[PATCH wayland] client: Check reference count only for destroyed proxies

Jonas Ådahl jadahl at gmail.com
Thu Mar 7 14:32:39 PST 2013


The llvm static analyzer tool reported "Use of memory after it is freed"
in dispatch_event() because the proxy is used after being freed if the
reference count reaches zero without the destroyed flag being set. This
would never happen in practice because the owner of the proxy object
always holds a reference until calling wl_proxy_destroy() which would
also set the destroyed flag.

Since this is the case, it is safe to do the reference count check only
if the destroyed flag is set, as it can never reach zero if not.

This commit doesn't change the behavior of the function, but makes the
static analyzer more happy.

Fixes https://bugs.freedesktop.org/show_bug.cgi?id=61385

Signed-off-by: Jonas Ådahl <jadahl at gmail.com>
---
 src/wayland-client.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/wayland-client.c b/src/wayland-client.c
index 74e4657..3ead2ac 100644
--- a/src/wayland-client.c
+++ b/src/wayland-client.c
@@ -822,10 +822,10 @@ dispatch_event(struct wl_display *display, struct wl_event_queue *queue)
 	proxy_destroyed = !!(proxy->flags & WL_PROXY_FLAG_DESTROYED);
 
 	proxy->refcount--;
-	if (!proxy->refcount)
-		free(proxy);
-
 	if (proxy_destroyed) {
+		if (!proxy->refcount)
+			free(proxy);
+
 		wl_closure_destroy(closure);
 		return;
 	}
-- 
1.7.10.4



More information about the wayland-devel mailing list