File 0006-src-gtkutil.c-xg_update_menu_item-Avoid-race-conditi.patch of Package emacs

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Bidar?= <bjorn.bidar@thaodan.de>
Date: Wed, 10 Apr 2024 04:50:48 +0300
Subject: [PATCH] * src/gtkutil.c(xg_update_menu_item): Avoid race conditions

Make sure we keep a reference to wlbl and wkey since we
use them later down and don't want to be freed even if the corresponding
widget gets destroyed to avoid race conditions, e.g. in case a frame
dies while the menu is still in construction.

If we don't GTK will crash in GTK_IS_LABEL aka
G_TYPE_CHECK_INSTANCE_TYPE when we call gtk_label_get_label(label).
---
 src/gtkutil.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/src/gtkutil.c b/src/gtkutil.c
index 0e9dd4dfe11c50a62a554ef3ea94db2ea0d24459..0d2defc0a987a42568a4c0be27191f6df3baaa8e 100644
--- a/src/gtkutil.c
+++ b/src/gtkutil.c
@@ -3791,15 +3791,23 @@ xg_update_menu_item (widget_value *val,
 
       wlbl = GTK_LABEL (list->data);
       wkey = GTK_LABEL (list->next->data);
+      /* Make sure we keep a reference to wlbl and wkey since we
+	 use them later down and don't want to be freed even if the corresponding widget
+	 gets destroyed to avoid race conditions, e.g. in case a frame
+	 dies while the menu is still in construction.
+
+	 If we don't GTK will crash in GTK_IS_LABEL aka G_TYPE_CHECK_INSTANCE_TYPE
+	 when we call gtk_label_get_label(label).
+      */
+      g_object_ref (G_OBJECT (wlbl));
+      g_object_ref (G_OBJECT (wkey));
       g_list_free (list);
 
       if (! utf8_key)
         {
           /* Remove the key and keep just the label.  */
-          g_object_ref (G_OBJECT (wlbl));
           gtk_container_remove (GTK_CONTAINER (w), wchild);
           gtk_container_add (GTK_CONTAINER (w), GTK_WIDGET (wlbl));
-          g_object_unref (G_OBJECT (wlbl));
           wkey = 0;
         }
 
@@ -3816,11 +3824,13 @@ xg_update_menu_item (widget_value *val,
 
           wlbl = GTK_LABEL (list->data);
           wkey = GTK_LABEL (list->next->data);
+	  g_object_ref(G_OBJECT (wkey));
           g_list_free (list);
 
           gtk_container_remove (GTK_CONTAINER (w), wchild);
           gtk_container_add (GTK_CONTAINER (w), wtoadd);
         }
+      g_object_ref(G_OBJECT (wlbl));
     }
 
   if (wkey) old_key = gtk_label_get_label (wkey);
@@ -3869,6 +3879,13 @@ xg_update_menu_item (widget_value *val,
         }
     }
 
+  /* Check if both objects below still exists or have been freed
+     otherwise before */
+  if (G_IS_OBJECT(wkey))
+    g_object_unref(G_OBJECT(wkey));
+  if (G_IS_OBJECT(wlbl))
+    g_object_unref (G_OBJECT (wlbl));
+
   if (label_changed) /* See comment in xg_update_menubar.  */
     g_object_notify (G_OBJECT (w), "label");
 }