diff options
| author | Furkan Sahin <furkan-dev@proton.me> | 2021-10-19 07:54:36 +0200 |
|---|---|---|
| committer | Furkan Sahin <furkan-dev@proton.me> | 2021-10-19 07:54:36 +0200 |
| commit | d6621578eac5345ff54a74ef2ab8df2bc2f5c5a7 (patch) | |
| tree | bcba147546c8c139c5d2ad8fccc771a0a1c82f35 | |
| parent | 2500095d37e2b2cb7d615ec5335e1d1049fbe6f7 (diff) | |
container: Fix crash when view unmaps + maps quickly
Followup on a3fdc2b4af.
If a view quickly maps and unmaps repeatedly, there will be multiple
destroyed containers with same view in a single transaction. Each of
these containers will then try to destroy this view, resulting in use
after free.
The container should only destroy the view if the view still belongs
to the container.
Simple reproducer: couple XMapWindow + XUnmapWindow in a loop followed
by XDestroyWindow.
See #6605
(cherry picked from commit f92329701b0983ec41fec29d3abc5c751cbe4a28)
| -rw-r--r-- | sway/tree/container.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/sway/tree/container.c b/sway/tree/container.c index e5149fb6..79e04ec0 100644 --- a/sway/tree/container.c +++ b/sway/tree/container.c @@ -80,10 +80,8 @@ void container_destroy(struct sway_container *con) { wlr_texture_destroy(con->marks_urgent); wlr_texture_destroy(con->marks_focused_tab_title); - if (con->view) { - if (con->view->container == con) { - con->view->container = NULL; - } + if (con->view && con->view->container == con) { + con->view->container = NULL; if (con->view->destroying) { view_destroy(con->view); } |