[PATCH] shell: Fix segfault from trying to access a destroyed popup shell surface

[Bryan Cain]

The shell_destroy_shell_surface function only set the backing resource to
NULL, leaving an unusable surface in the popup_grab list until the surface's
fading animation finished and it could be freed. This caused a segfault if
the shell tried to forcibly break the grab during that time interval due to
the compositor losing the keyboard focus.

Fixes bug #77072.
---
 desktop-shell/shell.c |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/desktop-shell/shell.c b/desktop-shell/shell.c
index 59fa99c..fe03420 100644
--- a/desktop-shell/shell.c
+++ b/desktop-shell/shell.c
@@ -3050,6 +3050,8 @@ shell_destroy_shell_surface(struct wl_resource *resource)
 {
 	struct shell_surface *shsurf = wl_resource_get_user_data(resource);
 
+	if (!wl_list_empty(&shsurf->popup.grab_link))
+		remove_popup_grab(shsurf);
 	shsurf->resource = NULL;
 }
 
-- 
1.7.9.5