Even when a closure got queued in the queue of a proxy, the proxy object can be destroyed during a closure invoke earlier in the queue. Therefore check that the proxy object still exists before invoking a closure.
Signed-off-by: Jonas Ådahl <[email protected]> --- Hi, I've been seeing crashes in dispatch_event() when destroying the closure, and it seems to be because of how frame callbacks were handled in mesa in combination with surfaces being destroyed. The cause seems to be a race condition occurring when eglSwapBuffers() is called soon after eglSurfaceDestroy(), for example when a surface is attached after another was destroyed. This race condition could be fixed by destroying the callback proxy when destroying the surface, but doing this triggers another bug in the event queue handling code which is fixed in this patch. What happened was that when a proxy object was destroyed as explained above, it could potentially happen after a closure associated with the proxy object was queued, but before it was invoked. Jonas src/wayland-client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/wayland-client.c b/src/wayland-client.c index 7e50b40..155a5b7 100644 --- a/src/wayland-client.c +++ b/src/wayland-client.c @@ -740,7 +740,7 @@ dispatch_event(struct wl_display *display, struct wl_event_queue *queue) pthread_mutex_unlock(&display->mutex); - if (proxy != WL_ZOMBIE_OBJECT && + if (proxy && proxy != WL_ZOMBIE_OBJECT && proxy->object.implementation && ret == 0) { if (wl_debug) wl_closure_print(closure, &proxy->object, false); -- 1.7.10.4 _______________________________________________ wayland-devel mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/wayland-devel
