From e8b22ca78e7637b24e912184f418430b51223b26 Mon Sep 17 00:00:00 2001
From: Bharath Acharya <abharath@novell.com>
Date: Wed, 09 Jun 2010 04:04:59 +0000
Subject: Bug #607324 - Crash doing table editing.

Double free fixes.
---
diff --git a/gtkhtml/htmlengine-edit-table.c b/gtkhtml/htmlengine-edit-table.c
index c4e7fad..09c1923 100644
--- a/gtkhtml/htmlengine-edit-table.c
+++ b/gtkhtml/htmlengine-edit-table.c
@@ -315,7 +315,8 @@ delete_cells_undo_destroy (HTMLUndoData *undo_data)
 	gint i;
 
 	for (i = 0; i < data->size; i ++)
-		html_object_destroy (HTML_OBJECT (data->cells [i]));
+		if (data->cells [i])
+			html_object_destroy (HTML_OBJECT (data->cells [i]));
 	g_free(data->cells);
 }
 
diff --git a/gtkhtml/htmlobject.c b/gtkhtml/htmlobject.c
index 62114bc..1d9d128 100644
--- a/gtkhtml/htmlobject.c
+++ b/gtkhtml/htmlobject.c
@@ -76,8 +76,6 @@ destroy (HTMLObject *self)
 
 	if (self->redraw_pending) {
 		self->free_pending = TRUE;
-	} else {
-		g_free (self);
 	}
 }
 
--
cgit v0.8.3.1