Script 'mail_helper' called by obssrc
Hello community,

here is the log from the commit of package ibus for openSUSE:Factory checked in 
at 2026-09-08 16:51:26
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/ibus (Old)
 and      /work/SRC/openSUSE:Factory/.ibus.new.1265 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "ibus"

Tue Sep  8 16:51:26 2026 rev:139 rq:1376193 version:1.5.34

Changes:
--------
--- /work/SRC/openSUSE:Factory/ibus/ibus.changes        2026-07-14 
13:45:23.857699633 +0200
+++ /work/SRC/openSUSE:Factory/.ibus.new.1265/ibus.changes      2026-09-08 
16:51:28.886333921 +0200
@@ -1,0 +2,7 @@
+Mon Sep  7 14:40:28 UTC 2026 - Dominique Leuenberger <[email protected]>
+
+- Backport patches to fix crashes with GNOME 51 (boo#1279542):
+  + 1a331e695d84fc6bae8f2d11c52d4776df49647b.patch
+  + 5bbe88a1936246185a65f76e58cc85871401e59a.patch
+
+-------------------------------------------------------------------

New:
----
  1a331e695d84fc6bae8f2d11c52d4776df49647b.patch
  5bbe88a1936246185a65f76e58cc85871401e59a.patch

----------(New B)----------
  New:- Backport patches to fix crashes with GNOME 51 (boo#1279542):
  + 1a331e695d84fc6bae8f2d11c52d4776df49647b.patch
  + 5bbe88a1936246185a65f76e58cc85871401e59a.patch
  New:  + 1a331e695d84fc6bae8f2d11c52d4776df49647b.patch
  + 5bbe88a1936246185a65f76e58cc85871401e59a.patch
----------(New E)----------

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ ibus.spec ++++++
--- /var/tmp/diff_new_pack.bgFs4N/_old  2026-09-08 16:51:29.781371433 +0200
+++ /var/tmp/diff_new_pack.bgFs4N/_new  2026-09-08 16:51:29.783371517 +0200
@@ -65,6 +65,8 @@
 # PATCH-FIX-SLE ibus-disable-engines-preload-in-GNOME.patch bnc#1036729 
[email protected]
 # Disable ibus engines preload in GNOME for These works are handled by 
gnome-shell.
 Patch12:        ibus-disable-engines-preload-in-GNOME.patch
+Patch13:        
https://github.com/ibus/ibus/commit/5bbe88a1936246185a65f76e58cc85871401e59a.patch
+Patch14:        
https://github.com/ibus/ibus/commit/1a331e695d84fc6bae8f2d11c52d4776df49647b.patch
 BuildRequires:  pkgconfig(dbusmenu-glib-0.4)
 BuildRequires:  pkgconfig(dbusmenu-gtk3-0.4)
 BuildRequires:  pkgconfig(glib-2.0) >= 2.84.0
@@ -217,6 +219,8 @@
 %patch -P 10 -p1
 %patch -P 11 -p1
 %patch -P 12 -p1
+%patch -P 13 -p1
+%patch -P 14 -p1
 
 %build
 %configure --disable-static \

++++++ 1a331e695d84fc6bae8f2d11c52d4776df49647b.patch ++++++
>From 1a331e695d84fc6bae8f2d11c52d4776df49647b Mon Sep 17 00:00:00 2001
From: Sebastian Keller <[email protected]>
Date: Thu, 27 Aug 2026 21:07:58 +0200
Subject: [PATCH] src: Fix IBusAttrList leak when converting text

After 5bbe88a1 the attribute list set on the text was getting leaked
when the list passed to `ibus_attr_list_copy_format_to_*()` had a length
of 0. In that case the list is already non-floating before the copy
function adds a ref and returns it. This then is passed to
`ibus_text_set_attributes()` which calls `g_object_ref_sink()`. Since
the list is not floating, this adds another ref that would not be added
in the length > 0 case. This surplus ref is causing the list to be
leaked.

To fix this leak we need to unref the list after calling
`ibus_text_set_attributes()`.

