Fixed bug [1501749fff] - Crash on embedded window deletion bound to <Map> event

2 files changed, 24 insertions, 6 deletions

diff --git a/generic/tkTextWind.c b/generic/tkTextWind.c
index 8d1f850..5b511d2 100644
--- a/generic/tkTextWind.c
+++ b/generic/tkTextWind.c
@@ -1123,6 +1123,16 @@ TkTextEmbWinDisplayProc(
 	    &lineX, &windowY, &width, &height);
     windowX = lineX - chunkPtr->x + x;
 
+    /*
+     * Mark the window as displayed so that it won't get unmapped.
+     * This needs to be done before the next instruction block because
+     * Tk_MaintainGeometry/Tk_MapWindow will run event handlers, in
+     * particular for the <Map> event, and if the bound script deletes
+     * the embedded window its clients will get freed.
+     */
+
+    client->displayed = 1;
+
     if (textPtr->tkwin == Tk_Parent(tkwin)) {
 	if ((windowX != Tk_X(tkwin)) || (windowY != Tk_Y(tkwin))
 		|| (Tk_ReqWidth(tkwin) != Tk_Width(tkwin))
@@ -1134,12 +1144,6 @@ TkTextEmbWinDisplayProc(
 	Tk_MaintainGeometry(tkwin, textPtr->tkwin, windowX, windowY,
 		width, height);
     }
-
-    /*
-     * Mark the window as displayed so that it won't get unmapped.
-     */
-
-    client->displayed = 1;
 }
 
 /*
diff --git a/tests/textWind.test b/tests/textWind.test
index 79dca50..2e16f7b 100644
--- a/tests/textWind.test
+++ b/tests/textWind.test
@@ -1023,6 +1023,20 @@ test textWind-17.9 {peer widget window configuration} {
     set res
 } {{-window {} {} {} {}} {-window {} {} {} {}} {-window {} {} {} .t.f} {-window {} {} {} .tt.t.f}}
 
+test textWind-18.1 {embedded window deletion triggered by a script bound to <Map>} {
+    catch {destroy .t .f}
+    pack [text .t]
+    for {set i 1} {$i < 100} {incr i} {.t insert end "Line $i\n"}
+    .t window create end -window [frame .f -background red -width 80 -height 80]
+    .t window create end -window [frame .f2 -background blue -width 80 -height 80]
+    bind .f <Map> {.t delete .f}
+    update
+    # this shall not crash (bug 1501749)
+    after 100 {.t yview end}
+    tkwait visibility .f2
+    update
+} {}
+
 catch {destroy .t}
 option clear