1berry/qtbase
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

client: Set queued buffer busy

Browse Source 
From the outside it doesn't matter if the buffer was really committed
or queued, it still in use. If it is not marked  busy QWaylandShmBackingStore
will delete when it is resized which can happen when the surface changes
screens or receives a new fractional scale resulting in a use after free
producing a crash or protocol error.

Pick-to: 6.6
Change-Id: I8abc4edbd8990af5114aa0b36c8ecedb37a4f0f6
Reviewed-by: David Edmundson <davidedmundson@kde.org>
Reviewed-by: Kai Uwe Broulik <kde@privat.broulik.de>
This commit is contained in:
David Redondo 2023-08-02 16:43:29 +02:00
parent 369a5296a9
commit 816f41c00d
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/plugins/platforms/wayland/qwaylandbuffer_p.h
View File

@ -37,7 +37,7 @@ public:
virtual QSize size() const = 0; virtual QSize size() const = 0;
virtual int scale() const { return 1; } virtual int scale() const { return 1; }
void setBusy() { mBusy = true; } void setBusy(bool busy) { mBusy = busy; }
bool busy() const { return mBusy; } bool busy() const { return mBusy; }
void setCommitted() { mCommitted = true; } void setCommitted() { mCommitted = true; }

6
src/plugins/platforms/wayland/qwaylandwindow.cpp
View File

@ -681,7 +681,7 @@ void QWaylandWindow::attach(QWaylandBuffer *buffer, int x, int y)
if (buffer) { if (buffer) {
Q_ASSERT(!buffer->committed()); Q_ASSERT(!buffer->committed());
handleUpdate(); handleUpdate();
buffer->setBusy(); buffer->setBusy(true);
mSurface->attach(buffer->buffer(), x, y); mSurface->attach(buffer->buffer(), x, y);
} else { } else {
@ -713,7 +713,11 @@ void QWaylandWindow::safeCommit(QWaylandBuffer *buffer, const QRegion &damage)
if (isExposed()) { if (isExposed()) {
commit(buffer, damage); commit(buffer, damage);
} else { } else {
if (mQueuedBuffer) {
mQueuedBuffer->setBusy(false);
}
mQueuedBuffer = buffer; mQueuedBuffer = buffer;
mQueuedBuffer->setBusy(true);
mQueuedBufferDamage = damage; mQueuedBufferDamage = damage;
} }
} }