[Wayland-bugs] [Bug 61385] wayland-client.c:dispatch_event() dereferences proxy after free

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=61385

--- Comment #1 from Jonas Ådahl <jadahl at gmail.com> ---
Even though the static analyzer cought this, it can never happen in practice.
This is because for a proxy object to reach reference count zero the owner must
destroy it using wl_proxy_destroy(). This has the side effect of adding the
WL_PROXY_FLAG_DESTROYED flag, which would hit the

if (proxy_destroyed) {
        wl_closure_destroy(closure);
        return;
}

statement. However, I can add some extra checks to make the static analyzer
more happy.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/wayland-bugs/attachments/20130224/f7ffb23b/attachment.html>