[evolution-patches] [GTKHtml]Fix for bug 332717 "Copy-Paste signature cause Evolution to crash"

[jeff cai <Jeff Cai Sun COM>]

Hi,
the patch foucuses on two points:
1. A glist should not be freed twice.
2. A glist should be freed from the header while not from some elements
amid it.

So I add some temporary varialbes and glist objects to ensure this.


Jeff Cai

Index: src/ChangeLog
===================================================================
RCS file: /cvs/gnome/gtkhtml/src/ChangeLog,v
retrieving revision 1.2167
diff -u -r1.2167 ChangeLog
--- src/ChangeLog	27 Feb 2006 12:50:28 -0000	1.2167
+++ src/ChangeLog	28 Feb 2006 10:02:35 -0000
@@ -1,3 +1,10 @@
+2006-02-28  Jeff Cai <jeff cai sun com>
+
+	* htmlengine-edit-cut-and-paste.c: (remove_empty_and_merge):
+	Clone glist in case that it is be freed twice.
+
+	Fixes bug #332717
+
 2006-02-27  Rohini S  <srohini novell com>
 
 	* htmlengine.c (new_parse_body, parse_one_token):
Index: src/htmlengine-edit-cut-and-paste.c
===================================================================
RCS file: /cvs/gnome/gtkhtml/src/htmlengine-edit-cut-and-paste.c,v
retrieving revision 1.115
diff -u -r1.115 htmlengine-edit-cut-and-paste.c
--- src/htmlengine-edit-cut-and-paste.c	27 Jan 2006 07:58:20 -0000	1.115
+++ src/htmlengine-edit-cut-and-paste.c	28 Feb 2006 10:02:36 -0000
@@ -224,10 +224,19 @@
 }
 
 static void
-remove_empty_and_merge (HTMLEngine *e, gboolean merge, GList *left, GList *right, HTMLCursor *c)
+remove_empty_and_merge (HTMLEngine *e, gboolean merge, GList *left_orig, GList *right_orig, HTMLCursor *c)
 {
 	HTMLObject *lo, *ro, *prev;
 
+	GList *left, *right;
+	GList *left_old, *right_old;
+
+	left_old = g_list_copy (left_orig);
+	right_old = g_list_copy (right_orig);
+
+	left = left_old;
+	right = right_old;
+
 #ifdef OP_DEBUG
 	/* HTMLObject *left_orig = left->data; */
 	printf ("before merge\n");
@@ -310,7 +319,22 @@
 		}
 
 		if (merge && lo && ro) {
-			if (!html_object_merge (lo, ro, e, &left, &right, c))
+			GList *left_copy, *right_copy;
+			gboolean merge_flag;
+
+			left_copy = g_list_copy (left);
+			right_copy = g_list_copy (right);
+			merge_flag = html_object_merge (lo, ro, e, &left_copy, &right_copy, c);
+
+			g_list_free (left_old);
+			g_list_free (right_old);
+
+			left = left_copy;
+			right = right_copy;
+			left_old = left;
+			right_old = right;
+
+			if (!merge_flag)
 				break;
 			if (ro == e->cursor->object) {
 				e->cursor->object  = lo;
@@ -324,6 +348,9 @@
 		e->cursor->object = prev;
 		e->cursor->offset = html_object_get_length (e->cursor->object);
 	}
+
+	g_list_free (left_old);
+	g_list_free (right_old);
 #ifdef OP_DEBUG
 	/* printf ("-- finished\n");
 	   gtk_html_debug_dump_tree_simple (left_orig, 0); */