[gtk] rbtree: Fix a crash in insertion fixup

[Benjamin Otte <otte src gnome org>]

commit af56f06b7b6c1eb3f0aaeb567b79be9182b53555
Author: Benjamin Otte <otte redhat com>
Date:   Sun Jan 20 06:07:52 2019 +0100

    rbtree: Fix a crash in insertion fixup
    
    This got broken in commit a33ff4c6ab3a196b3c71da48e4e650da85d1691c.
    
    Testcase included.

 gtk/gtkrbtree.c              |  4 ++--
 testsuite/gtk/rbtree-crash.c | 17 ++++++++++++++++-
 2 files changed, 18 insertions(+), 3 deletions(-)
---
diff --git a/gtk/gtkrbtree.c b/gtk/gtkrbtree.c
index ebc03504c5..219222b1e8 100644
--- a/gtk/gtkrbtree.c
+++ b/gtk/gtkrbtree.c
@@ -382,9 +382,9 @@ gtk_rb_tree_insert_fixup (GtkRbTree *tree,
                {
                  /* make node a left child */
                  node = p;
+                 gtk_rb_node_rotate_left (tree, node);
                   p = parent (node);
                   pp = parent (p);
-                 gtk_rb_node_rotate_left (tree, node);
                }
              /* recolor and rotate */
               set_black (p);
@@ -411,9 +411,9 @@ gtk_rb_tree_insert_fixup (GtkRbTree *tree,
              if (node == p->left)
                {
                  node = p;
+                 gtk_rb_node_rotate_right (tree, node);
                   p = parent (node);
                   pp = parent (p);
-                 gtk_rb_node_rotate_right (tree, node);
                }
              set_black (p);
              set_red (pp);
diff --git a/testsuite/gtk/rbtree-crash.c b/testsuite/gtk/rbtree-crash.c
index a4b641fea6..7abc6c2d7f 100644
--- a/testsuite/gtk/rbtree-crash.c
+++ b/testsuite/gtk/rbtree-crash.c
@@ -273,6 +273,20 @@ test_crash (void)
   gtk_rb_tree_unref (tree);
 }
 
+static void
+test_crash2 (void)
+{
+  GtkRbTree *tree;
+
+  tree = gtk_rb_tree_new (Node, Aug, augment, NULL, NULL);
+
+  add (tree, 0);
+  add (tree, 0);
+  add (tree, 1);
+
+  gtk_rb_tree_unref (tree);
+}
+
 int
 main (int argc, char *argv[])
 {
@@ -280,7 +294,8 @@ main (int argc, char *argv[])
   setlocale (LC_ALL, "C");
   g_test_bug_base ("http://bugzilla.gnome.org/show_bug.cgi?id=%s";);
 
-  g_test_add_func ("/csrbtree/crash", test_crash);
+  g_test_add_func ("/rbtree/crash", test_crash);
+  g_test_add_func ("/rbtree/crash2", test_crash2);
 
   return g_test_run ();
 }