libweston: cancel idle_repaint on output destroy
authorPekka Paalanen <pekka.paalanen@collabora.co.uk>
Thu, 26 Oct 2017 11:33:59 +0000 (14:33 +0300)
committerPekka Paalanen <pekka.paalanen@collabora.co.uk>
Tue, 17 Apr 2018 12:19:57 +0000 (15:19 +0300)
commitdcbcfc7f678d96d9c26514fa47d65d992bb5b48c
tree980669bc38112a425fcc0eb7c5f2cbc4887b52c4
parent586e1ac791e7a514b71db873b477b137f02aa0b4
libweston: cancel idle_repaint on output destroy

If the idle_repaint() callback has been scheduled when a weston_output
gets destroyed, the callback will hit use-after-free. I have encountered
this when migrating the wayland backend to the head-based API, using
--sprawl, and closing/disconnecting one of the parent compositor
outputs.

Store the idle_repaint callback source, and destroy it in
weston_output_release(), ensuring we don't get a stale call to
start_repaint_loop later.

Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
Reviewed-by: Ian Ray <ian.ray@ge.com>
Reviewed-by: Daniel Stone <daniels@collabora.com>
Acked-by: Derek Foreman <derekf@osg.samsung.com>
libweston/compositor.c
libweston/compositor.h