From 595b9a4f5a2cb5129c9227b63ba61ee7f38234c9 Mon Sep 17 00:00:00 2001
From: Seunghun <shiin.lee@samsung.com>
Date: Wed, 20 Feb 2019 11:10:11 +0900
Subject: [PATCH] e_comp_wl_shell: Do not reference 'ec' if e_object_unref()
 returns '0'.

The instance of E_Client is supposed to be freed if e_object_unref()
returns '0'. Hense, processing cannot access 'ec' in that case.

Change-Id: I842512455a8fac831363bba4a62f10bf43f271fa
---
 src/bin/e_comp_wl_shell.c | 38 +++++++++++++++++++++-----------------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/src/bin/e_comp_wl_shell.c b/src/bin/e_comp_wl_shell.c
index 2170e6a9f1..5bbc777ab1 100644
--- a/src/bin/e_comp_wl_shell.c
+++ b/src/bin/e_comp_wl_shell.c
@@ -371,6 +371,8 @@ e_shell_e_client_destroy(E_Client *ec)
 {
    EINA_SAFETY_ON_NULL_RETURN(ec);
 
+   ELOGF("SHELL", "Destroy shell surface", ec);
+
    if (e_policy_visibility_client_grab_cancel(ec))
      {
         ELOGF("POL_VIS", "CLIENT VIS ON(temp).", ec);
@@ -378,8 +380,23 @@ e_shell_e_client_destroy(E_Client *ec)
         ec->visibility.changed = 1;
      }
 
-   if ((e_object_unref(E_OBJECT(ec))) &&
-       (!e_object_is_del(E_OBJECT(ec))))
+   /* remove this 'ec' from parent's transients list */
+   if (ec->parent)
+     {
+        ec->parent->transients =
+           eina_list_remove(ec->parent->transients, ec);
+        if (ec->parent->modal == ec) ec->parent->modal = NULL;
+        ec->parent = NULL;
+     }
+
+   /* The instance of E_Client is supposed to be freed if e_object_unref returns '0'.
+    * Then there is nothing to do here */
+   if (e_object_unref(E_OBJECT(ec)) == 0)
+     return;
+
+   /* wl_resource_destroy(ec->comp_data->shell.surface); */
+
+   if (!e_object_is_del(E_OBJECT(ec)))
      {
         if (ec->comp_data->mapped)
           {
@@ -390,22 +407,9 @@ e_shell_e_client_destroy(E_Client *ec)
                   ec->comp_data->shell.unmap(ec->comp_data->shell.surface);
                }
           }
-        if (ec->parent)
-          {
-             ec->parent->transients =
-                eina_list_remove(ec->parent->transients, ec);
-             if (ec->parent->modal == ec) ec->parent->modal = NULL;
-             ec->parent = NULL;
-          }
-        /* wl_resource_destroy(ec->comp_data->shell.surface); */
+        ec->comp_data->shell.surface = NULL;
+        e_policy_client_unmap(ec);
      }
-
-   if (ec->comp_data)
-     ec->comp_data->shell.surface = NULL;
-
-   ELOGF("SHELL", "Destroy shell surface", ec);
-
-   e_policy_client_unmap(ec);
 }
 
 static void
-- 
2.34.1