[Spice-devel] [PATCH] client: x11: fix a crash caused by a call to a destroyed window.

[Yonit Halperin]

Happens when a focused window is destroyed without a focus out event,
and a focus-in event occurs on another window.
---
 client/x11/red_window.cpp |   12 +++++++++---
 client/x11/red_window_p.h |    2 +-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/client/x11/red_window.cpp b/client/x11/red_window.cpp
index 9a0423a..6be3ba5 100644
--- a/client/x11/red_window.cpp
+++ b/client/x11/red_window.cpp
@@ -1051,11 +1051,17 @@ RedWindow_p::RedWindow_p()
 {
 }
 
-void RedWindow_p::destroy(PixelsSource_p& pix_source)
+void RedWindow_p::destroy(RedWindow& red_window, PixelsSource_p& pix_source)
 {
     if (_win == None) {
         return;
     }
+
+    if (focus_window == &red_window) {
+        focus_window = NULL;
+        red_window.on_focus_out();
+    }
+
     XPlatform::cleare_win_proc(_win);
     XSelectInput(x_display, _win, 0);
     XSync(x_display, False);
@@ -1163,7 +1169,7 @@ void RedWindow_p::migrate(RedWindow& red_window, PixelsSource_p& pix_source, int
     }
     XTextProperty text_pro;
     bool valid_title = XGetWMName(x_display, _win, &text_pro) && text_pro.value;
-    destroy(pix_source);
+    destroy(red_window, pix_source);
     create(red_window, pix_source, _show_pos.x, _show_pos.y, attrib.width, attrib.height,
            to_screen);
     if (valid_title) {
@@ -1227,7 +1233,7 @@ RedWindow::RedWindow(RedWindow::Listener& listener, int screen)
 
 RedWindow::~RedWindow()
 {
-    destroy(*(PixelsSource_p*)get_opaque());
+    destroy(*this, *(PixelsSource_p*)get_opaque());
     if (_local_cursor) {
         _local_cursor->unref();
     }
diff --git a/client/x11/red_window_p.h b/client/x11/red_window_p.h
index e630b61..9a1c77f 100644
--- a/client/x11/red_window_p.h
+++ b/client/x11/red_window_p.h
@@ -36,7 +36,7 @@ public:
     void migrate(RedWindow& red_window, PixelsSource_p& pix_source, int dest_screen);
     void create(RedWindow& red_window, PixelsSource_p& pix_source, int x, int y,
                 unsigned int width, unsigned int height, int in_screen);
-    void destroy(PixelsSource_p& pix_source);
+    void destroy(RedWindow& red_window, PixelsSource_p& pix_source);
     void set_minmax(PixelsSource_p& pix_source, int width, int height);
     void wait_for_reparent();
     void wait_for_map();
-- 
1.6.6.1