From 91b523054febe7c9bea327e9596e8da5ff94f20e Mon Sep 17 00:00:00 2001
From: Alex Wilson <yourpalal2@gmail.com>
Date: Wed, 28 Mar 2012 00:17:27 +1300
Subject: [PATCH] Resolve TODO about possible use after free bug.

---
 src/servers/notification/AppGroupView.cpp       |  9 ++++-----
 src/servers/notification/NotificationWindow.cpp | 11 +++++++++++
 src/servers/notification/NotificationWindow.h   |  4 ++++
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/src/servers/notification/AppGroupView.cpp b/src/servers/notification/AppGroupView.cpp
index eee5fdd938..9266c3aa4c 100644
--- a/src/servers/notification/AppGroupView.cpp
+++ b/src/servers/notification/AppGroupView.cpp
@@ -185,11 +185,10 @@ AppGroupView::AddInfo(NotificationView* view)
 
 		for (int32 i = 0; i < children; i++) {
 			if (id == fInfo[i]->MessageID()) {
-				// TODO: because NotificationWindow also tracks these
-				// views, we may be heading towards a use-after-free with
-				// this code.
-				GetLayout()->RemoveView(fInfo[i]);
-				delete fInfo[i];
+				NotificationView* oldView = fInfo[i];
+				fParent->NotificationViewSwapped(oldView, view);
+				GetLayout()->RemoveView(oldView);
+				delete oldView;
 				
 				fInfo[i] = view;
 				found = true;
diff --git a/src/servers/notification/NotificationWindow.cpp b/src/servers/notification/NotificationWindow.cpp
index 6c41d4f74f..8ab97941e4 100644
--- a/src/servers/notification/NotificationWindow.cpp
+++ b/src/servers/notification/NotificationWindow.cpp
@@ -324,6 +324,17 @@ NotificationWindow::_ShowHide()
 }
 
 
+void
+NotificationWindow::NotificationViewSwapped(NotificationView* stale,
+	NotificationView* fresh)
+{
+	views_t::iterator it = find(fViews.begin(), fViews.end(), stale);
+
+	if (it != fViews.end())
+		*it = fresh;
+}
+
+
 void
 NotificationWindow::SetPosition()
 {
diff --git a/src/servers/notification/NotificationWindow.h b/src/servers/notification/NotificationWindow.h
index 9837c18deb..76dcc83509 100644
--- a/src/servers/notification/NotificationWindow.h
+++ b/src/servers/notification/NotificationWindow.h
@@ -57,6 +57,10 @@ public:
 private:
 	friend class AppGroupView;
 
+			void					NotificationViewSwapped(
+										NotificationView* stale,
+										NotificationView* fresh);
+
 			void					SetPosition();
 			void					_LoadSettings(bool startMonitor = false);
 			void					_LoadAppFilters(bool startMonitor = false);