xserver: Branch 'server-1.20-branch'

[GitLab Mirror]

 hw/xwayland/xwayland-present.c |    8 +-------
 hw/xwayland/xwayland.c         |   11 +++++++++--
 hw/xwayland/xwayland.h         |    2 +-
 3 files changed, 11 insertions(+), 10 deletions(-)

New commits:
commit b259485975078087fe6bde2b9e1eccf4ae14120c
Author: Michel Dänzer <mdaenzer at redhat.com>
Date:   Tue Mar 17 11:45:22 2020 +0100

    xwayland: Delete all frame_callback_list nodes in xwl_unrealize_window
    
    We were only calling xwl_present_unrealize_window for the toplevel
    window, but the list can contain entries from child windows as well,
    in which case we were leaving dangling pointers to freed memory.
    
    Closes: https://gitlab.freedesktop.org/xorg/xserver/issues/1000
    Fixes: c5067feaeea1 "xwayland: Use single frame callback for Present
                         flips and normal updates"
    Reviewed-by: Olivier Fourdan <ofourdan at redhat.com>
    Tested-by: Olivier Fourdan <ofourdan at redhat.com>
    (cherry picked from commit 5e91587302e85fd6f0e8d5ffbe30182e18c6913f)

diff --git a/hw/xwayland/xwayland-present.c b/hw/xwayland/xwayland-present.c
index c7c077aaa..5ba7dce08 100644
--- a/hw/xwayland/xwayland-present.c
+++ b/hw/xwayland/xwayland-present.c
@@ -524,14 +524,8 @@ xwl_present_flips_stop(WindowPtr window)
 }
 
 void
-xwl_present_unrealize_window(WindowPtr window)
+xwl_present_unrealize_window(struct xwl_present_window *xwl_present_window)
 {
-    struct xwl_present_window *xwl_present_window = xwl_present_window_priv(window);
-
-    if (!xwl_present_window ||
-        xorg_list_is_empty(&xwl_present_window->frame_callback_list))
-        return;
-
     /* The pending frame callback may never be called, so drop it and shorten
      * the frame timer interval.
      */
diff --git a/hw/xwayland/xwayland.c b/hw/xwayland/xwayland.c
index 5fefa5923..ed9f2e3c2 100644
--- a/hw/xwayland/xwayland.c
+++ b/hw/xwayland/xwayland.c
@@ -700,8 +700,15 @@ xwl_unrealize_window(WindowPtr window)
         wl_callback_destroy(xwl_window->frame_callback);
 
 #ifdef GLAMOR_HAS_GBM
-    if (xwl_screen->present)
-        xwl_present_unrealize_window(window);
+    if (xwl_screen->present) {
+        struct xwl_present_window *xwl_present_window, *tmp;
+
+        xorg_list_for_each_entry_safe(xwl_present_window, tmp,
+                                      &xwl_window->frame_callback_list,
+                                      frame_callback_list) {
+            xwl_present_unrealize_window(xwl_present_window);
+        }
+    }
 #endif
 
     free(xwl_window);
diff --git a/hw/xwayland/xwayland.h b/hw/xwayland/xwayland.h
index a12ec257b..daa719209 100644
--- a/hw/xwayland/xwayland.h
+++ b/hw/xwayland/xwayland.h
@@ -456,7 +456,7 @@ void xwl_glamor_egl_make_current(struct xwl_screen *xwl_screen);
 void xwl_present_frame_callback(struct xwl_present_window *xwl_present_window);
 Bool xwl_present_init(ScreenPtr screen);
 void xwl_present_cleanup(WindowPtr window);
-void xwl_present_unrealize_window(WindowPtr window);
+void xwl_present_unrealize_window(struct xwl_present_window *xwl_present_window);
 #endif /* GLAMOR_HAS_GBM */
 
 #ifdef XV