From 50c2ed1b9d9e9176acb6225ebd82a3373fe22817 Mon Sep 17 00:00:00 2001
From: Paul Olav Tvete <paul.tvete@qt.io>
Date: Tue, 4 Oct 2016 16:45:15 +0200
Subject: [PATCH] Fix race condition on mFrameCallback

Don't try to destroy the callback from two different threads. This
caused a crash with brcm-egl.

Change-Id: Idcb18fca9ed7f84902b88212c0cebd67932a59d3
Reviewed-by: Johan Helsing <johan.helsing@qt.io>
---
 src/plugins/platforms/wayland/qwaylandwindow.cpp | 14 ++++++--------
 src/plugins/platforms/wayland/qwaylandwindow_p.h |  3 ++-
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/src/plugins/platforms/wayland/qwaylandwindow.cpp b/src/plugins/platforms/wayland/qwaylandwindow.cpp
index e8f3ceb4fa0..59c446bb300 100644
--- a/src/plugins/platforms/wayland/qwaylandwindow.cpp
+++ b/src/plugins/platforms/wayland/qwaylandwindow.cpp
@@ -83,7 +83,7 @@ QWaylandWindow::QWaylandWindow(QWindow *window)
     , mMousePressedInContentArea(Qt::NoButton)
     , m_cursor(Qt::ArrowCursor)
     , mWaitingForFrameSync(false)
-    , mFrameCallback(0)
+    , mFrameCallback(nullptr)
     , mRequestResizeSent(false)
     , mCanResize(true)
     , mResizeDirty(false)
@@ -453,14 +453,12 @@ void QWaylandWindow::requestResize()
 
 void QWaylandWindow::attach(QWaylandBuffer *buffer, int x, int y)
 {
-    if (mFrameCallback) {
-        wl_callback_destroy(mFrameCallback);
-        mFrameCallback = 0;
-    }
+    mFrameCallback = nullptr;
 
     if (buffer) {
-        mFrameCallback = frame();
-        wl_callback_add_listener(mFrameCallback, &QWaylandWindow::callbackListener, this);
+        auto callback = frame();
+        wl_callback_add_listener(callback, &QWaylandWindow::callbackListener, this);
+        mFrameCallback = callback;
         mWaitingForFrameSync = true;
 
         attach(buffer->buffer(), x, y);
@@ -491,7 +489,7 @@ void QWaylandWindow::frameCallback(void *data, struct wl_callback *callback, uin
 
     self->mWaitingForFrameSync = false;
     wl_callback_destroy(callback);
-    self->mFrameCallback = 0;
+    self->mFrameCallback.testAndSetRelaxed(callback, nullptr);
     if (self->mUpdateRequested) {
         QWindowPrivate *w = QWindowPrivate::get(self->window());
         self->mUpdateRequested = false;
diff --git a/src/plugins/platforms/wayland/qwaylandwindow_p.h b/src/plugins/platforms/wayland/qwaylandwindow_p.h
index 03c4a1e484f..e0c42ace53d 100644
--- a/src/plugins/platforms/wayland/qwaylandwindow_p.h
+++ b/src/plugins/platforms/wayland/qwaylandwindow_p.h
@@ -53,6 +53,7 @@
 
 #include <QtCore/QWaitCondition>
 #include <QtCore/QMutex>
+#include <QtCore/QAtomicPointer>
 #include <QtGui/QIcon>
 #include <QtCore/QVariant>
 
@@ -220,7 +221,7 @@ protected:
 
     WId mWindowId;
     bool mWaitingForFrameSync;
-    struct wl_callback *mFrameCallback;
+    QAtomicPointer<struct wl_callback> mFrameCallback;
     QWaitCondition mFrameSyncWait;
 
     QMutex mResizeLock;