From 441f9bb144efd561f0ac4bc4e672acc9703b5126 Mon Sep 17 00:00:00 2001 From: Elvis Lee Date: Fri, 31 Jul 2015 18:02:54 +0900 Subject: [PATCH] wayland-client : Fix queue_release not to call proxy_destroy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit proxy_destroy could be called twice by wl_proxy_destroy and wl_event_queue_release. Then, wl_map_remove was called twice for same object id. Signed-off-by: Elvis Lee Reviewed-by: Jonas Ådahl Reviewed-by: Daniel Stone --- src/wayland-client.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/src/wayland-client.c b/src/wayland-client.c index 6450b67d..09c594ae 100644 --- a/src/wayland-client.c +++ b/src/wayland-client.c @@ -259,6 +259,7 @@ wl_event_queue_release(struct wl_event_queue *queue) { struct wl_closure *closure; struct wl_proxy *proxy; + bool proxy_destroyed; while (!wl_list_empty(&queue->event_list)) { closure = container_of(queue->event_list.next, @@ -268,10 +269,11 @@ wl_event_queue_release(struct wl_event_queue *queue) decrease_closure_args_refcount(closure); proxy = closure->proxy; - if (proxy->refcount == 1) - proxy_destroy(proxy); - else - --proxy->refcount; + proxy_destroyed = !!(proxy->flags & WL_PROXY_FLAG_DESTROYED); + + proxy->refcount--; + if (proxy_destroyed && !proxy->refcount) + free(proxy); wl_closure_destroy(closure); }