From f6ee7a032632c36e3d98b5af96de0a211e42236b Mon Sep 17 00:00:00 2001 From: Alex Wu Date: Wed, 1 Aug 2012 21:57:06 +0800 Subject: [PATCH] evas/elementary: Fix hoversel test segfault on wayland engine Bug report at http://trac.enlightenment.org/e/ticket/1235 The hoversel widget has a hover object internally to prompt item list. Once user click at the prompted area, the hover will dispear. Internally, the function stack like this: _on_hover_clicked()--> elm_hoversel_hover_end()-->evas_object_del(sd->hover). After this calling, hover object is marked as "to be deleted". i.e. obj->delete_me=1. In the next evas_render_updates_internal(), it will be freed. For wayland engine, there is an additional clipping operation to make the render_objects clipped into the viewport (See phase 4.5 in evas_render_updates_internal()). The problem is that the hover object marked as "to be deleted" will be clipped into e->framespace.clip by evas_object_clip_set(obj, e->framespace.clip) and then freed. So that the e->framespace.clip hold a wild pointer. At next evas_object_change(e->framespace.clip), Segmentation fault occur. I think this problem is not specific to hoversel. This patch add a check for obj->delete_me to avoid clipping a object which will be freed. --- trunk/evas/src/lib/canvas/evas_render.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/trunk/evas/src/lib/canvas/evas_render.c b/trunk/evas/src/lib/canvas/evas_render.c index 1db3d21..0a1f938 100644 --- a/trunk/evas/src/lib/canvas/evas_render.c +++ b/trunk/evas/src/lib/canvas/evas_render.c @@ -1412,6 +1412,8 @@ evas_render_updates_internal(Evas *e, if (evas_object_is_frame_object_get(obj)) continue; + if (obj->delete_me) continue; + EINA_RECTANGLE_SET(&obj_rect, obj->cur.geometry.x, obj->cur.geometry.y, obj->cur.geometry.w, obj->cur.geometry.h); -- 1.7.9.5