From 28c8dbf128e5ad84437476b1a8841fff3ec9519a Mon Sep 17 00:00:00 2001
From: Robin Gareus <robin@gareus.org>
Date: Wed, 20 Aug 2025 16:18:04 +0200
Subject: [PATCH] Handle special case of using unmanaged widgets to Frame

This happens in in Ardour's Preference dialog with
e.g. BufferingOptions:

~OptionEditorContainer deletes the Option, which in turn
deletes the Widget BufferingOptions:_buffering_presets_combo
Since the widget is not managed it is not removed from its
parent.

Later ~OptionEditorContainer disposes the page layout, which
eventually also calls the Frame d'tor, causing a heap-use-after-free.
---
 libs/widgets/frame.cc        | 8 ++++++++
 libs/widgets/widgets/frame.h | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/libs/widgets/frame.cc b/libs/widgets/frame.cc
index 8068ccb83d..6cd16dfb1f 100644
--- a/libs/widgets/frame.cc
+++ b/libs/widgets/frame.cc
@@ -64,6 +64,13 @@ Frame::~Frame ()
 	}
 }
 
+void
+Frame::child_destroyed (GtkWidget*, gpointer data)
+{
+	Frame* self = static_cast<Frame*>(data);
+	self->_w = 0;
+}
+
 void
 Frame::on_add (Widget* w)
 {
@@ -73,6 +80,7 @@ Frame::on_add (Widget* w)
 
 	Bin::on_add (w);
 	_w = w;
+	g_signal_connect (w->gobj(), "destroy", G_CALLBACK(child_destroyed), this);
 	queue_resize ();
 }
 
diff --git a/libs/widgets/widgets/frame.h b/libs/widgets/widgets/frame.h
index c349ad6afd..5a1ef00e14 100644
--- a/libs/widgets/widgets/frame.h
+++ b/libs/widgets/widgets/frame.h
@@ -56,6 +56,8 @@ protected:
 	void on_style_changed (const Glib::RefPtr<Gtk::Style>&);
 	void on_name_changed ();
 
+	static void child_destroyed (GtkWidget*, gpointer);
+
 private:
 	Glib::RefPtr<Gtk::Style> get_parent_style ();