Zoom is a neat trick, but in its current form it's very hard to test
and maintain.
It also causes output damage to scale outside of the output's boundaries,
which leads to an extra clipping step that's only necessary when zoom
is enabled.
Remove it to simplify desktop-shell and compositor.
Signed-off-by: Derek Foreman <derek.foreman@collabora.com>
This properly takes care of removing any of the views being added into
different layers upon shell destruction. Aggregates the shell_surface
destruction into one place to make things much more clearer. Keep the
animation part only the weston_desktop_surface destruction rather than
doing it at shutdown.
Fixes#509.
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
Starting with commit 'desktop-shell: Embed keyboard focus handle code
when activating' we are iterating over all the seats when removing a
weston_desktop_surface to be able to invalidate the activate surface.
Upon compositor tear down the shell destroy might invalidate seats
before removal of the weston_desktop_surface making the shell_seat
itself invalid. This wasn't apparent at that time because we're not
handling at that the removal of surfaces from layers.
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
Attempting to perform a switch on a surface (already) closed will trip
the assert in activate(), so check if we have a weston_desktop_surface
before trying to activate it.
Fixes#543
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
We no longer make use of the keyboard_focus_listener so remove it
entirely.
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
Suggested-by: Derek Foreman <derek.foreman@collabora.com>
We shouldn't be constrained by having a keyboard plugged-in, so avoid
activating/de-activating the window/surface in the keyboard focus
handler and embed it straight into the window activation part.
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
The shsurf is calloc'ed so the surface count is always 0. Not only
that but the surface is not set as active by default, so there's no
need to de-activate it.
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
The keyboard focus listener, caps changed and pointer focus listener
were missing when destroying the seat. These are necessary to avoid
using weston_desktop object even if it was destroyed, which happens due
to a focus out event and ultimately handled by the keyboard focus notify
callback.
Once the seats are destroyed (and implictly the focus handlers) we're
safe to destroy weston_desktop object as well.
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
This properly tracks the seats and with it, destroys them before
destroying weston_desktop object.
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
Fixes an issue where subsurface extending outside of the main surface
wasn't damaged when minimized resulting in left-over content.
Signed-off-by: Jonas Ådahl <jadahl@gmail.com>
Follow-up from commit 'desktop-shell: don't run fade animation if
compositor is inactive' where the reference was dropped directly,
instead of using weston_surface_destroy().
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
When a window is closed, Weston will, by default, run a fade out animation and
defer destroying the underlying surface until it completes. However, if the
compositor is sleeping, and therefore not rendering any frames, this animation
will *never* complete. Therefore, if windows are repeatedly created and
destroyed while in sleep mode, these surfaces will keep accumulating, and since
the buffers attached to them may be backed by an fd, eventually the ulimit will
be reached resulting in a potential crash or other errors.
This can be demonstrated repeatedly launching and killing an X11 application
with Xwayland running.
while true; do xterm & pid=$!; sleep 0.5; kill $pid; done
As soon as the compositor goes to sleep, one can observe a steadily growing
list of dmabufs in the output of lsof.
As a fix, desktop_surface_removed should check whether the compositor is active
before kicking off the fade animation. If it is not, it should instead drop the
extra reference taken in desktop_surface_committed and then destroy the surface
immediately.
