clutter/actor: Get next action from list before handling current action

Handling the current action might end up removing the current element
from the list, which would result in an invalid read when trying to get
the next element. Before glib 2.76 this was covered up by the use of the
slice allocator, but now this leads to a crash.

This was happening with the click action on the clear icon in the shell
search entry, which when clicked results in the clear icon being removed
along with the corresponding action.

Closes: https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/6552
Part-of: <https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/2955>

1 files changed, 5 insertions, 4 deletions

diff --git a/clutter/clutter/clutter-actor.c b/clutter/clutter/clutter-actor.c
index 75f86e44b..5b7a430cb 100644
--- a/clutter/clutter/clutter-actor.c
+++ b/clutter/clutter/clutter-actor.c
@@ -11972,20 +11972,21 @@ clutter_actor_run_actions (ClutterActor       *self,
                            ClutterEventPhase   phase)
 {
   ClutterActorPrivate *priv;
-  const GList *actions, *l;
+  const GList *l;
   gboolean retval = CLUTTER_EVENT_PROPAGATE;
 
   priv = self->priv;
   if (!priv->actions)
     return CLUTTER_EVENT_PROPAGATE;
 
-  actions = _clutter_meta_group_peek_metas (priv->actions);
-
-  for (l = actions; l; l = l->next)
+  l = _clutter_meta_group_peek_metas (priv->actions);
+  while (l)
     {
       ClutterAction *action = l->data;
       ClutterEventPhase action_phase;
 
+      l = l->next;
+
       action_phase = clutter_action_get_phase (action);
 
       if (action_phase == phase)