From a46b946cb3842a6e6296ed7c4c7b0303096a2b00 Mon Sep 17 00:00:00 2001 From: Bryan Cain Date: Fri, 4 Apr 2014 17:41:24 -0500 Subject: [PATCH] shell: Fix segfault from trying to access a destroyed popup shell surface The shell_destroy_shell_surface function only set the backing resource to NULL, leaving an unusable surface in the popup_grab list until the surface's fading animation finished and it could be freed. This caused a segfault if the shell tried to forcibly break the grab during that time interval due to the compositor losing the keyboard focus. https://bugs.freedesktop.org/show_bug.cgi?id=77072 --- desktop-shell/shell.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/desktop-shell/shell.c b/desktop-shell/shell.c index 59fa99c2..fe03420e 100644 --- a/desktop-shell/shell.c +++ b/desktop-shell/shell.c @@ -3050,6 +3050,8 @@ shell_destroy_shell_surface(struct wl_resource *resource) { struct shell_surface *shsurf = wl_resource_get_user_data(resource); + if (!wl_list_empty(&shsurf->popup.grab_link)) + remove_popup_grab(shsurf); shsurf->resource = NULL; }