Signed-off-by: Erik Kurzinger <ekurzinger@nvidia.com>
This fixes the following ASan detected leaks:
Direct leak of 88 byte(s) in 1 object(s) allocated from:
#0 0x7f8c3455f330 in __interceptor_malloc (/lib/x86_64-linux-gnu/libasan.so.5+0xe9330)
#1 0x7f8c33c60906 in wl_event_loop_add_timer ../../git/wayland/src/event-loop.c:571
#2 0x7f8c2ff98f46 in shell_fade_init ../../git/weston/desktop-shell/shell.c:4211
#3 0x7f8c2ff9e1da in wet_shell_init ../../git/weston/desktop-shell/shell.c:5266
#4 0x7f8c3443ede5 in wet_load_shell ../../git/weston/compositor/main.c:956
#5 0x7f8c3444fdb9 in wet_main ../../git/weston/compositor/main.c:3434
#6 0x55878ad3bfc6 in execute_compositor ../../git/weston/tests/weston-test-fixture-compositor.c:432
#7 0x55878ad3f9fa in weston_test_harness_execute_as_client ../../git/weston/tests/weston-test-runner.c:528
#8 0x55878ad2fbd6 in fixture_setup ../../git/weston/tests/viewporter-test.c:46
#9 0x55878ad2fc58 in fixture_setup_run_ ../../git/weston/tests/viewporter-test.c:48
#10 0x55878ad3ffaf in main ../../git/weston/tests/weston-test-runner.c:661
#11 0x7f8c340b409a in __libc_start_main ../csu/libc-start.c:308
#12 0x55878ad2f769 in _start (/home/pq/build/weston-meson/tests/test-viewporter+0xc769)
Indirect leak of 856 byte(s) in 1 object(s) allocated from:
#0 0x7f8c3455f518 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0xe9518)
#1 0x7f8c33c99b73 in zalloc ../../git/weston/include/libweston/zalloc.h:38
#2 0x7f8c33c9cfb1 in weston_surface_create ../../git/weston/libweston/compositor.c:574
#3 0x7f8c2ff98230 in shell_fade_create_surface_for_output ../../git/weston/desktop-shell/shell.c:4059
#4 0x7f8c2ff98df6 in shell_fade_init ../../git/weston/desktop-shell/shell.c:4202
#5 0x7f8c2ff9e1da in wet_shell_init ../../git/weston/desktop-shell/shell.c:5266
#6 0x7f8c3443ede5 in wet_load_shell ../../git/weston/compositor/main.c:956
#7 0x7f8c3444fdb9 in wet_main ../../git/weston/compositor/main.c:3434
#8 0x55878ad3bfc6 in execute_compositor ../../git/weston/tests/weston-test-fixture-compositor.c:432
#9 0x55878ad3f9fa in weston_test_harness_execute_as_client ../../git/weston/tests/weston-test-runner.c:528
#10 0x55878ad2fbd6 in fixture_setup ../../git/weston/tests/viewporter-test.c:46
#11 0x55878ad2fc58 in fixture_setup_run_ ../../git/weston/tests/viewporter-test.c:48
#12 0x55878ad3ffaf in main ../../git/weston/tests/weston-test-runner.c:661
#13 0x7f8c340b409a in __libc_start_main ../csu/libc-start.c:308
#14 0x55878ad2f769 in _start (/home/pq/build/weston-meson/tests/test-viewporter+0xc769)
Indirect leak of 608 byte(s) in 1 object(s) allocated from:
#0 0x7f8c3455f518 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0xe9518)
#1 0x7f8c33c99b73 in zalloc ../../git/weston/include/libweston/zalloc.h:38
#2 0x7f8c33c9bed5 in weston_view_create ../../git/weston/libweston/compositor.c:365
#3 0x7f8c2ff98251 in shell_fade_create_surface_for_output ../../git/weston/desktop-shell/shell.c:4063
#4 0x7f8c2ff98df6 in shell_fade_init ../../git/weston/desktop-shell/shell.c:4202
#5 0x7f8c2ff9e1da in wet_shell_init ../../git/weston/desktop-shell/shell.c:5266
#6 0x7f8c3443ede5 in wet_load_shell ../../git/weston/compositor/main.c:956
#7 0x7f8c3444fdb9 in wet_main ../../git/weston/compositor/main.c:3434
#8 0x55878ad3bfc6 in execute_compositor ../../git/weston/tests/weston-test-fixture-compositor.c:432
#9 0x55878ad3f9fa in weston_test_harness_execute_as_client ../../git/weston/tests/weston-test-runner.c:528
#10 0x55878ad2fbd6 in fixture_setup ../../git/weston/tests/viewporter-test.c:46
#11 0x55878ad2fc58 in fixture_setup_run_ ../../git/weston/tests/viewporter-test.c:48
#12 0x55878ad3ffaf in main ../../git/weston/tests/weston-test-runner.c:661
#13 0x7f8c340b409a in __libc_start_main ../csu/libc-start.c:308
#14 0x55878ad2f769 in _start (/home/pq/build/weston-meson/tests/test-viewporter+0xc769)
They were found with:
ASAN_OPTIONS=fast_unwind_on_malloc=0,malloc_context_size=50 \
LSAN_OPTIONS=suppressions=/home/pq/git/weston/.gitlab-ci/leak-sanitizer.supp \
./tests/test-viewporter test_viewporter_double_create
Turns out shell_destroy() had an open-coded and outdated copy of the
tear-down sequence, so fixing the leaks in only handle_output_destroy()
was not enough.
