remove link before calling the user handler

Inside of the user handler, list can be changed. And it could make crash.

Change-Id: Ib49bc110e826ff7b34b6c8bc2224b5006b1972ba

diff --git a/src/tdm_layer.c b/src/tdm_layer.c
index ea30779..cb4ef55 100644 (file)
--- a/src/tdm_layer.c
+++ b/src/tdm_layer.c
@@ -644,6 +644,8 @@ _tdm_layer_cb_output_commit(tdm_output *output, unsigned int sequence,
        if (!found)
                return;
 
+       LIST_DEL(&layer_commit_handler->link);
+
        private_layer = layer_commit_handler->private_layer;
 
        if (tdm_debug_module & TDM_DEBUG_COMMIT)
@@ -661,7 +663,6 @@ _tdm_layer_cb_output_commit(tdm_output *output, unsigned int sequence,
                _pthread_mutex_lock(&private_display->lock);
        }
 
-       LIST_DEL(&layer_commit_handler->link);
        free(layer_commit_handler);
 
        _pthread_mutex_unlock(&private_display->lock);

diff --git a/src/tdm_output.c b/src/tdm_output.c
index b37bf4f..2374a36 100644 (file)
--- a/src/tdm_output.c
+++ b/src/tdm_output.c
@@ -605,9 +605,11 @@ tdm_output_cb_vblank(tdm_output *output_backend, unsigned int sequence,
                if (tdm_debug_module & TDM_DEBUG_COMMIT)
                        TDM_INFO("handler(%p)", v);
 
+               LIST_DEL(&v->link);
+
                if (v->func)
                        v->func(v->private_output, sequence, tv_sec, tv_usec, v->user_data);
-               LIST_DEL(&v->link);
+
                free(v);
        }
        _pthread_mutex_lock(&private_display->lock);
@@ -651,6 +653,8 @@ tdm_output_cb_commit(tdm_output *output_backend, unsigned int sequence,
                return;
        }
 
+       LIST_DEL(&output_commit_handler->link);
+
        if (tdm_debug_module & TDM_DEBUG_COMMIT) {
                TDM_INFO("----------------------------------------- output(%d) committed", private_output->pipe);
                TDM_INFO("handler(%p)", output_commit_handler);
@@ -671,7 +675,6 @@ tdm_output_cb_commit(tdm_output *output_backend, unsigned int sequence,
                _pthread_mutex_lock(&private_display->lock);
        }
 
-       LIST_DEL(&output_commit_handler->link);
        free(output_commit_handler);
 
        if (tdm_debug_module & TDM_DEBUG_COMMIT)

diff --git a/src/tdm_server.c b/src/tdm_server.c
index 21c0c9d..5d7159a 100644 (file)
--- a/src/tdm_server.c
+++ b/src/tdm_server.c
@@ -242,6 +242,8 @@ destroy_vblank_callback(struct wl_resource *resource)
 
        TDM_RETURN_IF_FAIL(vblank_info != NULL);
 
+       LIST_DEL(&vblank_info->link);
+
        if (vblank_info->vblank)
                tdm_vblank_destroy(vblank_info->vblank);
 
@@ -250,7 +252,6 @@ destroy_vblank_callback(struct wl_resource *resource)
                        destroy_wait(w);
        }
 
-       LIST_DEL(&vblank_info->link);
        free(vblank_info);
 }
 
@@ -549,6 +550,8 @@ destroy_output_callback(struct wl_resource *resource)
 
        TDM_RETURN_IF_FAIL(output_info != NULL);
 
+       LIST_DEL(&output_info->link);
+
        tdm_output_remove_change_handler(output_info->output,
                                                                         _tdm_server_cb_output_change, output_info);
 
@@ -556,7 +559,6 @@ destroy_output_callback(struct wl_resource *resource)
                wl_resource_destroy(v->resource);
        }
 
-       LIST_DEL(&output_info->link);
        free(output_info);
 }
 

diff --git a/src/tdm_vblank.c b/src/tdm_vblank.c
index 2c5eca4..931842d 100644 (file)
--- a/src/tdm_vblank.c
+++ b/src/tdm_vblank.c
@@ -802,6 +802,9 @@ _tdm_vblank_cb_vblank_HW(tdm_output *output, unsigned int sequence,
                VWR("couldn't update sw timer");
        }
 
+       LIST_DEL(&wait_info->link);
+       _tdm_vblank_valid_list_del(&wait_info->valid_link);
+
        /* tv_sec & tv_usec shouldn't be zero. But sometimes they are zero in some hardware.
         * We need to prohibit that last_time becomes zero because "last_time == 0" means
         * that a tdm_vblank object is just created and doesn't have the first vblank event.
@@ -822,8 +825,6 @@ _tdm_vblank_cb_vblank_HW(tdm_output *output, unsigned int sequence,
                wait_info->func(private_vblank, TDM_ERROR_NONE, wait_info->target_seq,
                                                tv_sec, tv_usec, wait_info->user_data);
 
-       LIST_DEL(&wait_info->link);
-       _tdm_vblank_valid_list_del(&wait_info->valid_link);
        free(wait_info);
 }