From cbb6b37fa26d1303e341a099f7689784c27b1d8b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Wed, 6 Aug 2025 19:45:35 +0300
Subject: [PATCH] glib: Fix segfault in `List::retain()`

One more level of pointer indirection is needed to get the item from the list.
---
 glib/src/collections/list.rs  | 8 +++++++-
 glib/src/collections/slist.rs | 8 +++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/glib/src/collections/list.rs b/glib/src/collections/list.rs
index 9ebb7ffd0d6f..2ab8006b9281 100644
--- a/glib/src/collections/list.rs
+++ b/glib/src/collections/list.rs
@@ -355,7 +355,7 @@ impl<T: TransparentPtrType> List<T> {
             unsafe {
                 let mut ptr = head.as_ptr();
                 while !ptr.is_null() {
-                    let item = &*((*ptr).data as *const ffi::gpointer as *const T);
+                    let item = &*(&(*ptr).data as *const ffi::gpointer as *const T);
                     let next = (*ptr).next;
                     if !f(item) {
                         ptr::drop_in_place(&mut (*ptr).data as *mut ffi::gpointer as *mut T);
@@ -909,6 +909,12 @@ mod test {
         let mut list_items = list2.iter().cloned().collect::<Vec<_>>();
         list_items.reverse();
         assert_eq!(&items[1..], &list_items);
+
+        list.reverse();
+        let mut list3 = list.clone();
+        list3.retain(|item| item.seconds() >= 14.0);
+        let list_items = list3.iter().cloned().collect::<Vec<_>>();
+        assert_eq!(&items[2..], &list_items);
     }
 
     #[test]
diff --git a/glib/src/collections/slist.rs b/glib/src/collections/slist.rs
index ad1ef90ba2a6..7316145bf9b2 100644
--- a/glib/src/collections/slist.rs
+++ b/glib/src/collections/slist.rs
@@ -350,7 +350,7 @@ impl<T: TransparentPtrType> SList<T> {
             unsafe {
                 let mut ptr = head.as_ptr();
                 while !ptr.is_null() {
-                    let item = &*((*ptr).data as *const ffi::gpointer as *const T);
+                    let item = &*(&(*ptr).data as *const ffi::gpointer as *const T);
                     let next = (*ptr).next;
                     if !f(item) {
                         ptr::drop_in_place(&mut (*ptr).data as *mut ffi::gpointer as *mut T);
@@ -902,6 +902,12 @@ mod test {
         let mut list_items = list2.iter().cloned().collect::<Vec<_>>();
         list_items.reverse();
         assert_eq!(&items[1..], &list_items);
+
+        list.reverse();
+        let mut list3 = list.clone();
+        list3.retain(|item| item.seconds() >= 14.0);
+        let list_items = list3.iter().cloned().collect::<Vec<_>>();
+        assert_eq!(&items[2..], &list_items);
     }
 
     #[test]