Deepfriedice
commented
10 months ago Apologies if I'm butting in here. I don't really know the process for contributing but I thought I'd try to help since this issue is bothering me.
This looks like it's caused by the ordering of events in the itemlist_remove_item function in itemlist.c:449 :
/* hard unconditional item remove */
void
itemlist_remove_item (itemPtr item)
{
if (itemlist->priv->selectedId == item->id) {
itemlist_set_selected (NULL);
itemlist->priv->deferredRemove = FALSE;
}
itemlist_duplicate_list_remove_item (item);
itemview_remove_item (item);
itemview_update ();
db_item_remove (item->id);
/* update feed list counters*/
vfolder_foreach (node_update_counters);
node_update_counters (node_from_id (item->nodeId));
item_unload (item);
g_signal_emit_by_name (itemlist, "item-updated", item->nodeId);
}item_unload seems to be just an alias for g_object_unref (item.h:106), so the last two lines here are decrementing the reference count (which seems to reliably trigger a free) and then trying to access the nodeId field. I belive nodeId is getting overwitten after the free, and then g_signal_emit_by_name is trying to dereference it, casuing the segfault.
I don't know what g_signal_emit_by_name is responsible for here, but I suspect these last two lines can be swapped, so that we emit the signal first and then free the _LifereaItem struct? I tried this locally and it seems to work, but I'm not sure how to run Liferea's tests.
rich-coe
lwindolf
v1.15.0 103cb6a
In the subscription list for a feed, selected the last (newest) item. Got a SIGSEGV.
libglib-2_0-0-2.76.4-1.1.x86_64 libgtk-3-0-3.24.38-1.2.x86_64 libsoup-3_0-0-3.4.2-1.1.x86_64 libwebkit2gtk-4_1-0-2.40.4-1.1.x86_64