main: Use the output handler to destroy to black view

Use the specific output destroyer handler, instead of destroying it in
the handler itself. This way we can still clean-up and avoid any leaks,
and still not trip ourselves causing a use-after-free, when the output
is destroyed by libweston.

Bug-AGL: SPEC-3630, SPEC-3672

Signed-off-by: Marius Vlad <marius.vlad@collabora.com>
Reported-by: Walter Lozano <walter.lozano@collabora.com>
Change-Id: I11916245b85d2541286ee438284601b466dc20c2

diff --git a/src/main.c b/src/main.c
index e85d788..8492f54 100644 (file)
--- a/src/main.c
+++ b/src/main.c
@@ -74,6 +74,11 @@ handle_output_destroy(struct wl_listener *listener, void *data)
        output = wl_container_of(listener, output, output_destroy);
        assert(output->output == data);
 
+       if (output->fullscreen_view.fs->view) {
+               weston_surface_destroy(output->fullscreen_view.fs->view->surface);
+               output->fullscreen_view.fs->view = NULL;
+       }
+
        output->output = NULL;
        wl_list_remove(&output->output_destroy.link);
 }

diff --git a/src/shell.c b/src/shell.c
index e6fb332..40beef1 100644 (file)
--- a/src/shell.c
+++ b/src/shell.c
@@ -561,13 +561,8 @@ destroy_black_view(struct wl_listener *listener, void *data)
 
 
        if (fs && fs->fs) {
-               if (fs->fs->view && fs->fs->view->surface) {
-                       weston_surface_destroy(fs->fs->view->surface);
-                       fs->fs->view = NULL;
-               }
-
-               free(fs->fs);
                wl_list_remove(&fs->fs_destroy.link);
+               free(fs->fs);
        }
 }