summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorHermet Park <hermetpark@gmail.com>2019-07-26 16:49:45 +0900
committerHermet Park <hermetpark@gmail.com>2019-07-26 16:54:31 +0900
commit24a49c893886d4fa8cd81f727c465f717c3a0629 (patch)
tree447a4dbd2fd8115ffda114ae395ca33c8a14ddb7
parente40f666807ea4dfd19dfd37b96c8da5a56c7a62e (diff)
downloadefl-24a49c893886d4fa8cd81f727c465f717c3a0629.tar.gz
ecore_evas: prevent double free evas.
When user manually free the ecore evas, it could delete evas internally, then evas_invalidate would be triggered, invalidate callback would try free evas again, this causes double free evas. TEST SCENARIO: ee = ecore_evas_new(...); ... ecore_evas_free(ee); -> free evas -> invalidated cb -> free evas (**double free) This is a regression bug by 5847886a3fdb7c470bd55e215b822bbbaf109080
-rw-r--r--src/lib/ecore_evas/ecore_evas.c7
1 files changed, 6 insertions, 1 deletions
diff --git a/src/lib/ecore_evas/ecore_evas.c b/src/lib/ecore_evas/ecore_evas.c
index 672b7c4072..18c251f007 100644
--- a/src/lib/ecore_evas/ecore_evas.c
+++ b/src/lib/ecore_evas/ecore_evas.c
@@ -3502,7 +3502,11 @@ _ecore_evas_free(Ecore_Evas *ee)
ee->prop.wm_rot.manual_mode.timer = NULL;
eina_hash_free(ee->prop.cursors);
ee->prop.cursors = NULL;
- if (!ee->evas_dying) evas_free(ee->evas);
+ if (!ee->evas_dying)
+ {
+ ee->evas_dying = EINA_TRUE;
+ evas_free(ee->evas);
+ }
ee->evas = NULL;
ECORE_MAGIC_SET(ee, ECORE_MAGIC_NONE);
ee->driver = NULL;
@@ -5276,6 +5280,7 @@ static void
_ecore_evas_event_del(void *data, const Efl_Event *ev EINA_UNUSED)
{
Ecore_Evas *ee = data;
+ if (ee->evas_dying) return;
ee->evas_dying = EINA_TRUE;
ecore_evas_free(ee);