However in the length > 0 case the new list returned by
`ibus_attr_list_copy_format_to_*()` is floating, so this would drop the
refcount to 0. To avoid this we need to ensure that if the list is floating the
floating ref is sunk before calling `ibus_text_set_attributes()`, so the
call to `g_object_ref_sink()` in there adds a ref, such that we can
safely unref this after the call to `ibus_text_set_attributes()`.

This also keeps the guarantee that the list is not floating anymore
after converting text to not regress the issue fixed by 5bbe88a1.

Fixes: https://github.com/ibus/ibus/commit/5bbe88a1
Closes: https://github.com/ibus/ibus/issues/2941
---
 src/ibusinputcontext.c | 20 ++++++++++++++++++--
 src/ibuspanelservice.c | 20 ++++++++++++++++++--
 2 files changed, 36 insertions(+), 4 deletions(-)

diff --git a/src/ibusinputcontext.c b/src/ibusinputcontext.c
index bdfd166dd..d0e162fc7 100644
--- a/src/ibusinputcontext.c
+++ b/src/ibusinputcontext.c
@@ -569,8 +569,16 @@ ibus_input_context_convert_text (IBusInputContext *context,
                        text->text, error->message);
             g_error_free (error);
         }
-        if (new_attrs)
+        if (new_attrs) {
+#if GLIB_CHECK_VERSION (2, 70, 0)
+            g_object_take_ref (new_attrs);
+#else
+            if (g_object_is_floating (new_attrs)
+                g_object_ref_sink (new_attrs);
+#endif
             ibus_text_set_attributes (text, new_attrs);
+            g_object_unref (new_attrs);
+        }
         break;
     case IBUS_PREEDIT_FORMAT_HINT:
         new_attrs = ibus_attr_list_copy_format_to_hint (text->attrs, &error);
@@ -579,8 +587,16 @@ ibus_input_context_convert_text (IBusInputContext *context,
                        text->text, error->message);
             g_error_free (error);
         }
-        if (new_attrs)
+        if (new_attrs) {
+#if GLIB_CHECK_VERSION (2, 70, 0)
+            g_object_take_ref (new_attrs);
+#else
+            if (g_object_is_floating (new_attrs)
+                g_object_ref_sink (new_attrs);
+#endif
             ibus_text_set_attributes (text, new_attrs);
+            g_object_unref (new_attrs);
+        }
         break;
     default:
         g_assert_not_reached ();
diff --git a/src/ibuspanelservice.c b/src/ibuspanelservice.c
index 14cca3ecf..18404a39e 100644
--- a/src/ibuspanelservice.c
+++ b/src/ibuspanelservice.c
@@ -1203,8 +1203,16 @@ ibus_panel_convert_text (IBusPanelService *panel,
                        text->text, error->message);
             g_error_free (error);
         }
-        if (new_attrs)
+        if (new_attrs) {
+#if GLIB_CHECK_VERSION (2, 70, 0)
+            g_object_take_ref (new_attrs);
+#else
+            if (g_object_is_floating (new_attrs)
+                g_object_ref_sink (new_attrs);
+#endif
             ibus_text_set_attributes (text, new_attrs);
+            g_object_unref (new_attrs);
+        }
         break;
     case IBUS_PREEDIT_FORMAT_HINT:
         new_attrs = ibus_attr_list_copy_format_to_hint (text->attrs, &error);
@@ -1213,8 +1221,16 @@ ibus_panel_convert_text (IBusPanelService *panel,
                        text->text, error->message);
             g_error_free (error);
         }
-        if (new_attrs)
+        if (new_attrs) {
+#if GLIB_CHECK_VERSION (2, 70, 0)
+            g_object_take_ref (new_attrs);
+#else
+            if (g_object_is_floating (new_attrs)
+                g_object_ref_sink (new_attrs);
+#endif
             ibus_text_set_attributes (text, new_attrs);
+            g_object_unref (new_attrs);
+        }
         break;
     default:
         g_assert_not_reached ();

