mirrors/weston
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

exposay: Fix use after free when a view is destroyed during animation

Browse Source 
Moving the destroy listener setup allows the animation completion handler
to be called before we free any structures it needs.

Signed-off-by: Derek Foreman <derekf@osg.samsung.com>
This commit is contained in:
Derek Foreman 2015-05-26 16:21:05 -05:00 committed by Bryce Harrington
parent daf846e4ea
commit d8156e22f6
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
desktop-shell/exposay.c
View File

@ -296,9 +296,6 @@ exposay_layout(struct desktop_shell *shell, struct shell_output *shell_output)
esurface->eoutput = eoutput; esurface->eoutput = eoutput;
esurface->view = view; esurface->view = view;
esurface->view_destroy_listener.notify = handle_view_destroy;
wl_signal_add(&view->destroy_signal, &esurface->view_destroy_listener);
esurface->row = i / eoutput->grid_size; esurface->row = i / eoutput->grid_size;
esurface->column = i % eoutput->grid_size; esurface->column = i % eoutput->grid_size;
@ -322,6 +319,15 @@ exposay_layout(struct desktop_shell *shell, struct shell_output *shell_output)
exposay_animate_in(esurface); exposay_animate_in(esurface);
/* We want our destroy handler to be after the animation
* destroy handler in the list, this way when the view is
* destroyed, the animation can safely call the animation
* completion callback before we free the esurface in our
* destroy handler.
*/
esurface->view_destroy_listener.notify = handle_view_destroy;
wl_signal_add(&view->destroy_signal, &esurface->view_destroy_listener);
i++; i++;
} }