diff options
| -rw-r--r-- | generic/tkMenu.c | 11 | ||||
| -rw-r--r-- | win/tkWinMenu.c | 6 |
2 files changed, 10 insertions, 7 deletions
diff --git a/generic/tkMenu.c b/generic/tkMenu.c index 15c8031..9ba5a15 100644 --- a/generic/tkMenu.c +++ b/generic/tkMenu.c @@ -982,7 +982,7 @@ MenuWidgetObjCmd( * * Side effects: * Commands may get excecuted; variables may get set; sub-menus may get - * posted. + * posted, the passed menu may be destroyed. * *---------------------------------------------------------------------- */ @@ -991,6 +991,9 @@ int TkInvokeMenu( Tcl_Interp *interp, /* The interp that the menu lives in. */ TkMenu *menuPtr, /* The menu we are invoking. */ + /* Must be protected by Tcl_preserve + * against freeing by the caller + */ int index) /* The zero based index of the item we are * invoking. */ { @@ -1005,11 +1008,6 @@ TkInvokeMenu( goto done; } - /* - * Tk Bug 2d3a81c0: menu may be freed in callback, but menu item is - * preserved. As menu is required to delete menu item later, it segfaults. - */ - Tcl_Preserve(menuPtr); Tcl_Preserve(mePtr); if (mePtr->type == TEAROFF_ENTRY) { Tcl_DString ds; @@ -1067,7 +1065,6 @@ TkInvokeMenu( Tcl_DecrRefCount(commandPtr); } Tcl_Release(mePtr); - Tcl_Release(menuPtr); done: return result; diff --git a/win/tkWinMenu.c b/win/tkWinMenu.c index a07765a..9d9e19c 100644 --- a/win/tkWinMenu.c +++ b/win/tkWinMenu.c @@ -1240,11 +1240,17 @@ TkWinHandleMenuEvent( interp = menuPtr->interp; Tcl_Preserve(interp); + /* + * Tk Bug 2d3a81c0: menu may be freed in callback, but menu item is + * preserved. As menu is required to delete menu item later, it segfaults. + */ + Tcl_Preserve(menuPtr); code = TkInvokeMenu(interp, menuPtr, mePtr->index); if (code != TCL_OK && code != TCL_CONTINUE && code != TCL_BREAK) { Tcl_AddErrorInfo(interp, "\n (menu invoke)"); Tcl_BackgroundException(interp, code); } + Tcl_Release(menuPtr); Tcl_Release(interp); *plResult = 0; returnResult = 1; |