e_hwc_window: fix use after free of E_Hwc_Window

E_Hwc_Window can be freed when it is removed from
the pending_presentation_cb_wins list.

Change-Id: I81921f6b67aebacccff4e1a895f9aeba741dcdcf

diff --git a/src/bin/e_hwc_window.c b/src/bin/e_hwc_window.c
index 9bf0d62..c5e1253 100644 (file)
--- a/src/bin/e_hwc_window.c
+++ b/src/bin/e_hwc_window.c
@@ -3297,6 +3297,9 @@ e_hwc_window_presentation_callback_pending_take_over(E_Hwc_Window *hwc_window,
    target_hwc_window = hwc->target_hwc_window;
    EINA_SAFETY_ON_NULL_RETURN_VAL(target_hwc_window, EINA_FALSE);
 
+   e_hwc_presentation_callback_list_merge(dst_list,
+                                          &hwc_window->pending_presentation_callbacks);
+
    if (eina_list_data_find(target_hwc_window->pending_presentation_cb_wins, hwc_window))
      {
         target_hwc_window->pending_presentation_cb_wins =
@@ -3305,9 +3308,6 @@ e_hwc_window_presentation_callback_pending_take_over(E_Hwc_Window *hwc_window,
         e_hwc_window_unref(hwc_window);
      }
 
-   e_hwc_presentation_callback_list_merge(dst_list,
-                                          &hwc_window->pending_presentation_callbacks);
-
    return EINA_TRUE;
 }