Fixed bug [1501749fff] - Crash on embedded window deletion bound to <Map> event

2 files changed, 27 insertions, 6 deletions

diff --git a/generic/tkTextWind.c b/generic/tkTextWind.c
index bd61d75..c9fc20f 100644
--- a/generic/tkTextWind.c
+++ b/generic/tkTextWind.c
@@ -1134,6 +1134,16 @@ TkTextEmbWinDisplayProc(
 	    &lineX, &windowY, &width, &height);
     windowX = lineX - chunkPtr->x + x;
 
+    /*
+     * Mark the window as displayed so that it won't get unmapped.
+     * This needs to be done before the next instruction block because
+     * Tk_MaintainGeometry/Tk_MapWindow will run event handlers, in
+     * particular for the <Map> event, and if the bound script deletes
+     * the embedded window its clients will get freed.
+     */
+
+    client->displayed = 1;
+
     if (textPtr->tkwin == Tk_Parent(tkwin)) {
 	if ((windowX != Tk_X(tkwin)) || (windowY != Tk_Y(tkwin))
 		|| (Tk_ReqWidth(tkwin) != Tk_Width(tkwin))
@@ -1145,12 +1155,6 @@ TkTextEmbWinDisplayProc(
 	Tk_MaintainGeometry(tkwin, textPtr->tkwin, windowX, windowY,
 		width, height);
     }
-
-    /*
-     * Mark the window as displayed so that it won't get unmapped.
-     */
-
-    client->displayed = 1;
 }
 
 /*
diff --git a/tests/textWind.test b/tests/textWind.test
index c3483e6..27b7309 100644
--- a/tests/textWind.test
+++ b/tests/textWind.test
@@ -1458,6 +1458,23 @@ test textWind-17.10 {peer widget window configuration} -setup {
     destroy .tt .t
 }  -result {{-window {} {} {} {}} {-window {} {} {} {}} {-window {} {} {} .t.f} {-window {} {} {} .tt.t.f}}
 
+test textWind-18.1 {embedded window deletion triggered by a script bound to <Map>} -setup {
+    catch {destroy .t .f .f2}
+} -body {
+    pack [text .t]
+    for {set i 1} {$i < 100} {incr i} {.t insert end "Line $i\n"}
+    .t window create end -window [frame .f -background red -width 80 -height 80]
+    .t window create end -window [frame .f2 -background blue -width 80 -height 80]
+    bind .f <Map> {.t delete .f}
+    update
+    # this shall not crash (bug 1501749)
+    after 100 {.t yview end}
+    tkwait visibility .f2
+    update
+} -cleanup {
+    destroy .t .f .f2
+} -result {}
+
 option clear
 
 # cleanup