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.com>
Most other places call a variable like this 'shell_output', so let's do
that here too. The old name was really confusing.
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.com>
Plugs ASan reported leaks:
Direct leak of 88 byte(s) in 1 object(s) allocated from:
#0 0x7f338f70a518 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0xe9518)
#1 0x7f338afe22f3 in zalloc ../../git/weston/include/libweston/zalloc.h:38
#2 0x7f338afe3cc2 in weston_desktop_xwayland_init ../../git/weston/libweston-desktop/xwayland.c:410
#3 0x7f338afdbaef in weston_desktop_create ../../git/weston/libweston-desktop/libweston-desktop.c:87
#4 0x7f338b148d39 in wet_shell_init ../../git/weston/desktop-shell/shell.c:5224
#5 0x7f338f5e9de5 in wet_load_shell ../../git/weston/compositor/main.c:956
#6 0x7f338f5fadb9 in wet_main ../../git/weston/compositor/main.c:3434
#7 0x5646d2392fc6 in execute_compositor ../../git/weston/tests/weston-test-fixture-compositor.c:432
#8 0x5646d23969fa in weston_test_harness_execute_as_client ../../git/weston/tests/weston-test-runner.c:528
#9 0x5646d2386bd6 in fixture_setup ../../git/weston/tests/viewporter-test.c:46
#10 0x5646d2386c58 in fixture_setup_run_ ../../git/weston/tests/viewporter-test.c:48
#11 0x5646d2396faf in main ../../git/weston/tests/weston-test-runner.c:661
#12 0x7f338f25f09a in __libc_start_main ../csu/libc-start.c:308
#13 0x5646d2386769 in _start (/home/pq/build/weston-meson/tests/test-viewporter+0xc769)
Indirect leak of 152 byte(s) in 1 object(s) allocated from:
#0 0x7f338f70a518 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0xe9518)
#1 0x7f338afdb811 in zalloc ../../git/weston/include/libweston/zalloc.h:38
#2 0x7f338afdb92d in weston_desktop_create ../../git/weston/libweston-desktop/libweston-desktop.c:65
#3 0x7f338b148d39 in wet_shell_init ../../git/weston/desktop-shell/shell.c:5224
#4 0x7f338f5e9de5 in wet_load_shell ../../git/weston/compositor/main.c:956
#5 0x7f338f5fadb9 in wet_main ../../git/weston/compositor/main.c:3434
#6 0x5646d2392fc6 in execute_compositor ../../git/weston/tests/weston-test-fixture-compositor.c:432
#7 0x5646d23969fa in weston_test_harness_execute_as_client ../../git/weston/tests/weston-test-runner.c:528
#8 0x5646d2386bd6 in fixture_setup ../../git/weston/tests/viewporter-test.c:46
#9 0x5646d2386c58 in fixture_setup_run_ ../../git/weston/tests/viewporter-test.c:48
#10 0x5646d2396faf in main ../../git/weston/tests/weston-test-runner.c:661
#11 0x7f338f25f09a in __libc_start_main ../csu/libc-start.c:308
#12 0x5646d2386769 in _start (/home/pq/build/weston-meson/tests/test-viewporter+0xc769)
Indirect leak of 72 byte(s) in 1 object(s) allocated from:
#0 0x7f338f70a518 in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0xe9518)
#1 0x7f338afdc5ae in zalloc ../../git/weston/include/libweston/zalloc.h:38
#2 0x7f338afdc89e in weston_desktop_client_create ../../git/weston/libweston-desktop/client.c:108
#3 0x7f338afe3d2a in weston_desktop_xwayland_init ../../git/weston/libweston-desktop/xwayland.c:415
#4 0x7f338afdbaef in weston_desktop_create ../../git/weston/libweston-desktop/libweston-desktop.c:87
#5 0x7f338b148d39 in wet_shell_init ../../git/weston/desktop-shell/shell.c:5224
#6 0x7f338f5e9de5 in wet_load_shell ../../git/weston/compositor/main.c:956
