[Wayland-bugs] [Bug 79684] subsurfaces: crash when destroying nested subsurfaces

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=79684

George Kiagiadakis <kiagiadakis.george at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |kiagiadakis.george at gmail.co
                   |                            |m

--- Comment #2 from George Kiagiadakis <kiagiadakis.george at gmail.com> ---
I had a look at this bug. The backtrace looks like:

#0  0x00007ffff7bd7b47 in wl_list_remove (elm=elm at entry=0xbbc1a8) at
src/wayland-util.c:54
#1  0x000000000040cba0 in weston_view_destroy (view=0xbbc180) at
src/compositor.c:1711
#2  0x000000000040cc6b in surface_free_unused_subsurface_views
(surface=0xac6610) at src/compositor.c:2018
#3  0x000000000040cc37 in surface_free_unused_subsurface_views
(surface=0xac5da0) at src/compositor.c:2015
#4  0x000000000040ce20 in weston_compositor_build_view_list
(compositor=0x63a250) at src/compositor.c:2104
#5  0x000000000040cb97 in weston_view_destroy (view=0xbbe280) at
src/compositor.c:1708
#6  0x000000000040cc6b in surface_free_unused_subsurface_views
(surface=0xacd4f0) at src/compositor.c:2018
#7  0x000000000040cc37 in surface_free_unused_subsurface_views
(surface=0xac6610) at src/compositor.c:2015
#8  0x000000000040cc37 in surface_free_unused_subsurface_views
(surface=0xac5da0) at src/compositor.c:2015
#9  0x000000000040ce20 in weston_compositor_build_view_list
(compositor=0x63a250) at src/compositor.c:2104
#10 0x000000000040cb97 in weston_view_destroy (view=0xbbeac0) at
src/compositor.c:1708

and continues for ~500 frames. It looks to me as if
weston_compositor_build_view_list() is not meant to be called recursively, as
it operates on the same object (compositor) all the time and just corrupts the
lists on which it works on.

I did a quick hack that works, but it's probably not the best idea:

diff --git a/src/compositor.c b/src/compositor.c                                
index 2c33297..6691e49 100644
--- a/src/compositor.c
+++ b/src/compositor.c
@@ -1699,13 +1699,18 @@ weston_surface_discard_queue(struct weston_surface
*surface)
 WL_EXPORT void
 weston_view_destroy(struct weston_view *view)
 {
+       static int recursing = 0;
+       recursing++;
+
        wl_signal_emit(&view->destroy_signal, view);

        assert(wl_list_empty(&view->geometry.child_list));

        if (weston_view_is_mapped(view)) {
                weston_view_unmap(view);
-               weston_compositor_build_view_list(view->surface->compositor);
+               if (recursing == 1)
+                      
weston_compositor_build_view_list(view->surface->compositor);
        }

        wl_list_remove(&view->link);
@@ -1719,6 +1724,8 @@ weston_view_destroy(struct weston_view *view)
        wl_list_remove(&view->surface_link);

        free(view);
+       recursing--;
 }

 WL_EXPORT void

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/wayland-bugs/attachments/20140609/2522c11d/attachment.html>