object_unref);