#7 0x7f338f5fadb9 in wet_main ../../git/weston/compositor/main.c:3434
#8 0x5646d2392fc6 in execute_compositor ../../git/weston/tests/weston-test-fixture-compositor.c:432
#9 0x5646d23969fa in weston_test_harness_execute_as_client ../../git/weston/tests/weston-test-runner.c:528
#10 0x5646d2386bd6 in fixture_setup ../../git/weston/tests/viewporter-test.c:46
#11 0x5646d2386c58 in fixture_setup_run_ ../../git/weston/tests/viewporter-test.c:48
#12 0x5646d2396faf in main ../../git/weston/tests/weston-test-runner.c:661
#13 0x7f338f25f09a in __libc_start_main ../csu/libc-start.c:308
#14 0x5646d2386769 in _start (/home/pq/build/weston-meson/tests/test-viewporter+0xc769)
Oops.
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.com>
This ensures the layers are torn down properly.
See commit: libweston: add weston_layer_fini()
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.com>
get_output_work_area() can be used by exposay to know the free space
where it can render its surfaces, what avoids overlapping the panel.
Currently this function is declared as static in
desktop-shell/shell.c, so it cannot be used by exposay.
Remove static from get_output_work_area() and add it to shell.h
so it can be used by exposay as well.
Signed-off-by: Leandro Ribeiro <leandrohr@riseup.net>
As in some circumstances there could be no output connected, avoid
retrieving the width/height of the output if none was found/connected.
Fixes: #384
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
Introduced with a8da2084, it seems that there are cases when there's no
parent available (zenity, for instance).
Removes any potential child and re-initialize it, in case the parent is
not set. (Simon Ser)
Fixes: #340
Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
Reviewed-by: Simon Ser <contact@emersion.fr>
Reported-by: n3rdopolis <bluescreenavenger@gmail.com>
If a xdg_toplevel surface has a child (or multiple), the desktop shell
still allows to activate the parent. This can be problematic with
modal dialogs such as message boxes which then are hidden behind the
main window, which might be non-responsive to inputs at this this
point.
The protocol specifies set_parent as follows: "Set the 'parent' of
this surface. This surface should be stacked above the parent surface
and all other ancestor surfaces."
Track parent/child relationship in desktop-shell. Follow the protocol
recommendation and make sure the child stays stacked above the parent.
Fixes: #231
Signed-off-by: Stefan Agner <stefan@agner.ch>
Wayland innovated a lot of cool things, but non-binary boolean values is
the great advances of our time.
Make config_parser_get_bool() work on boolean values, and switch all its
users.
Signed-off-by: Daniel Stone <daniels@collabora.com>
This introduces a new convention of checking through the compositor destroy
listener if the plugin is already initialized. If the plugin is already
initialized, then the plugin entry function succeeds as a no-op. This makes it
safe to load the same plugin multiple times in a running compositor.
Currently module loading functions return failure if a plugin is already
loaded, but that will change in the future. Therefore we need this other method
of ensuring we do not double-initialize a plugin which would lead to list
corruptions the very least.
