[PATCH weston] desktop-shell: destroy surfaces in an idle handler after fade out

[Derek Foreman]

It's possible for more than one animation to be taking place on a view at
the same time.  If one of those animations is the shell's fade out for
dying surfaces, its completion handler will trigger the surface destroy
signal, causing other animations on the animation list to remove themselves.

Since this removal occurs during the linked list walk, the compositor may
crash.

We move the actual surface destruction into an idle handler to avoid this.

Signed-off-by: Derek Foreman <derekf at osg.samsung.com>
---
 desktop-shell/shell.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/desktop-shell/shell.c b/desktop-shell/shell.c
index 96aa8f3..0dc7c6d 100644
--- a/desktop-shell/shell.c
+++ b/desktop-shell/shell.c
@@ -176,6 +176,8 @@ struct shell_surface {
 	bool has_set_geometry, has_next_geometry;
 
 	int focus_count;
+
+	bool destroying;
 };
 
 struct shell_grab {
@@ -3569,7 +3571,7 @@ shell_handle_surface_destroy(struct wl_listener *listener, void *data)
 }
 
 static void
-fade_out_done(struct weston_view_animation *animation, void *data)
+fade_out_done_idle_cb(void *data)
 {
 	struct shell_surface *shsurf = data;
 
@@ -3577,6 +3579,21 @@ fade_out_done(struct weston_view_animation *animation, void *data)
 }
 
 static void
+fade_out_done(struct weston_view_animation *animation, void *data)
+{
+	struct shell_surface *shsurf = data;
+	struct wl_event_loop *loop;
+
+	loop = wl_display_get_event_loop(
+				shsurf->surface->compositor->wl_display);
+
+	if (!shsurf->destroying) {
+		wl_event_loop_add_idle(loop, fade_out_done_idle_cb, shsurf);
+		shsurf->destroying = true;
+	}
+}
+
+static void
 handle_resource_destroy(struct wl_listener *listener, void *data)
 {
 	struct shell_surface *shsurf =
-- 
2.1.4