embed: avoid memory corruption when clearing top widgets

Don't call remove_from_destroy_list_cb, which modifies the destroy list,
when already iterating through the list.

https://bugzilla.gnome.org/show_bug.cgi?id=779180

1 files changed, 13 insertions, 9 deletions

diff --git a/embed/ephy-embed.c b/embed/ephy-embed.c
index b12516e86..d8f2c1631 100644
--- a/embed/ephy-embed.c
+++ b/embed/ephy-embed.c
@@ -219,15 +219,6 @@ ephy_embed_statusbar_pop (EphyEmbed *embed, guint context_id)
 }
 
 static void
-ephy_embed_destroy_top_widgets (EphyEmbed *embed)
-{
-  GSList *iter;
-
-  for (iter = embed->destroy_on_transition_list; iter; iter = iter->next)
-    gtk_widget_destroy (GTK_WIDGET (iter->data));
-}
-
-static void
 remove_from_destroy_list_cb (GtkWidget *widget, EphyEmbed *embed)
 {
   GSList *list;
@@ -238,6 +229,19 @@ remove_from_destroy_list_cb (GtkWidget *widget, EphyEmbed *embed)
 }
 
 static void
+ephy_embed_destroy_top_widgets (EphyEmbed *embed)
+{
+  GSList *iter;
+
+  for (iter = embed->destroy_on_transition_list; iter; iter = iter->next) {
+    g_signal_handlers_disconnect_by_func (iter->data, remove_from_destroy_list_cb, embed);
+    gtk_widget_destroy (GTK_WIDGET (iter->data));
+  }
+
+  embed->destroy_on_transition_list = NULL;
+}
+
+static void
 ephy_embed_set_title (EphyEmbed  *embed,
                       const char *title)
 {