weston crash in destroy_shell_surface

[Dima Ryazanov]

I haven't figured out how to fix the crash, but wanted to bring it up
before the 1.4 release.

It's pretty easy to reproduce it:
1. Open weston-terminal (or maybe another client)
2. Right-click the titlebar
3. Click "close"

As far as I can tell, the problem is these lines in destroy_shell_surface
in shell.c:

wl_list_remove(&shsurf->children_link);
wl_list_for_each_safe(child, next, &shsurf->children_list, children_link) {
wl_list_remove(&child->children_link);
child->parent = NULL;
}

The same children_link gets removed twice, resulting in a NULL pointer.
First, the parent surface calls "wl_list_remove(&child->children_link);" on
its child. Later, the child surface itself gets destroyed and calls
"wl_list_remove(&shsurf->children_link);" on itself. I don't understand the
code well enough to fix this, though.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/wayland-devel/attachments/20140121/116cd0bb/attachment.html>