From af453f876e44f4cb990acc92b50d130e6efed667 Mon Sep 17 00:00:00 2001 From: Sebastian Wick Date: Tue, 20 May 2025 21:39:45 +0200 Subject: [PATCH] shm: Remove refcount check which cannot be triggered If the pool refcount reaches zero, it is freed, so accessing its members is UB which ASan would catch. Also simplify check for negative refcounts. Signed-off-by: Sebastian Wick --- src/wayland-shm.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/src/wayland-shm.c b/src/wayland-shm.c index d22353c6..27db8c65 100644 --- a/src/wayland-shm.c +++ b/src/wayland-shm.c @@ -143,17 +143,16 @@ shm_pool_unref(struct wl_shm_pool *pool, bool external) { if (external) { pool->external_refcount--; - if (!(pool->external_refcount >= 0)) + if (pool->external_refcount < 0) wl_abort("Requested to unref an external reference to " "pool but none found\n"); if (pool->external_refcount == 0) shm_pool_finish_resize(pool); } else { pool->internal_refcount--; - if (!(pool->internal_refcount >= 0)) + if (pool->internal_refcount < 0) wl_abort("Requested to unref an internal reference to " "pool but none found\n"); - } if (pool->internal_refcount + pool->external_refcount > 0) @@ -513,10 +512,6 @@ wl_shm_buffer_get_height(const struct wl_shm_buffer *buffer) WL_EXPORT struct wl_shm_pool * wl_shm_buffer_ref_pool(struct wl_shm_buffer *buffer) { - if (!(buffer->pool->internal_refcount + - buffer->pool->external_refcount)) - wl_abort("Can't get reference to pool that has been freed\n"); - buffer->pool->external_refcount++; return buffer->pool; }