egl/wayland: Destroy the pending buffer callback with the egl surface

Otherwise, we crash when the callback is executed, since the dri2_surf
pointer may point to invalid data.

Reviewed-by: Kristian Høgsberg <krh@bitplanet.net>
This commit is contained in:
Ander Conselvan de Oliveira 2013-01-21 17:36:52 +02:00 committed by Andreas Boll
parent cd0e19a749
commit 81d40e66ad
2 changed files with 7 additions and 0 deletions

View file

@ -177,6 +177,7 @@ struct dri2_egl_surface
__DRIbuffer *third_buffer;
__DRIbuffer *pending_buffer;
struct wl_callback *frame_callback;
struct wl_callback *pending_buffer_callback;
int format;
#endif

View file

@ -145,6 +145,7 @@ dri2_create_surface(_EGLDriver *drv, _EGLDisplay *disp, EGLint type,
dri2_surf->pending_buffer = NULL;
dri2_surf->third_buffer = NULL;
dri2_surf->frame_callback = NULL;
dri2_surf->pending_buffer_callback = NULL;
if (conf->AlphaSize == 0)
dri2_surf->format = WL_DRM_FORMAT_XRGB8888;
@ -232,6 +233,9 @@ dri2_destroy_surface(_EGLDriver *drv, _EGLDisplay *disp, _EGLSurface *surf)
if (dri2_surf->frame_callback)
wl_callback_destroy(dri2_surf->frame_callback);
if (dri2_surf->pending_buffer_callback)
wl_callback_destroy(dri2_surf->pending_buffer_callback);
if (dri2_surf->base.Type == EGL_WINDOW_BIT) {
dri2_surf->wl_win->private = NULL;
@ -299,6 +303,7 @@ dri2_release_pending_buffer(void *data,
dri2_surf->pending_buffer = NULL;
wl_callback_destroy(callback);
dri2_surf->pending_buffer_callback = NULL;
}
static const struct wl_callback_listener release_buffer_listener = {
@ -331,6 +336,7 @@ dri2_release_buffers(struct dri2_egl_surface *dri2_surf)
&release_buffer_listener, dri2_surf);
wl_proxy_set_queue((struct wl_proxy *) callback,
dri2_dpy->wl_queue);
dri2_surf->pending_buffer_callback = callback;
break;
default:
dri2_dpy->dri2->releaseBuffer(dri2_dpy->dri_screen,