<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - Weston sends input events from freed surface"
href="https://bugs.freedesktop.org/show_bug.cgi?id=81194">81194</a>
</td>
</tr>
<tr>
<th>Assignee</th>
<td>wayland-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Summary</th>
<td>Weston sends input events from freed surface
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Reporter</th>
<td>ricardo.vieira@tecnico.ulisboa.pt
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Version</th>
<td>1.5.0
</td>
</tr>
<tr>
<th>Component</th>
<td>weston
</td>
</tr>
<tr>
<th>Product</th>
<td>Wayland
</td>
</tr></table>
<p>
<div>
<pre>when a wl_surface is destroyed it looks like the pointer and keyboard signals
are sent after the window is destroyed (for example the leave singnal) and the
surface argument was already freed for example if we call
wl_surface_get_user_data(surface) from pointer leave signal it segfaults
Steps to reproduce:
-Create a window
-Wait until the pointer handle enter event
-destroy the wl_surface from the window
-wait for events
-call wl_surface_get_user_data(surface) from pointer handle leave
-Segfault
I found this bug running the reopen test from glfw a multi-platform library for
OpenGL
Tested on Weston 7b9820766(master)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>