From c91dc83fb0ed8f9340302c8e3a6acb641cf4b6cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marco=20Trevisan=20=28Trevi=C3=B1o=29?= <mail@3v1n0.net>
Date: Fri, 24 May 2024 17:01:25 +0200
Subject: [PATCH] girepository/parser: Clarify ownership of nodetype nodes

We may had free'd a list of items without freeing the items in there.
So now, properly steal the data instead and free everything.
---
 girepository/girparser.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/girepository/girparser.c b/girepository/girparser.c
index 0cf341533..adb9db7f9 100644
--- a/girepository/girparser.c
+++ b/girepository/girparser.c
@@ -2309,7 +2309,7 @@ end_type_top (ParseContext *ctx)
   if (!ctx->type_parameters)
     goto out;
 
-  typenode = (GIIrNodeType*)ctx->type_parameters->data;
+  typenode = (GIIrNodeType *) g_steal_pointer (&ctx->type_parameters->data);
 
   /* Default to pointer for unspecified containers */
   if (typenode->tag == GI_TYPE_TAG_ARRAY ||
@@ -2333,32 +2333,32 @@ end_type_top (ParseContext *ctx)
     case GI_IR_NODE_PARAM:
       {
         GIIrNodeParam *param = (GIIrNodeParam *)ctx->current_typed;
-        param->type = typenode;
+        param->type = g_steal_pointer (&typenode);
       }
       break;
     case GI_IR_NODE_FIELD:
       {
         GIIrNodeField *field = (GIIrNodeField *)ctx->current_typed;
-        field->type = typenode;
+        field->type = g_steal_pointer (&typenode);
       }
       break;
     case GI_IR_NODE_PROPERTY:
       {
         GIIrNodeProperty *property = (GIIrNodeProperty *) ctx->current_typed;
-        property->type = typenode;
+        property->type = g_steal_pointer (&typenode);
       }
       break;
     case GI_IR_NODE_CONSTANT:
       {
         GIIrNodeConstant *constant = (GIIrNodeConstant *)ctx->current_typed;
-        constant->type = typenode;
+        constant->type = g_steal_pointer (&typenode);
       }
       break;
     default:
       g_printerr("current node is %d\n", CURRENT_NODE (ctx)->type);
       g_assert_not_reached ();
     }
-  g_list_free (ctx->type_parameters);
+  g_list_free_full (ctx->type_parameters, (GDestroyNotify) gi_ir_node_free);
 
  out:
   ctx->type_depth = 0;
@@ -2374,7 +2374,7 @@ end_type_recurse (ParseContext *ctx)
 
   parent = (GIIrNodeType *) ((GList*)ctx->type_stack->data)->data;
   if (ctx->type_parameters)
-    param = (GIIrNodeType *) ctx->type_parameters->data;
+    param = (GIIrNodeType *) g_steal_pointer (&ctx->type_parameters->data);
 
   if (parent->tag == GI_TYPE_TAG_ARRAY ||
       parent->tag == GI_TYPE_TAG_GLIST ||
@@ -2383,7 +2383,7 @@ end_type_recurse (ParseContext *ctx)
       g_assert (param != NULL);
 
       if (parent->parameter_type1 == NULL)
-        parent->parameter_type1 = param;
+        parent->parameter_type1 = g_steal_pointer (&param);
       else
         g_assert_not_reached ();
     }
@@ -2392,13 +2392,14 @@ end_type_recurse (ParseContext *ctx)
       g_assert (param != NULL);
 
       if (parent->parameter_type1 == NULL)
-        parent->parameter_type1 = param;
+        parent->parameter_type1 = g_steal_pointer (&param);
       else if (parent->parameter_type2 == NULL)
-        parent->parameter_type2 = param;
+        parent->parameter_type2 = g_steal_pointer (&param);
       else
         g_assert_not_reached ();
     }
-  g_list_free (ctx->type_parameters);
+  g_clear_pointer ((GIIrNode **) &param, gi_ir_node_free);
+  g_list_free_full (ctx->type_parameters, (GDestroyNotify) gi_ir_node_free);
   ctx->type_parameters = (GList *)ctx->type_stack->data;
   ctx->type_stack = g_list_delete_link (ctx->type_stack, ctx->type_stack);
 }