Comment 0 for bug 787736

Binary package hint: appmenu-gtk

The rebuild function creates a hash table mapping the toplevel to the g_timeout id responsible for doing the refresh.

The rebuild function allocates a RebuildData object to pass to the do_rebuild idle function. The do_rebuild callback function frees this object when it is called.

However, the do_rebuild function isn't guaranteed to be called. In fact the whole point of the hash table seems to be that the callback can be canceled. When that happens, the RebuildData object isn't freed, causing a leak.

Additionally, instead of storing a proper reference to the toplevel in the RebuldData object, a weak pointer is stored instead. But if the weak pointer gets set to null, the do_rebuld function will lose its only copy of that pointer, so it will have no way of cleaning up the associated entry in the hash table.