[PATCH 2/3] Fix server crash when a client dies during a drag with an icon

[Kristian Hoegsberg]

On Thu, Mar 01, 2012 at 02:09:42PM +0200, Ander Conselvan de Oliveira wrote:
> If a client dies during a drag that it started using an icon surface,
> the server could crash because the icon surface is not valid anymore.
> 
> Fix this by using a destroy listener to reset device->drag_surface to
> nil when the surface is destroyed.

Looks good, applied.
Kristian

> ---
>  src/data-device.c    |   19 ++++++++++++++++++-
>  src/wayland-server.h |    1 +
>  2 files changed, 19 insertions(+), 1 deletions(-)
> 
> diff --git a/src/data-device.c b/src/data-device.c
> index 0c7fa65..f0f6baa 100644
> --- a/src/data-device.c
> +++ b/src/data-device.c
> @@ -253,6 +253,7 @@ drag_grab_button(struct wl_pointer_grab *grab,
>  
>  			implementation->attach(surface_resource->client,
>  					       surface_resource, NULL, 0, 0);
> +			wl_list_remove(&device->drag_icon_listener.link);
>  		}
>  
>  		device->drag_data_source = NULL;
> @@ -267,6 +268,18 @@ static const struct wl_pointer_grab_interface drag_grab_interface = {
>  };
>  
>  static void
> +destroy_data_device_icon(struct wl_listener *listener,
> +			 struct wl_resource *resource, uint32_t time)
> +{
> +	struct wl_input_device *device;
> +
> +	device = container_of(listener, struct wl_input_device,
> +			      drag_icon_listener);
> +
> +	device->drag_surface = NULL;
> +}
> +
> +static void
>  data_device_start_drag(struct wl_client *client, struct wl_resource *resource,
>  		       struct wl_resource *source_resource,
>  		       struct wl_resource *origin_resource,
> @@ -282,8 +295,12 @@ data_device_start_drag(struct wl_client *client, struct wl_resource *resource,
>  	device->drag_grab.interface = &drag_grab_interface;
>  	device->drag_data_source = source_resource->data;
>  
> -	if (icon_resource)
> +	if (icon_resource) {
>  		device->drag_surface = icon_resource->data;
> +		device->drag_icon_listener.func = destroy_data_device_icon;
> +		wl_list_insert(icon_resource->destroy_listener_list.prev,
> +			       &device->drag_icon_listener.link);
> +	}
>  
>  	wl_input_device_start_pointer_grab(device, &device->drag_grab, time);
>  }
> diff --git a/src/wayland-server.h b/src/wayland-server.h
> index 2a21111..49ab5b1 100644
> --- a/src/wayland-server.h
> +++ b/src/wayland-server.h
> @@ -232,6 +232,7 @@ struct wl_input_device {
>  	struct wl_listener drag_focus_listener;
>  	struct wl_pointer_grab drag_grab;
>  	struct wl_surface *drag_surface;
> +	struct wl_listener drag_icon_listener;
>  
>  	struct wl_data_source *selection_data_source;
>  	struct wl_listener selection_data_source_listener;
> -- 
> 1.7.4.1
> 
> _______________________________________________
> wayland-devel mailing list
> wayland-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/wayland-devel