From: Jonas Ådahl <jadahl@gmail.com>
Date: Thu, 7 Mar 2013 22:32:39 +0000 (+0100)
Subject: client: Check reference count only for destroyed proxies
X-Git-Tag: 1.0.90~65
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=e053a5625129bd11c301c9587f5f29cbda95c66d;p=platform%2Fupstream%2Fwayland.git

client: Check reference count only for destroyed proxies

The llvm static analyzer tool reported "Use of memory after it is freed"
in dispatch_event() because the proxy is used after being freed if the
reference count reaches zero without the destroyed flag being set. This
would never happen in practice because the owner of the proxy object
always holds a reference until calling wl_proxy_destroy() which would
also set the destroyed flag.

Since this is the case, it is safe to do the reference count check only
if the destroyed flag is set, as it can never reach zero if not.

This commit doesn't change the behavior of the function, but makes the
static analyzer more happy.

Fixes https://bugs.freedesktop.org/show_bug.cgi?id=61385

Signed-off-by: Jonas Ådahl <jadahl@gmail.com>
---

diff --git a/src/wayland-client.c b/src/wayland-client.c
index 74e4657..3ead2ac 100644
--- a/src/wayland-client.c
+++ b/src/wayland-client.c
@@ -822,10 +822,10 @@ dispatch_event(struct wl_display *display, struct wl_event_queue *queue)
 	proxy_destroyed = !!(proxy->flags & WL_PROXY_FLAG_DESTROYED);
 
 	proxy->refcount--;
-	if (!proxy->refcount)
-		free(proxy);
-
 	if (proxy_destroyed) {
+		if (!proxy->refcount)
+			free(proxy);
+
 		wl_closure_destroy(closure);
 		return;
 	}