[PATCH wayland] client: Check reference count only for destroyed proxies

[Kristian Høgsberg]

On Thu, Mar 07, 2013 at 11:32:39PM +0100, Jonas Ådahl wrote:
> The llvm static analyzer tool reported "Use of memory after it is freed"
> in dispatch_event() because the proxy is used after being freed if the
> reference count reaches zero without the destroyed flag being set. This
> would never happen in practice because the owner of the proxy object
> always holds a reference until calling wl_proxy_destroy() which would
> also set the destroyed flag.
> 
> Since this is the case, it is safe to do the reference count check only
> if the destroyed flag is set, as it can never reach zero if not.
> 
> This commit doesn't change the behavior of the function, but makes the
> static analyzer more happy.
> 
> Fixes https://bugs.freedesktop.org/show_bug.cgi?id=61385

Yes, looks fine, thanks.

Kristian

> Signed-off-by: Jonas Ådahl <jadahl at gmail.com>
> ---
>  src/wayland-client.c |    6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/src/wayland-client.c b/src/wayland-client.c
> index 74e4657..3ead2ac 100644
> --- a/src/wayland-client.c
> +++ b/src/wayland-client.c
> @@ -822,10 +822,10 @@ dispatch_event(struct wl_display *display, struct wl_event_queue *queue)
>  	proxy_destroyed = !!(proxy->flags & WL_PROXY_FLAG_DESTROYED);
>  
>  	proxy->refcount--;
> -	if (!proxy->refcount)
> -		free(proxy);
> -
>  	if (proxy_destroyed) {
> +		if (!proxy->refcount)
> +			free(proxy);
> +
>  		wl_closure_destroy(closure);
>  		return;
>  	}
> -- 
> 1.7.10.4
> 
> _______________________________________________
> wayland-devel mailing list
> wayland-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/wayland-devel