egl/wayland: Destroy the pending buffer callback with the egl surface

Otherwise, we crash when the callback is executed, since the dri2_surf
pointer may point to invalid data.

Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>

diff --git a/src/egl/drivers/dri2/egl_dri2.h b/src/egl/drivers/dri2/egl_dri2.h
index 3c42338..2e7b547 100644 (file)
--- a/src/egl/drivers/dri2/egl_dri2.h
+++ b/src/egl/drivers/dri2/egl_dri2.h
@@ -177,6 +177,7 @@ struct dri2_egl_surface
    __DRIbuffer           *third_buffer;
    __DRIbuffer           *pending_buffer;
    struct wl_callback    *frame_callback;
+   struct wl_callback    *pending_buffer_callback;
    int                   format;
 #endif
 

diff --git a/src/egl/drivers/dri2/platform_wayland.c b/src/egl/drivers/dri2/platform_wayland.c
index 59371d6..ccff9a8 100644 (file)
--- a/src/egl/drivers/dri2/platform_wayland.c
+++ b/src/egl/drivers/dri2/platform_wayland.c
@@ -145,6 +145,7 @@ dri2_create_surface(_EGLDriver *drv, _EGLDisplay *disp, EGLint type,
    dri2_surf->pending_buffer = NULL;
    dri2_surf->third_buffer = NULL;
    dri2_surf->frame_callback = NULL;
+   dri2_surf->pending_buffer_callback = NULL;
 
    if (conf->AlphaSize == 0)
       dri2_surf->format = WL_DRM_FORMAT_XRGB8888;
@@ -232,6 +233,9 @@ dri2_destroy_surface(_EGLDriver *drv, _EGLDisplay *disp, _EGLSurface *surf)
    if (dri2_surf->frame_callback)
       wl_callback_destroy(dri2_surf->frame_callback);
 
+   if (dri2_surf->pending_buffer_callback)
+      wl_callback_destroy(dri2_surf->pending_buffer_callback);
+
 
    if (dri2_surf->base.Type == EGL_WINDOW_BIT) {
       dri2_surf->wl_win->private = NULL;
@@ -299,6 +303,7 @@ dri2_release_pending_buffer(void *data,
    dri2_surf->pending_buffer = NULL;
 
    wl_callback_destroy(callback);
+   dri2_surf->pending_buffer_callback = NULL;
 }
 
 static const struct wl_callback_listener release_buffer_listener = {
@@ -331,6 +336,7 @@ dri2_release_buffers(struct dri2_egl_surface *dri2_surf)
                                     &release_buffer_listener, dri2_surf);
             wl_proxy_set_queue((struct wl_proxy *) callback,
                                dri2_dpy->wl_queue);
+            dri2_surf->pending_buffer_callback = callback;
             break;
          default:
             dri2_dpy->dri2->releaseBuffer(dri2_dpy->dri_screen,