[PATCH wayland] client: Check that the proxy object exists before invoking closure

[Jonas Ådahl]

Even when a closure got queued in the queue of a proxy, the proxy object
can be destroyed during a closure invoke earlier in the queue. Therefore
check that the proxy object still exists before invoking a closure.

Signed-off-by: Jonas Ådahl <jadahl at gmail.com>
---

Hi,

I've been seeing crashes in dispatch_event() when destroying the closure,
and it seems to be because of how frame callbacks were handled in mesa in
combination with surfaces being destroyed. The cause seems to be a race
condition occurring when eglSwapBuffers() is called soon after
eglSurfaceDestroy(), for example when a surface is attached after another
was destroyed.

This race condition could be fixed by destroying the callback proxy when
destroying the surface, but doing this triggers another bug in the event
queue handling code which is fixed in this patch. What happened was that
when a proxy object was destroyed as explained above, it could
potentially happen after a closure associated with the proxy object was
queued, but before it was invoked.

Jonas

 src/wayland-client.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wayland-client.c b/src/wayland-client.c
index 7e50b40..155a5b7 100644
--- a/src/wayland-client.c
+++ b/src/wayland-client.c
@@ -740,7 +740,7 @@ dispatch_event(struct wl_display *display, struct wl_event_queue *queue)
 
 	pthread_mutex_unlock(&display->mutex);
 
-	if (proxy != WL_ZOMBIE_OBJECT &&
+	if (proxy && proxy != WL_ZOMBIE_OBJECT &&
 	    proxy->object.implementation && ret == 0) {
 		if (wl_debug)
 			wl_closure_print(closure, &proxy->object, false);
-- 
1.7.10.4