-
Bug
-
Resolution: Incomplete
-
P3: Somewhat important
-
None
-
5.15.17
-
None
-
Linux Embedded
ituation: In our Wayland Compositor based on QtWaylandCompositor, we have for example a taskbar with an entry for each open window. This taskbar is hidden when a window is shown in fullscreen.
Whe a window is closed by the application, this is completely asynchonous to the copositor. When the slot onSurfaceDestroyed is called and our cleanup code is run, e.g. to find and remove that taskbar entry or to see if the windows disappeared was fullscreen and we need to show the taskbar again, we got a use after free situation: Especially the XdgShell is already deleted before "onSufraceDestroey" is called this leads to a use after free when calling fullscreen() for that surface, as "fullscreen()" is implemented by the XdgShell:
QWaylandCompositorExtension::extensionContainer() const 0x00007ffff7ea3ca8
::imdi::ImdiSurface::waylandSurface ImdiSurface.cpp:312
::imdi::ImdiSurface::waylandClient ImdiSurface.cpp:318
::imdi::ImdiSurface::getOtherItemsForClient ImdiSurface.cpp:421
::imdi::ImdiSurface::lockAllClientItems ImdiSurface.cpp:408
::imdi::ImdiSurface::removeDialogPresentation ImdiSurface.cpp:386
::imdi::ImdiSurface::onSurfaceDestroyed ImdiSurface.cpp:297
::imdi::QxApplication::notify QxApplication.cpp:22
main main.cpp:106
QWaylandSurface* ImdiSurface::waylandSurface()
{ return qobject_cast<QWaylandSurface*>(shellSurface()->extensionContainer());
}
We see similar issues when several windows disapear at onece, e.g. client with many windows open is terminated. We had a piece of code iterating over all other windows if a window is closed (triggered by onSurfaceDestroyed), but if all windows of a client close at once, we saw use after free when accessing certain properties / methods of the other windows, expecially using extension like XdgShell.
How is this supposed to be done correctly?