Evas filters: Fix crash with async sw rendering

If the filtered object (text or image object) was deleted, its
output image (cached inside the filter data) would be freed
immediately. This could cause crashes in case of async rendering.

@fix

diff --git a/src/lib/evas/canvas/evas_filter_mixin.c b/src/lib/evas/canvas/evas_filter_mixin.c
index 934a8c6..154c6dc 100644 (file)
--- a/src/lib/evas/canvas/evas_filter_mixin.c
+++ b/src/lib/evas/canvas/evas_filter_mixin.c
@@ -254,6 +254,7 @@ evas_filter_object_render(Eo *eo_obj, Evas_Object_Protected_Data *obj,
         fcow = FCOW_BEGIN(pd);
         fcow->output = filter_output;
         fcow->changed = EINA_FALSE;
+        fcow->async = do_async;
         if (!ok) fcow->invalid = EINA_TRUE;
         FCOW_END(fcow, pd);
 
@@ -518,7 +519,12 @@ _evas_filter_destructor(Eo *eo_obj, Evas_Filter_Data *pd)
    if (evas_object_filter_cow_default == pd->data) return;
 
    if (pd->data->output)
-     ENFN->image_free(ENDT, pd->data->output);
+     {
+        if (!pd->data->async)
+          ENFN->image_free(ENDT, pd->data->output);
+        else
+          evas_unref_queue_image_put(obj->layer->evas, pd->data->output);
+     }
    eina_hash_free(pd->data->sources);
    EINA_INLIST_FOREACH_SAFE(pd->data->data, il, db)
      {

diff --git a/src/lib/evas/include/evas_private.h b/src/lib/evas/include/evas_private.h
index 8c57805..0aa28d1 100644 (file)
--- a/src/lib/evas/include/evas_private.h
+++ b/src/lib/evas/include/evas_private.h
@@ -1206,6 +1206,7 @@ struct _Evas_Object_Filter_Data
    } state;
    Eina_Bool            changed : 1;
    Eina_Bool            invalid : 1; // Code parse failed
+   Eina_Bool            async : 1;
 };
 
 struct _Evas_Object_Func