primary selection: destroy devices before manager
Since device_destroy() calls wl_list_remove() on the device's link, the manager must still be valid. However if the manager is destroyed before the seat as the wl_display destroy handlers are called, devices listening for the seat to be destroyed will access free'd memory in wl_list_remove().
This commit is contained in:
		
							parent
							
								
									d3047011d0
								
							
						
					
					
						commit
						bf926e31a0
					
				|  | @ -452,6 +452,12 @@ static void primary_selection_device_manager_bind(struct wl_client *client, | |||
| static void handle_display_destroy(struct wl_listener *listener, void *data) { | ||||
| 	struct wlr_primary_selection_v1_device_manager *manager = | ||||
| 		wl_container_of(listener, manager, display_destroy); | ||||
| 
 | ||||
| 	struct wlr_primary_selection_v1_device *device, *tmp; | ||||
| 	wl_list_for_each_safe(device, tmp, &manager->devices, link) { | ||||
| 		device_destroy(device); | ||||
| 	} | ||||
| 
 | ||||
| 	wlr_signal_emit_safe(&manager->events.destroy, manager); | ||||
| 	wl_list_remove(&manager->display_destroy.link); | ||||
| 	wl_global_destroy(manager->global); | ||||
|  |  | |||
		Loading…
	
		Reference in New Issue