e_hwc_window: fix use after free of E_Hwc_Window

E_Hwc_Window can be freed when it is removed from
the pending_presentation_cb_wins list.

Change-Id: I80645061ce12035bebde68509d9774834e799ffc

diff --git a/src/bin/e_hwc_window.c b/src/bin/e_hwc_window.c
index ebc6fae..b77d5d5 100644 (file)
--- a/src/bin/e_hwc_window.c
+++ b/src/bin/e_hwc_window.c
@@ -3245,6 +3245,9 @@ e_hwc_window_presentation_callback_pending_take_over(E_Hwc_Window *hwc_window,
    target_hwc_window = hwc->target_hwc_window;
    EINA_SAFETY_ON_NULL_RETURN_VAL(target_hwc_window, EINA_FALSE);
 
+   e_hwc_presentation_callback_list_merge(dst_list,
+                                          &hwc_window->pending_presentation_callbacks);
+
    if (eina_list_data_find(target_hwc_window->pending_presentation_cb_wins, hwc_window))
      {
         target_hwc_window->pending_presentation_cb_wins =
@@ -3253,9 +3256,6 @@ e_hwc_window_presentation_callback_pending_take_over(E_Hwc_Window *hwc_window,
         e_hwc_window_unref(hwc_window);
      }
 
-   e_hwc_presentation_callback_list_merge(dst_list,
-                                          &hwc_window->pending_presentation_callbacks);
-
    return EINA_TRUE;
 }