All plugins are converted to use the new helper, except:
- those that do not have a destroy listener already, and
- hmi-controller which does the same open-coded as the common code pattern
did not fit there.
Plugins should always have a compositor destroy listener registered since they
very least allocate a struct to hold their data. Hence omissions are
highlighted in code.
Backends do not need this because weston_compositor_load_backend() already
protects against double-init. GL-renderer does not export a standard module
init function so cannot be initialized the usual way and therefore is not
vulnerable to double-init.
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.com>
When hotunplugging a display, the compositor will tear down the
corresponding output object.
Avoid NULL output dereferences by all surface label getters in
desktop-shell when hotunplugging happens.
Signed-off-by: Miguel A Vico Moya <mvicomoya@nvidia.com>
When Fading out a destroyed surface view finishes, the view is rendered
with very little alpha. After that, since the output isn't updated
unless a event on the output doesn't occurs, the view is still on the
output. By unmapping the view, the output repaint scheduled without the
surface.
Signed-off-by: Tomohito Esaki <etom@igel.co.jp>
When the last output is destroyed or when a new output is created after
the last output is destroyed, we need to re-position the views to ensure
that all the views are displayed on the output.
Fixes: https://gitlab.freedesktop.org/wayland/weston/issues/210
Signed-off-by: Harish Krupo <harishkrupo@gmail.com>
This too is a public installed header.
The public headers are moved under a new top-level directory include/ to make
them clearly stand out as special (public API).
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.com>
It is a public installed header used by libweston.h.
See "Rename compositor.h to libweston/libweston.h" for rationale.
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.com>
A surface can get destroyed while a shell grab is active, which can
for example happen if the command running in weston-terminal exits.
When a surface gets destroyed, grab->shsurf is reset to NULL by
destroy_shell_grab_shsurf(), but otherwise the grab remains active and
its callbacks continue to be called. Thus, dereferencing grab->shsurf
in a callback without checking it for NULL first can lead to undefined
behavior, including crashes.
Several functions were already properly checking grab->shsurf for NULL,
move_grab_motion() being one example. Others, however, were not, which
is what this commit fixes.
Related to https://gitlab.freedesktop.org/wayland/weston/issues/192
Signed-off-by: Sergey Bugaev <bugaevc@gmail.com>
Changing the focused surface did remove the surface_destroy_listener from the wl_signal list,
but destroying the focus state did not. As a result, sometimes the same listener would be added
to two surfaces, which would join their wl_signal lists together, which would cause infinite
loops and use-after-frees when closing desktop surfaces.
This crash was happening when *releasing* a pointer button on a window
that was being resized and got destroyed during the grab.
[@daniels: Cosmetic fixes; apply same fix to grab cancel.]
Use the proper weston_compositor_exit API instead of wl_display_terminate() to
allow the compositor main to prepare for exit, and most importantly to set the
exit error code as appropriate.
I have some brokenness in my test suite running, and weston-desktop-shell was
crashing at start, yet the tests did not notice. With this patch, the tests
where the helper crashes are properly marked as failed.
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.com>
Avoid crashes related to get_shell_surface returning NULL.
Surfaces are already allowed to be neither focus nor shell in
e.g. focus_state_surface_destroy.
This allows to possibility to specify where to look for the executable
but also simplifies the need of having to pass either BINDIR/LIBEXECDIR
for retrieving full-path of the executable.
Signed-off-by: Marius Vlad <marius.vlad0@gmail.com>
During de-init ensure removal of added signals from list. Otherwise
a dongling pointer is left behind which will affect other plugins.
Signed-off-by: Harsha M M <harsha.manjulamallikarjun@in.bosch.com>
Reviewed-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
Collect the fallback definitions of static_assert() from desktop-shell
and the test shell, and move them to helpers.h. This allows code
throughout the tree to use static_assert() for build-time assertions,
where it is supported by the compiler.
As GCC goes out of its way to only add static_assert() when C11 has been
explicitly requested - which we don't do - make sure to use the more
widely available _Static_assert() if that is provided.
