Hello,

I found a bug and fixed it with the patch :)

*to reproduce:*
run compositor on top of x11

repeat
   run flower
   drag & drop it a little
   move the pointer in and out of the compositor/flower
   Ctrl+C the flower client

it would break eventually

*problem:*
I found that the linked list surface->destroy_listener_list got corrupted at
some point (it was not circular any more, strange next/prev etc), which
causes the crash.

*solution:*
The problem was in wl_list_remove -- when you erase an element, you don't
mark it as 'erased', by setting prev/next to NULL for example. Then if you
erase it again the list becomes corrupt. I nullified the prev/next and check
in the begining of wl_list_remove for not-in-list elements and just ignore
them. That seems to fix it.

Regards,
Iskren
From 15de592a8adb3007f813a278f00ddf4727f757f3 Mon Sep 17 00:00:00 2001
From: Iskren Chernev <[email protected]>
Date: Sat, 12 Mar 2011 02:28:04 +0200
Subject: [PATCH] Fixed bug in wl_list.

---
 wayland/wayland-util.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/wayland/wayland-util.c b/wayland/wayland-util.c
index 3643274..fb60da2 100644
--- a/wayland/wayland-util.c
+++ b/wayland/wayland-util.c
@@ -44,8 +44,14 @@ wl_list_insert(struct wl_list *list, struct wl_list *elm)
 WL_EXPORT void
 wl_list_remove(struct wl_list *elm)
 {
+	if (elm->prev == NULL)
+		// element not in list
+		return;
+
 	elm->prev->next = elm->next;
 	elm->next->prev = elm->prev;
+
+	elm->prev = elm->next = NULL;
 }
 
 WL_EXPORT int
-- 
1.7.4

_______________________________________________
wayland-devel mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/wayland-devel

Reply via email to