mirrors/wlroots
1
0
Fork 0
mirror of https://gitlab.freedesktop.org/wlroots/wlroots.git synced 2026-03-16 05:34:23 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

compositor: Clean up surface current_outputs last

Browse source 
During surface resource cleanup, several signals will be emitted. If any
of these end up calling wlr_surface_send_enter, a new output could be
added to the current_outputs list. This would result in a leaked
surface_output and a dangling wlr_surface pointer.

Clean up current_outputs last.

References: https://github.com/swaywm/sway/issues/8650
This commit is contained in:
Kenny Levinsen 2025-04-14 12:42:13 +02:00
parent d7527778bb
commit 867960d6f4
1 changed files with 7 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

13
types/wlr_compositor.c
View file

@ -725,12 +725,6 @@ static void surface_destroy_role_object(struct wlr_surface *surface);
static void surface_handle_resource_destroy(struct wl_resource *resource) { static void surface_handle_resource_destroy(struct wl_resource *resource) {
struct wlr_surface *surface = wlr_surface_from_resource(resource); struct wlr_surface *surface = wlr_surface_from_resource(resource);
struct wlr_surface_output *surface_output, *surface_output_tmp;
wl_list_for_each_safe(surface_output, surface_output_tmp,
&surface->current_outputs, link) {
surface_output_destroy(surface_output);
}
surface_destroy_role_object(surface); surface_destroy_role_object(surface);
wl_signal_emit_mutable(&surface->events.destroy, surface); wl_signal_emit_mutable(&surface->events.destroy, surface);
@ -762,6 +756,13 @@ static void surface_handle_resource_destroy(struct wl_resource *resource) {
if (surface->buffer != NULL) { if (surface->buffer != NULL) {
wlr_buffer_unlock(&surface->buffer->base); wlr_buffer_unlock(&surface->buffer->base);
} }
struct wlr_surface_output *surface_output, *surface_output_tmp;
wl_list_for_each_safe(surface_output, surface_output_tmp,
&surface->current_outputs, link) {
surface_output_destroy(surface_output);
}
free(surface); free(surface);
} }