++++++ 5bbe88a1936246185a65f76e58cc85871401e59a.patch ++++++
>From 5bbe88a1936246185a65f76e58cc85871401e59a Mon Sep 17 00:00:00 2001
From: Tianhao Chai <[email protected]>
Date: Wed, 27 May 2026 13:11:28 +0900
Subject: [PATCH] src: make an IBusText own an updated IBusAttrList reference

For all usages of IBusAttrList, the list is an owned reference within a
IBusText struct. `ibus_panel_convert_text()` and
`ibus_input_context_convert_text()` violate the invarient by assigning a
**floating** IBusAttrList reference to anIBusText without sinking it.

When GJS attempts to create a JS representation of an existing GObject,
it unconditionally sinks the incoming reference.[1] For a non-floating
reference this up-refs the object.

For this floating IBusAttrLit, `g_object_ref_sink` converts it to a
strong reference in-place leaving ref-count at 1. At this point the
`IBusAttrList` is referenced by both the enclosing `IBusText` and the
newly created GJS wrapper. When one of them is ref-downed the object
is recycled, leaving the other reference dangling.

To fix this we just need to maintain the list as a non-floating ref.
We already have a `ibus_text_set_attributes()` that does the intended
ref sinking, so just use that instead of manually assigning pointers.

[1]: 
https://gitlab.gnome.org/GNOME/gjs/-/blob/db450465ab0161e131a92992c2509507aa6152aa/gi/object.cpp#L3597

Closes: #2889
---
 src/ibusinputcontext.c | 12 ++++--------
 src/ibuspanelservice.c | 12 ++++--------
 2 files changed, 8 insertions(+), 16 deletions(-)

diff --git a/src/ibusinputcontext.c b/src/ibusinputcontext.c
index 68d12fb5e..bdfd166dd 100644
--- a/src/ibusinputcontext.c
+++ b/src/ibusinputcontext.c
@@ -569,10 +569,8 @@ ibus_input_context_convert_text (IBusInputContext *context,
                        text->text, error->message);
             g_error_free (error);
         }
-        if (new_attrs) {
-            g_object_unref (text->attrs);
-            text->attrs = new_attrs;
-        }
+        if (new_attrs)
+            ibus_text_set_attributes (text, new_attrs);
         break;
     case IBUS_PREEDIT_FORMAT_HINT:
         new_attrs = ibus_attr_list_copy_format_to_hint (text->attrs, &error);
@@ -581,10 +579,8 @@ ibus_input_context_convert_text (IBusInputContext *context,
                        text->text, error->message);
             g_error_free (error);
         }
-        if (new_attrs) {
-            g_object_unref (text->attrs);
-            text->attrs = new_attrs;
-        }
+        if (new_attrs)
+            ibus_text_set_attributes (text, new_attrs);
         break;
     default:
         g_assert_not_reached ();
diff --git a/src/ibuspanelservice.c b/src/ibuspanelservice.c
index 162298227..f50cea19f 100644
--- a/src/ibuspanelservice.c
+++ b/src/ibuspanelservice.c
@@ -1203,10 +1203,8 @@ ibus_panel_convert_text (IBusPanelService *panel,
                        text->text, error->message);
             g_error_free (error);
         }
-        if (new_attrs) {
-            g_object_unref (text->attrs);
-            text->attrs = new_attrs;
-        }
+        if (new_attrs)
+            ibus_text_set_attributes (text, new_attrs);
         break;
     case IBUS_PREEDIT_FORMAT_HINT:
         new_attrs = ibus_attr_list_copy_format_to_hint (text->attrs, &error);
@@ -1215,10 +1213,8 @@ ibus_panel_convert_text (IBusPanelService *panel,
                        text->text, error->message);
             g_error_free (error);
         }
-        if (new_attrs) {
-            g_object_unref (text->attrs);
-            text->attrs = new_attrs;
-        }
+        if (new_attrs)
+            ibus_text_set_attributes (text, new_attrs);
         break;
     default:
         g_assert_not_reached ();

Reply via email to