From: Pekka Paalanen <[email protected]>

This issue was introduced by "desktop-shell: detect stale shell surface
outputs" which forgot to remove the output destroy listener when
shell_surface is destroyed, leading to memory corruption.

This was fairly easy to trigger by opening and closing an application
window a few times.

Signed-off-by: Pekka Paalanen <[email protected]>
---
 desktop-shell/shell.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/desktop-shell/shell.c b/desktop-shell/shell.c
index 64db89fc..0e50c97b 100644
--- a/desktop-shell/shell.c
+++ b/desktop-shell/shell.c
@@ -2303,6 +2303,12 @@ fade_out_done_idle_cb(void *data)
        struct shell_surface *shsurf = data;
 
        weston_surface_destroy(shsurf->view->surface);
+
+       if (shsurf->output_destroy_listener.notify) {
+               wl_list_remove(&shsurf->output_destroy_listener.link);
+               shsurf->output_destroy_listener.notify = NULL;
+       }
+
        free(shsurf);
 }
 
@@ -2420,6 +2426,12 @@ desktop_surface_removed(struct weston_desktop_surface 
*desktop_surface,
                                fade_out_done, shsurf);
        } else {
                weston_view_destroy(shsurf->view);
+
+               if (shsurf->output_destroy_listener.notify) {
+                       wl_list_remove(&shsurf->output_destroy_listener.link);
+                       shsurf->output_destroy_listener.notify = NULL;
+               }
+
                free(shsurf);
        }
 }
-- 
2.16.1

_______________________________________________
wayland-devel mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/wayland-devel

Reply via email to