File 0006-src-gtkutil.c-xg_update_menu_item-Avoid-race-conditi.patch of Package emacs

From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Bidar?= <bjorn.bidar@thaodan.de>
Date: Wed, 10 Apr 2024 04:50:48 +0300
Subject: [PATCH] * src/gtkutil.c(xg_update_menu_item): Avoid race conditions

Make sure we keep a reference to wlbl and wkey since we
use them later down and don't want to be freed even if the corresponding
widget gets destroyed to avoid race conditions, e.g. in case a frame
dies while the menu is still in construction.

If we don't GTK will crash in GTK_IS_LABEL aka
G_TYPE_CHECK_INSTANCE_TYPE when we call gtk_label_get_label(label).
---
 src/gtkutil.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/src/gtkutil.c b/src/gtkutil.c
index c067f7b53ac1e8985766a627aeff8609609646f1..6ed6d9ac6e5bf200514fc96c23b9b0e48947ecc5 100644
--- a/src/gtkutil.c
+++ b/src/gtkutil.c
@@ -3791,15 +3791,23 @@ xg_update_menu_item (widget_value *val,
 
       wlbl = GTK_LABEL (list->data);
       wkey = GTK_LABEL (list->next->data);
+      /* Make sure we keep a reference to wlbl and wkey since we
+	 use them later down and don't want to be freed even if the corresponding widget
+	 gets destroyed to avoid race conditions, e.g. in case a frame
+	 dies while the menu is still in construction.
+
+	 If we don't GTK will crash in GTK_IS_LABEL aka G_TYPE_CHECK_INSTANCE_TYPE
+	 when we call gtk_label_get_label(label).
+      */
+      g_object_ref (G_OBJECT (wlbl));
+      g_object_ref (G_OBJECT (wkey));
       g_list_free (list);
 
       if (! utf8_key)
         {
           /* Remove the key and keep just the label.  */
-          g_object_ref (G_OBJECT (wlbl));
           gtk_container_remove (GTK_CONTAINER (w), wchild);
           gtk_container_add (GTK_CONTAINER (w), GTK_WIDGET (wlbl));
-          g_object_unref (G_OBJECT (wlbl));
           wkey = 0;
         }
 
@@ -3816,11 +3824,13 @@ xg_update_menu_item (widget_value *val,
 
           wlbl = GTK_LABEL (list->data);
           wkey = GTK_LABEL (list->next->data);
+	  g_object_ref(G_OBJECT (wkey));
           g_list_free (list);
 
           gtk_container_remove (GTK_CONTAINER (w), wchild);
           gtk_container_add (GTK_CONTAINER (w), wtoadd);
         }
+      g_object_ref(G_OBJECT (wlbl));
     }
 
   if (wkey) old_key = gtk_label_get_label (wkey);
@@ -3869,6 +3879,13 @@ xg_update_menu_item (widget_value *val,
         }
     }
 
+  /* Check if both objects below still exists or have been freed
+     otherwise before */
+  if (G_IS_OBJECT(wkey))
+    g_object_unref(G_OBJECT(wkey));
+  if (G_IS_OBJECT(wlbl))
+    g_object_unref (G_OBJECT (wlbl));
+
   if (label_changed) /* See comment in xg_update_menubar.  */
     g_object_notify (G_OBJECT (w), "label");
 }