master 3b65fb7 1/2: Fix segfault on closing frame with tooltip (Bug#41239)

[Noam Postavsky]

branch: master
commit 3b65fb7658c2717457c033c6704cf3b007804226
Author: Noam Postavsky <address@hidden>
Commit: Noam Postavsky <address@hidden>

    Fix segfault on closing frame with tooltip (Bug#41239)
    
    * src/gtkutil.c (xg_free_frame_widgets): Empty and unreference the
    tooltip widget before destroying its label.
---
 src/gtkutil.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/gtkutil.c b/src/gtkutil.c
index 681f86f..5d1ce6d 100644
--- a/src/gtkutil.c
+++ b/src/gtkutil.c
@@ -1404,10 +1404,15 @@ xg_free_frame_widgets (struct frame *f)
       FRAME_X_WINDOW (f) = 0; /* Set to avoid XDestroyWindow in xterm.c */
       FRAME_X_RAW_DRAWABLE (f) = 0;
       FRAME_GTK_OUTER_WIDGET (f) = 0;
+      if (x->ttip_widget)
+        {
+          /* Remove ttip_lbl from ttip_widget's custom slot before
+             destroying it, to avoid double-free (Bug#41239).  */
+          gtk_tooltip_set_custom (x->ttip_widget, NULL);
+          g_object_unref (G_OBJECT (x->ttip_widget));
+        }
       if (x->ttip_lbl)
         gtk_widget_destroy (x->ttip_lbl);
-      if (x->ttip_widget)
-        g_object_unref (G_OBJECT (x->ttip_widget));
     }
 }