desktop_shell: Fix crash caused by double wl_list_remove 00/324200/1
authorSeunghun Lee <shiin.lee@samsung.com>
Wed, 14 May 2025 01:43:56 +0000 (10:43 +0900)
committerTizen Window System <tizen.windowsystem@gmail.com>
Wed, 14 May 2025 04:22:23 +0000 (13:22 +0900)
This patch addresses a crash caused by attempting to remove wl_list
twice.

It was discovered that calling e_shell_e_client_destroy() can result in
the destruction of the E_Surface.
Therefore, the surface_destroy listener must be removed before invoking
e_shell_e_client_destroy(). Failure to do so could cause
_surface_finish() to be called again via the listener callback,
_surface_cb_surface_destroy(), leading to unintended behavior.

Change-Id: I9b1c506d8964eb02a96cf39110a06c81490ee97e

src/bin/server/e_desktop_shell.c

index 26eed4b28f0803b8db04bfccaedc9391d3d999d2..82d116c42fc8afa5292b2c058aad41622098968d 100644 (file)
@@ -179,10 +179,18 @@ _surface_finish(E_Desktop_Surface *surface)
    if (!surface->surface)
      return;
 
-   e_shell_e_client_destroy(surface->ec);
+   /** FIXME: The order of wl_list_remove() and e_shell_e_client_destroy() is
+    * critical in this section. It has been observed that calling
+    * e_shell_e_client_destroy() can lead to the destruction of the E_Surface.
+    * As a result, the surface_destroy listener must be removed prior to
+    * invoking e_shell_e_client_destroy(). If this is not done,
+    * _surface_finish() could be called again through the listener callback,
+    * _surface_cb_surface_destroy(), leading to unintended behavior.
+    */
    wl_list_remove(&surface->surface_destroy.link);
    surface->iface = NULL;
    surface->surface = NULL;
+   e_shell_e_client_destroy(surface->ec);
 }
 
 static E_Desktop_Surface *