e_comp_wl: fixed a crash when destroying an wl_client. 21/87021/1
authorGwanglim Lee <gl77.lee@samsung.com>
Tue, 6 Sep 2016 04:49:44 +0000 (13:49 +0900)
committerGwanglim Lee <gl77.lee@samsung.com>
Tue, 6 Sep 2016 04:49:44 +0000 (13:49 +0900)
The crash occurs when trying to destroy wl_client which is disconnected.

In this case, E_Client was already deleted but wl_callback resource is not
destroyed because it is in ec->comp_data->pending.frames list and E_Client
didn't clean up its pending.frames list when freeing.

Change-Id: I7371dfaad38cfe757d0477674baa10e981bf4591

src/bin/e_comp_wl.c

index 0733ca4..3aa9575 100644 (file)
@@ -2655,6 +2655,7 @@ _e_comp_wl_frame_cb_destroy(struct wl_resource *resource)
    E_Client *ec;
 
    if (!(ec = wl_resource_get_user_data(resource))) return;
+   if (e_object_is_del(E_OBJECT(ec))) return;
 
    ec->comp_data->frames =
      eina_list_remove(ec->comp_data->frames, resource);
@@ -4015,6 +4016,9 @@ _e_comp_wl_client_cb_del(void *data EINA_UNUSED, E_Client *ec)
    EINA_LIST_FREE(ec->comp_data->frames, cb)
      wl_resource_destroy(cb);
 
+   EINA_LIST_FREE(ec->comp_data->pending.frames, cb)
+     wl_resource_destroy(cb);
+
    if (ec->comp_data->surface)
      wl_resource_set_user_data(ec->comp_data->surface, NULL);