[PATCH] Destroy resources when destroying input and output

[Mariusz Ceier]

Some structures containing resources list are freed before resources
on that list are destroyed, and that triggers invalid read/write
in compositor.c:3103 indirectly called from text-backend.c:938
when running weston under valgrind.

This patch destroys resources on these lists before such
structures are freed.

That fixes at least x11 and freerds backend.

Signed-off-by: Mariusz Ceier <mceier+wayland at gmail.com>
---
 src/compositor.c |  4 ++++
 src/input.c      | 15 ++++++++++++---
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/src/compositor.c b/src/compositor.c
index ff0f3ab..a4077e8 100644
--- a/src/compositor.c
+++ b/src/compositor.c
@@ -3183,6 +3183,7 @@ weston_compositor_verify_pointers(struct weston_compositor *ec)
 WL_EXPORT void
 weston_output_destroy(struct weston_output *output)
 {
+	struct wl_resource *resource, *next_resource;
 	output->destroying = 1;
 
 	weston_compositor_remove_output(output->compositor, output);
@@ -3192,6 +3193,9 @@ weston_output_destroy(struct weston_output *output)
 
 	wl_signal_emit(&output->destroy_signal, output);
 
+	wl_resource_for_each_safe(resource, next_resource, &output->resource_list)
+		wl_resource_destroy(resource);
+
 	free(output->name);
 	pixman_region32_fini(&output->region);
 	pixman_region32_fini(&output->previous_damage);
diff --git a/src/input.c b/src/input.c
index 07e9d6c..062a2cb 100644
--- a/src/input.c
+++ b/src/input.c
@@ -471,10 +471,13 @@ weston_pointer_create(struct weston_seat *seat)
 WL_EXPORT void
 weston_pointer_destroy(struct weston_pointer *pointer)
 {
+	struct wl_resource *resource, *next_resource;
+
 	if (pointer->sprite)
 		pointer_unmap_sprite(pointer);
 
-	/* XXX: What about pointer->resource_list? */
+	wl_resource_for_each_safe(resource, next_resource, &pointer->resource_list)
+		wl_resource_destroy(resource);
 
 	wl_list_remove(&pointer->focus_resource_listener.link);
 	wl_list_remove(&pointer->focus_view_listener.link);
@@ -520,7 +523,7 @@ weston_xkb_info_destroy(struct weston_xkb_info *xkb_info);
 WL_EXPORT void
 weston_keyboard_destroy(struct weston_keyboard *keyboard)
 {
-	/* XXX: What about keyboard->resource_list? */
+	struct wl_resource *resource, *next_resource;
 
 #ifdef ENABLE_XKBCOMMON
 	if (keyboard->seat->compositor->use_xkbcommon) {
@@ -533,6 +536,9 @@ weston_keyboard_destroy(struct weston_keyboard *keyboard)
 	}
 #endif
 
+	wl_resource_for_each_safe(resource, next_resource, &keyboard->resource_list)
+		wl_resource_destroy(resource);
+
 	wl_array_release(&keyboard->keys);
 	wl_list_remove(&keyboard->focus_resource_listener.link);
 	free(keyboard);
@@ -570,7 +576,10 @@ weston_touch_create(void)
 WL_EXPORT void
 weston_touch_destroy(struct weston_touch *touch)
 {
-	/* XXX: What about touch->resource_list? */
+	struct wl_resource *resource, *next_resource;
+
+	wl_resource_for_each_safe(resource, next_resource, &touch->resource_list)
+		wl_resource_destroy(resource);
 
 	wl_list_remove(&touch->focus_view_listener.link);
 	wl_list_remove(&touch->focus_resource_listener.link);
-- 
1.8.5.2