1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
http://bugzilla.openedhand.com/show_bug.cgi?id=1432
diff --git a/matchbox/core/mb-wm-client.c b/matchbox/core/mb-wm-client.c
index 0791060..f6d949d 100644
--- a/matchbox/core/mb-wm-client.c
+++ b/matchbox/core/mb-wm-client.c
@@ -55,9 +58,11 @@ mb_wm_client_destroy (MBWMObject *obj)
client->sig_prop_change_id = 0;
- if (client->ping_cb_id)
- mb_wm_main_context_timeout_handler_remove (wm->main_ctx,
- client->ping_cb_id);
+ /* Must call mb_wm_client_ping_stop rather than
+ * mb_wm_main_context_timeout_handler_remove() to prevent a race condition
+ * segfault in the timeout list manipulation
+ */
+ mb_wm_client_ping_stop (client);
#if ENABLE_COMPOSITE
if (mb_wm_compositing_enabled (wm))
diff --git a/matchbox/core/mb-wm-main-context.c b/matchbox/core/mb-wm-main-context.c
index f74d249..a206a2e 100644
--- a/matchbox/core/mb-wm-main-context.c
+++ b/matchbox/core/mb-wm-main-context.c
@@ -822,7 +822,7 @@ mb_wm_main_context_handle_timeout (MBWMTimeOutEventInfo *tinfo,
static Bool
mb_wm_main_context_check_timeouts (MBWMMainContext *ctx)
{
- MBWMList * l = ctx->event_funcs.timeout;
+ MBWMList * l = mb_wm_util_list_get_first(ctx->event_funcs.timeout);
struct timeval current_time;
if (!l)
@@ -833,29 +833,18 @@ mb_wm_main_context_check_timeouts (MBWMMainContext *ctx)
while (l)
{
MBWMTimeOutEventInfo * tinfo = l->data;
+ unsigned long tid = tinfo->id;
if (!mb_wm_main_context_handle_timeout (tinfo, ¤t_time))
- {
- MBWMList * prev = l->prev;
- MBWMList * next = l->next;
-
- if (prev)
- prev->next = next;
- else
- ctx->event_funcs.timeout = next;
-
- if (next)
- next->prev = prev;
-
- free (tinfo);
- free (l);
-
- l = next;
- }
+ {
+ /* Timeout handler notified it can be removed, do so now */
+ mb_wm_main_context_timeout_handler_remove (ctx,tid);
+ /* To avoid race condition, restart at front of list */
+ l = mb_wm_util_list_get_first(ctx->event_funcs.timeout);
+ }
else
- l = l->next;
+ l = mb_wm_util_list_next(l);
}
-
return True;
}
#endif /* !USE_GLIB_MAINLOOP */
@@ -904,25 +893,14 @@ mb_wm_main_context_timeout_handler_remove (MBWMMainContext *ctx,
MBWMTimeOutEventInfo * info = l->data;
if (info->id == id)
- {
- MBWMList * prev = l->prev;
- MBWMList * next = l->next;
-
- if (prev)
- prev->next = next;
- else
- ctx->event_funcs.timeout = next;
-
- if (next)
- next->prev = prev;
-
- free (info);
- free (l);
-
- return;
- }
-
- l = l->next;
+ {
+ /* Reset list head after entry removal */
+ ctx->event_funcs.timeout =
+ mb_wm_util_list_remove(ctx->event_funcs.timeout, l->data);
+ return;
+ }
+
+ l = mb_wm_util_list_next(l);
}
#else
g_source_remove (id);
|