This will be used in future patches to ensure two array lengths don't go
out of sync.
Signed-off-by: Daniel Stone <daniels@collabora.com>
Reviewed-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
Rather than having a hardcoded dependency on the build-directory layout,
use an explicit module-map environment variable, which rewrites requests
for modules and helper/libexec binaries to specific paths.
Pekka: This will help with migration to Meson where setting up the paths
according to autotools would be painful and unnecessary.
Emre: This should also help setting up the test suite after a
cross-compile.
Pekka: A caveat here is that this patch makes it slightly easier to load
external backends by abusing the module map. External backends are
specifically not supported in libweston.
Signed-off-by: Daniel Stone <daniels@collabora.com>
v2:
Fixed ivi_layout-test-plugin.c:wet_module_init().
Do not change the lookup name of ivi-layout.ivi.
Improved documentation of weston_module_path_from_env() and made it cope
with map strings that a) do not end with a semicolon, and b) have
multiple consecutive semicolons.
Let WESTON_MODULE_MAP be printed into the test log so that it is easier
to run tests manually.
Reviewed-by: Daniel Stone <daniels@collabora.com>
Reviewed-by: Emre Ucan <eucan@de.adit-jv.com>
Suggested by Emil: Use a variable for strlen(name).
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
Running 'weston-simple-egl -f -b' (fullscreen, unthrottled) caused a
crash in shell_ensure_fullscreen_black_view() due to
shsurf->fullscreen_output being NULL. Also shell_configure_fullscreen()
could crash on that condition.
Fix shell_configure_fullscreen() to bail out with minimal work if there
is no fullscreen_output.
It is unclear if anything will cause a reconfiguration when an output is
plugged in.
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
Signed-off-by: Fabien Lahoudere <fabien.lahoudere@collabora.com>
Reviewed-by: Ian Ray <ian.ray@ge.com>
In activate, do not call lower_fullscreen_layer() at all if the output
is NULL. It should not do anything in that case, per the existing
comment.
This is a tentative crash fix for a case where there are no enabled
weston_outputs at all.
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
Signed-off-by: Fabien Lahoudere <fabien.lahoudere@collabora.com>
Reviewed-by: Ian Ray <ian.ray@ge.com>
This is a tentative crash fix for a case where there are no enabled
weston_outputs at all.
If no output is given, just put the surface at 0,0. At least it should
become mostly visible if an output is plugged in, if not centered.
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
Signed-off-by: Fabien Lahoudere <fabien.lahoudere@collabora.com>
Reviewed-by: Ian Ray <ian.ray@ge.com>
This is a tentative crash fix for a case where there are no
enabled weston_outputs at all.
Let get_output_work_area() return a zero area if the given output is
NULL. If there is no output, there is no area. Unfortunately we cannot
return "no position" but have to use 0,0 instead.
In send_configure_for_surface(), this causes a maximized surface to
receive width=0 and height=0 in the configure event, which means the
client is free to choose the size. There is no correct size to send for
maximizing for no output.
In constrain_position(), this has no effect. The interactive move of a
surface is restricted to not go below the panel, so even if a user
managed to move a surface without an output, it just prevents the
surface moving beyond y=0.
In weston_view_set_initial_position(), get_output_work_area() will not
be called with NULL output anyway.
In set_maximized_position(), this makes it behave as if the output was
at 0,0 which is the default position of the first output.
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
Signed-off-by: Fabien Lahoudere <fabien.lahoudere@collabora.com>
Reviewed-by: Ian Ray <ian.ray@ge.com>
This issue was introduced by "desktop-shell: detect stale shell surface
outputs" which forgot to remove the output destroy listener when
shell_surface is destroyed, leading to memory corruption.
This was fairly easy to trigger by opening and closing an application
window a few times.
Signed-off-by: Pekka Paalanen <pekka.paalanen@collabora.co.uk>
Reviewed-by: Ian Ray <ian.ray@ge.com>