On Sun, Jul 22, 2012 at 09:27:33AM -0700, Dima Ryazanov wrote:
> Oh, sorry, I wasn't sure how to reproduce the other case. (Did you see my
> last email? I don't know if I should write a new client, or if I can test
> it with existing ones.)
> I have some time, I'm just not familiar with the code :)
Oh, sorry, I wasn't sure how to reproduce the other case. (Did you see my
last email? I don't know if I should write a new client, or if I can test
it with existing ones.)
I have some time, I'm just not familiar with the code :)
On Sun, Jul 22, 2012 at 8:45 AM, Kristian Høgsberg wrote:
> On Tue,
On Tue, Jul 10, 2012 at 02:35:10PM -0400, Kristian Høgsberg wrote:
> On Tue, Jul 10, 2012 at 09:28:11AM -0700, Dima Ryazanov wrote:
> > I see the following use-after-free when a client disconnects:
> >
> > ==21822== Invalid write of size 8
> > ==21822==at 0x54A8F74: wl_list_remove (wayland-uti
>
> We have a different case to consider though. When a surface is
> explicitly destroyed by calling surface.destroy(), we still need to
> destroy pending callbacks, and that case the resource system wont do
> it for us. So we need to iterate through the list and free them
> manually.
Is there
On Tue, Jul 10, 2012 at 09:28:11AM -0700, Dima Ryazanov wrote:
> I see the following use-after-free when a client disconnects:
>
> ==21822== Invalid write of size 8
> ==21822==at 0x54A8F74: wl_list_remove (wayland-util.c:51)
> ==21822==by 0x409C87: destroy_frame_callback (compositor.c:1362
I see the following use-after-free when a client disconnects:
==21822== Invalid write of size 8
==21822==at 0x54A8F74: wl_list_remove (wayland-util.c:51)
==21822==by 0x409C87: destroy_frame_callback (compositor.c:1362)
==21822==by 0x56B44E7: destroy_resource (wayland-server.c:427)
==21
