GtkLabel with markup - segfault when label content changes while copying the link to clipboard

[Suren Karapetyan <surenkarapetyan gmail com>]

Hi all.

I've been trying to fix a bug 
(https://bugzilla.redhat.com/show_bug.cgi?id=1219982) with 
transmission-remote-gtk.
Was able to narrow it down: when there is a GtkLabel (with markup 
enabled) and you open the context menu on a hyperlink to copy it, but 
before you click "Copy Link Address" the label content is modified (with 
set_markup), you'll end up with a segfault.

So I'm trying to understand if this is intended behavior or a bug. 
Couldn't find anything in the documentation or anywhere else.

A short program to trigger the error follows. Right-click on the 
hyperlink, wait up to 5 seconds for another "label replaced" log line to 
appear and click "Copy Link Address".

Thanks!
Suren

--------------

#include <gtk/gtk.h>

gint TimerCallback (gpointer l) {
    gchar *msg;
    msg = g_malloc(100);
    snprintf(msg, 100,
        "<a href=\"http://www.example.com/\";>http://www.example.com/</a>");
    gtk_label_set_markup(GTK_LABEL(l), msg);
    g_free(msg);
    g_message("%s", "label replaced");
    return 1;
}

static void activate (GtkApplication* app, gpointer user_data) {
    GtkWidget *window;
    GtkWidget *l;
    gchar *msg;

    msg = g_malloc(100);
    l = gtk_label_new(NULL);
    snprintf(msg, 100,
        "<a href=\"http://www.example.com/\";>http://www.example.com/</a>");
    gtk_label_set_markup(GTK_LABEL(l), msg);
    g_free(msg);
    window = gtk_application_window_new (app);
    gtk_container_add(GTK_CONTAINER(window), l);
    gtk_window_set_title(GTK_WINDOW(window), "Window");
    gtk_window_set_default_size (GTK_WINDOW(window), 200, 200);
    gtk_widget_show_all(window);
    g_timeout_add(5000, TimerCallback, l);
}

int main (int argc, char **argv) {
    GtkApplication *app;
    int status;

    app = gtk_application_new("org.gtk.example", G_APPLICATION_FLAGS_NONE);
    g_signal_connect(app, "activate",
        G_CALLBACK(activate), NULL);
    status = g_application_run(G_APPLICATION(app),
        argc, argv);
g_object_unref(app);

    return status;
}