sway

commit 4e4898e90f4d9b721091137a744deac335e73f12
parent c43374cdf043e913b48d3cdb31d0f716a2cf58bd
Author: Ryan Dwyer <ryandwyer1@gmail.com>
Date:   Wed, 26 Sep 2018 21:28:16 +1000

Fix race condition crash when view unmaps + maps quickly

When a view unmaps, we start a transaction to destroy the container,
then when the transaction completes we destroy the container and unset
the view's container pointer. But if the view has remapped in the
meantime, the view's container pointer will be pointing to a different
container which should not be cleared.

This adds a check to make sure the view is still pointing to the
container being destroyed before clearing the pointer. The freeing of
the title format is also removed as it is already freed when the view
destroys in view_destroy.

Diffstat:
M
sway/tree/container.c
 | 
10
++++------

1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/sway/tree/container.c b/sway/tree/container.c
@@ -67,12 +67,10 @@ void container_destroy(struct sway_container *con) {
 	list_free(con->outputs);
 
 	if (con->view) {
-		struct sway_view *view = con->view;
-		view->container = NULL;
-		free(view->title_format);
-		view->title_format = NULL;
-
-		if (view->destroying) {
+		if (con->view->container == con) {
+			con->view->container = NULL;
+		}
+		if (con->view->destroying) {
 			view_destroy(con->view);
 		}
 	}