<div dir="ltr">Looks good to me.</div><div class="gmail_extra"> <div class="gmail_quote">2013/4/3 Rob Bradford <<a href="mailto:robert.bradford@intel.com" target="_blank">robert.bradford@intel.com</a>> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">From: Rob Bradford <<a href="mailto:rob@linux.intel.com">rob@linux.intel.com</a>> Add a destroy listener so that when the current surface associated with the pointer is destroyed we can reset the pointer to the current surface. In order to achieve this add a wl_pointer_set_current() which handles assigning the surface and creating the listener. This resolves a use-after-free error triggered with nested popup surfaces Fixes: <a href="https://bugzilla.gnome.org/show_bug.cgi?id=696946" target="_blank">https://bugzilla.gnome.org/show_bug.cgi?id=696946</a> --- src/wayland-server.c | 22 ++++++++++++++++++++++ src/wayland-server.h | 3 +++ 2 files changed, 25 insertions(+) diff --git a/src/wayland-server.c b/src/wayland-server.c index 384b465..3710d8b 100644 --- a/src/wayland-server.c +++ b/src/wayland-server.c @@ -946,6 +946,28 @@ wl_pointer_end_grab(struct wl_pointer *pointer) pointer->current_x, pointer->current_y); } +static void +current_surface_destroy(struct wl_listener *listener, void *data) +{ + struct wl_pointer *pointer = + container_of(listener, struct wl_pointer, current_listener); + + pointer->current = NULL; +} + +WL_EXPORT void +wl_pointer_set_current(struct wl_pointer *pointer, struct wl_surface *surface) +{ + pointer->current = surface; + + if (!surface) + return; + + wl_signal_add(&surface->resource.destroy_signal, + &pointer->current_listener); + pointer->current_listener.notify = current_surface_destroy; +} + WL_EXPORT void wl_touch_start_grab(struct wl_touch *touch, struct wl_touch_grab *grab) { diff --git a/src/wayland-server.h b/src/wayland-server.h index e5a862a..af2be62 100644 --- a/src/wayland-server.h +++ b/src/wayland-server.h @@ -312,6 +312,7 @@ struct wl_pointer { wl_fixed_t x, y; struct wl_surface *current; + struct wl_listener current_listener; wl_fixed_t current_x, current_y; uint32_t button_count; @@ -450,6 +451,8 @@ wl_pointer_start_grab(struct wl_pointer *pointer, struct wl_pointer_grab *grab); void wl_pointer_end_grab(struct wl_pointer *pointer); +void +wl_pointer_set_current(struct wl_pointer *pointer, struct wl_surface *surface); void wl_keyboard_init(struct wl_keyboard *keyboard); -- 1.8.1.4 _______________________________________________ wayland-devel mailing list <a href="mailto:wayland-devel@lists.freedesktop.org">wayland-devel@lists.freedesktop.org</a> <a href="http://lists.freedesktop.org/mailman/listinfo/wayland-devel" target="_blank">http://lists.freedesktop.org/mailman/listinfo/wayland-devel</a> </blockquote></div> </div>