hermet pushed a commit to branch master. http://git.enlightenment.org/core/efl.git/commit/?id=24a49c893886d4fa8cd81f727c465f717c3a0629
commit 24a49c893886d4fa8cd81f727c465f717c3a0629 Author: Hermet Park <[email protected]> Date: Fri Jul 26 16:49:45 2019 +0900 ecore_evas: prevent double free evas. When user manually free the ecore evas, it could delete evas internally, then evas_invalidate would be triggered, invalidate callback would try free evas again, this causes double free evas. TEST SCENARIO: ee = ecore_evas_new(...); ... ecore_evas_free(ee); -> free evas -> invalidated cb -> free evas (**double free) This is a regression bug by 5847886a3fdb7c470bd55e215b822bbbaf109080 --- src/lib/ecore_evas/ecore_evas.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/lib/ecore_evas/ecore_evas.c b/src/lib/ecore_evas/ecore_evas.c index 672b7c4072..18c251f007 100644 --- a/src/lib/ecore_evas/ecore_evas.c +++ b/src/lib/ecore_evas/ecore_evas.c @@ -3502,7 +3502,11 @@ _ecore_evas_free(Ecore_Evas *ee) ee->prop.wm_rot.manual_mode.timer = NULL; eina_hash_free(ee->prop.cursors); ee->prop.cursors = NULL; - if (!ee->evas_dying) evas_free(ee->evas); + if (!ee->evas_dying) + { + ee->evas_dying = EINA_TRUE; + evas_free(ee->evas); + } ee->evas = NULL; ECORE_MAGIC_SET(ee, ECORE_MAGIC_NONE); ee->driver = NULL; @@ -5276,6 +5280,7 @@ static void _ecore_evas_event_del(void *data, const Efl_Event *ev EINA_UNUSED) { Ecore_Evas *ee = data; + if (ee->evas_dying) return; ee->evas_dying = EINA_TRUE; ecore_evas_free(ee); --
