efl_ui_widget: fix model listenting logicdevs/bu5hm4n/work

if we are walking this method twice (spoiler we do!) then we subscribe
twice to the event, which leads (depending on the order of executed
deletion) to the accessing of obj after its deleted.

2 files changed, 7 insertions, 4 deletions

diff --git a/src/lib/elementary/efl_ui_widget.c b/src/lib/elementary/efl_ui_widget.c
index 3dc4c1a69d..7ad2a23f89 100644
--- a/src/lib/elementary/efl_ui_widget.c
+++ b/src/lib/elementary/efl_ui_widget.c
@@ -5914,6 +5914,7 @@ _efl_ui_widget_model_provider_invalidate(void *data, const Efl_Event *event EINA
                                 data);
    efl_replace(&pd->properties.provider, NULL);
    efl_replace(&pd->properties.model, NULL);
+   pd->properties.callback_to_provider = EINA_FALSE;
 }
 
 static void
@@ -5928,10 +5929,11 @@ _efl_ui_widget_model_register(Eo *obj, Efl_Ui_Widget_Data *pd)
         efl_replace(&pd->properties.provider,
                     efl_provider_find(obj, EFL_MODEL_PROVIDER_CLASS));
         if (!pd->properties.provider) return ;
-        efl_event_callback_array_add(pd->properties.provider,
-                                     efl_ui_widget_model_provider_callbacks(),
-                                     obj);
-
+        if (!pd->properties.callback_to_provider)
+          efl_event_callback_array_add(pd->properties.provider,
+                                       efl_ui_widget_model_provider_callbacks(),
+                                       obj);
+        pd->properties.callback_to_provider = EINA_TRUE;
         efl_replace(&pd->properties.model,
                     efl_ui_view_model_get(pd->properties.provider));
 
diff --git a/src/lib/elementary/elm_widget.h b/src/lib/elementary/elm_widget.h
index 6350c882bf..4d854eb147 100644
--- a/src/lib/elementary/elm_widget.h
+++ b/src/lib/elementary/elm_widget.h
@@ -386,6 +386,7 @@ typedef struct _Elm_Widget_Smart_Data
       Eina_Hash *model_lookup;
       Eina_Hash *view_lookup;
       Eina_Bool  registered : 1;
+      Eina_Bool  callback_to_provider : 1;
    } properties;
    void                          *shared_win_data;
    Eina_Bool                     scroll_x_locked : 1;