[Mesa-dev] [PATCH 9.0 stable branch] egl/wayland: Destroy the pending buffer callback with the egl surface

[Ander Conselvan de Oliveira]

From: Ander Conselvan de Oliveira <ander.conselvan.de.oliveira at intel.com>

Otherwise, we crash when the callback is executed, since the dri2_surf
pointer may point to invalid data.
---

The wayland EGL platform code was heavily changed in master for the
implementation of the EGL_EXT_buffer_age extension, so this bug does
not exist there neither does this patch apply.

Thanks,
Ander

 src/egl/drivers/dri2/egl_dri2.h         |    1 +
 src/egl/drivers/dri2/platform_wayland.c |    6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/src/egl/drivers/dri2/egl_dri2.h b/src/egl/drivers/dri2/egl_dri2.h
index 3c42338..2e7b547 100644
--- a/src/egl/drivers/dri2/egl_dri2.h
+++ b/src/egl/drivers/dri2/egl_dri2.h
@@ -177,6 +177,7 @@ struct dri2_egl_surface
    __DRIbuffer           *third_buffer;
    __DRIbuffer           *pending_buffer;
    struct wl_callback    *frame_callback;
+   struct wl_callback    *pending_buffer_callback;
    int			  format;
 #endif
 
diff --git a/src/egl/drivers/dri2/platform_wayland.c b/src/egl/drivers/dri2/platform_wayland.c
index 59371d6..ccff9a8 100644
--- a/src/egl/drivers/dri2/platform_wayland.c
+++ b/src/egl/drivers/dri2/platform_wayland.c
@@ -145,6 +145,7 @@ dri2_create_surface(_EGLDriver *drv, _EGLDisplay *disp, EGLint type,
    dri2_surf->pending_buffer = NULL;
    dri2_surf->third_buffer = NULL;
    dri2_surf->frame_callback = NULL;
+   dri2_surf->pending_buffer_callback = NULL;
 
    if (conf->AlphaSize == 0)
       dri2_surf->format = WL_DRM_FORMAT_XRGB8888;
@@ -232,6 +233,9 @@ dri2_destroy_surface(_EGLDriver *drv, _EGLDisplay *disp, _EGLSurface *surf)
    if (dri2_surf->frame_callback)
       wl_callback_destroy(dri2_surf->frame_callback);
 
+   if (dri2_surf->pending_buffer_callback)
+      wl_callback_destroy(dri2_surf->pending_buffer_callback);
+
 
    if (dri2_surf->base.Type == EGL_WINDOW_BIT) {
       dri2_surf->wl_win->private = NULL;
@@ -299,6 +303,7 @@ dri2_release_pending_buffer(void *data,
    dri2_surf->pending_buffer = NULL;
 
    wl_callback_destroy(callback);
+   dri2_surf->pending_buffer_callback = NULL;
 }
 
 static const struct wl_callback_listener release_buffer_listener = {
@@ -331,6 +336,7 @@ dri2_release_buffers(struct dri2_egl_surface *dri2_surf)
 				     &release_buffer_listener, dri2_surf);
             wl_proxy_set_queue((struct wl_proxy *) callback,
                                dri2_dpy->wl_queue);
+            dri2_surf->pending_buffer_callback = callback;
             break;
          default:
             dri2_dpy->dri2->releaseBuffer(dri2_dpy->dri_screen,
-- 
1.7.9.5