diff options
author | Hermet Park <hermetpark@gmail.com> | 2019-07-26 16:49:45 +0900 |
---|---|---|
committer | Hermet Park <hermetpark@gmail.com> | 2019-07-26 16:54:31 +0900 |
commit | 24a49c893886d4fa8cd81f727c465f717c3a0629 (patch) | |
tree | 447a4dbd2fd8115ffda114ae395ca33c8a14ddb7 | |
parent | e40f666807ea4dfd19dfd37b96c8da5a56c7a62e (diff) | |
download | efl-24a49c893886d4fa8cd81f727c465f717c3a0629.tar.gz |
ecore_evas: prevent double free evas.
When user manually free the ecore evas,
it could delete evas internally,
then evas_invalidate would be triggered,
invalidate callback would try free evas again,
this causes double free evas.
TEST SCENARIO:
ee = ecore_evas_new(...);
...
ecore_evas_free(ee);
-> free evas
-> invalidated cb
-> free evas (**double free)
This is a regression bug by 5847886a3fdb7c470bd55e215b822bbbaf109080
-rw-r--r-- | src/lib/ecore_evas/ecore_evas.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/lib/ecore_evas/ecore_evas.c b/src/lib/ecore_evas/ecore_evas.c index 672b7c4072..18c251f007 100644 --- a/src/lib/ecore_evas/ecore_evas.c +++ b/src/lib/ecore_evas/ecore_evas.c @@ -3502,7 +3502,11 @@ _ecore_evas_free(Ecore_Evas *ee) ee->prop.wm_rot.manual_mode.timer = NULL; eina_hash_free(ee->prop.cursors); ee->prop.cursors = NULL; - if (!ee->evas_dying) evas_free(ee->evas); + if (!ee->evas_dying) + { + ee->evas_dying = EINA_TRUE; + evas_free(ee->evas); + } ee->evas = NULL; ECORE_MAGIC_SET(ee, ECORE_MAGIC_NONE); ee->driver = NULL; @@ -5276,6 +5280,7 @@ static void _ecore_evas_event_del(void *data, const Efl_Event *ev EINA_UNUSED) { Ecore_Evas *ee = data; + if (ee->evas_dying) return; ee->evas_dying = EINA_TRUE; ecore_evas_free(ee); |