client: Gracefully handle shutdown and window hiding

When a window is hidden or destroyed, the render thread may already
be rendering. We need to properly read-lock the surface pointer
when it is in use and exit when it becomes null.

Note that there is also a potential crash in the Mesa GL driver
where it keeps a proxy to the wl_surface, so if we delete this
while we are still rendering, it can crash inside the driver.
This is not addressed by this patch, and has not been reproduced
on any other drivers so far.

[ChangeLog][Client] Fixed a crash that could happen when hiding
or closing windows while Qt Quick was actively rendering on
a different thread.

Fixes: QTBUG-91264
Fixes: QTBUG-90037
Task-number: QTBUG-92249
Change-Id: I029b123b83c58740321e8b90a463ced748d8bcf4
Reviewed-by: Laszlo Agocs <laszlo.agocs@qt.io>
Reviewed-by: David Edmundson <davidedmundson@kde.org>
(cherry picked from commit b19b0fbaf775e8b8eda1e03c265a5393d618c6c0)
Reviewed-by: Liang Qi <liang.qi@qt.io>

3 files changed, 19 insertions, 4 deletions

diff --git a/src/client/qwaylandwindow.cpp b/src/client/qwaylandwindow.cpp
index d32b4fce..06303de3 100644
--- a/src/client/qwaylandwindow.cpp
+++ b/src/client/qwaylandwindow.cpp
@@ -416,6 +416,7 @@ void QWaylandWindow::closePopups(QWaylandWindow *parent)
 
 QPlatformScreen *QWaylandWindow::calculateScreenFromSurfaceEvents() const
 {
+    QReadLocker lock(&mSurfaceLock);
     if (mSurface) {
         if (auto *screen = mSurface->oldestEnteredScreen())
             return screen;
@@ -469,6 +470,7 @@ void QWaylandWindow::setMask(const QRegion &mask)
 
     mMask = mask;
 
+    QReadLocker locker(&mSurfaceLock);
     if (!mSurface)
         return;
 
@@ -555,6 +557,10 @@ void QWaylandWindow::sendRecursiveExposeEvent()
 void QWaylandWindow::attach(QWaylandBuffer *buffer, int x, int y)
 {
     Q_ASSERT(!buffer->committed());
+    QReadLocker locker(&mSurfaceLock);
+    if (mSurface == nullptr)
+        return;
+
     if (buffer) {
         handleUpdate();
         buffer->setBusy();
@@ -573,6 +579,10 @@ void QWaylandWindow::attachOffset(QWaylandBuffer *buffer)
 
 void QWaylandWindow::damage(const QRect &rect)
 {
+    QReadLocker locker(&mSurfaceLock);
+    if (mSurface == nullptr)
+        return;
+
     mSurface->damage(rect.x(), rect.y(), rect.width(), rect.height());
 }
 
@@ -603,6 +613,8 @@ void QWaylandWindow::commit(QWaylandBuffer *buffer, const QRegion &damage)
         qCDebug(lcWaylandBackingstore) << "Buffer already committed, ignoring.";
         return;
     }
+
+    QReadLocker locker(&mSurfaceLock);
     if (!mSurface)
         return;
 
@@ -616,7 +628,9 @@ void QWaylandWindow::commit(QWaylandBuffer *buffer, const QRegion &damage)
 
 void QWaylandWindow::commit()
 {
-    mSurface->commit();
+    QReadLocker locker(&mSurfaceLock);
+    if (mSurface != nullptr)
+        mSurface->commit();
 }
 
 const wl_callback_listener QWaylandWindow::callbackListener = {
@@ -707,6 +721,7 @@ QPointF QWaylandWindow::mapFromWlSurface(const QPointF &surfacePosition) const
 
 wl_surface *QWaylandWindow::wlSurface()
 {
+    QReadLocker locker(&mSurfaceLock);
     return mSurface ? mSurface->object() : nullptr;
 }
 
@@ -731,7 +746,8 @@ QWaylandScreen *QWaylandWindow::waylandScreen() const
 
 void QWaylandWindow::handleContentOrientationChange(Qt::ScreenOrientation orientation)
 {
-    if (mDisplay->compositorVersion() < 2)
+    QReadLocker locker(&mSurfaceLock);
+    if (mDisplay->compositorVersion() < 2 || mSurface == nullptr)
         return;
 
     wl_output_transform transform;
diff --git a/src/client/qwaylandwindow_p.h b/src/client/qwaylandwindow_p.h
index 1dbb6f99..45eefdbf 100644
--- a/src/client/qwaylandwindow_p.h
+++ b/src/client/qwaylandwindow_p.h
@@ -287,7 +287,7 @@ private:
 
     static QWaylandWindow *mMouseGrab;
 
-    QReadWriteLock mSurfaceLock;
+    mutable QReadWriteLock mSurfaceLock;
 
     friend class QWaylandSubSurface;
 };
diff --git a/src/hardwareintegration/client/wayland-egl/qwaylandglcontext.cpp b/src/hardwareintegration/client/wayland-egl/qwaylandglcontext.cpp
index 756eb3cd..5145d187 100644
--- a/src/hardwareintegration/client/wayland-egl/qwaylandglcontext.cpp
+++ b/src/hardwareintegration/client/wayland-egl/qwaylandglcontext.cpp
@@ -192,7 +192,6 @@ public:
     }
     void blit(QWaylandEglWindow *window)
     {
-        Q_ASSERT(window->wlSurface());
         QOpenGLTextureCache *cache = QOpenGLTextureCache::cacheForContext(m_context->context());
 
         QSize surfaceSize = window->surfaceSize();