Evas filters: Fix crash with async sw rendering

If the filtered object (text or image object) was deleted, its
output image (cached inside the filter data) would be freed
immediately. This could cause crashes in case of async rendering.

@fix

2 files changed, 8 insertions, 1 deletions

diff --git a/src/lib/evas/canvas/evas_filter_mixin.c b/src/lib/evas/canvas/evas_filter_mixin.c
index 934a8c6fb9..154c6dc0f3 100644
--- a/src/lib/evas/canvas/evas_filter_mixin.c
+++ b/src/lib/evas/canvas/evas_filter_mixin.c
@@ -254,6 +254,7 @@ evas_filter_object_render(Eo *eo_obj, Evas_Object_Protected_Data *obj,
         fcow = FCOW_BEGIN(pd);
         fcow->output = filter_output;
         fcow->changed = EINA_FALSE;
+        fcow->async = do_async;
         if (!ok) fcow->invalid = EINA_TRUE;
         FCOW_END(fcow, pd);
 
@@ -518,7 +519,12 @@ _evas_filter_destructor(Eo *eo_obj, Evas_Filter_Data *pd)
    if (evas_object_filter_cow_default == pd->data) return;
 
    if (pd->data->output)
-     ENFN->image_free(ENDT, pd->data->output);
+     {
+        if (!pd->data->async)
+          ENFN->image_free(ENDT, pd->data->output);
+        else
+          evas_unref_queue_image_put(obj->layer->evas, pd->data->output);
+     }
    eina_hash_free(pd->data->sources);
    EINA_INLIST_FOREACH_SAFE(pd->data->data, il, db)
      {
diff --git a/src/lib/evas/include/evas_private.h b/src/lib/evas/include/evas_private.h
index 01b43401a5..730eae3f65 100644
--- a/src/lib/evas/include/evas_private.h
+++ b/src/lib/evas/include/evas_private.h
@@ -1194,6 +1194,7 @@ struct _Evas_Object_Filter_Data
    } state;
    Eina_Bool            changed : 1;
    Eina_Bool            invalid : 1; // Code parse failed
+   Eina_Bool            async : 1;
 };
 
 struct _Evas_Object_Func