xwayland: unredirect sub-windows when root destroyed

This ensures that we unredirect root sub-windows when the root window is
being destroyed. We need to do this explicitly rather than rely on the
the CompositeClientSubwindows resource being freed automatically because
that may not happen until after the root window has already been freed
resulting in uninitialized memory access.

4 files changed, 31 insertions, 0 deletions

diff --git a/composite/compalloc.c b/composite/compalloc.c
index 2caf79eb0..e5b279b16 100644
--- a/composite/compalloc.c
+++ b/composite/compalloc.c
@@ -521,6 +521,11 @@ compUnredirectSubwindows (ClientPtr pClient, WindowPtr pWin, int update)
     return BadValue;
 }
 
+int CompositeUnRedirectSubwindows (WindowPtr pWin, int update)
+{
+    return compUnredirectSubwindows (serverClient, pWin, update);
+}
+
 /*
  * Add redirection information for one subwindow (during reparent)
  */
diff --git a/composite/compositeext.h b/composite/compositeext.h
index c1e915ae1..9c5330a39 100644
--- a/composite/compositeext.h
+++ b/composite/compositeext.h
@@ -36,5 +36,7 @@ extern _X_EXPORT Bool CompositeRegisterAlternateVisuals(ScreenPtr pScreen,
                                                         int nVisuals);
 extern _X_EXPORT int CompositeRedirectSubwindows(WindowPtr pWin,
 						 int update);
+extern _X_EXPORT int CompositeUnRedirectSubwindows (WindowPtr pWin,
+						    int update);
 
 #endif /* _COMPOSITEEXT_H_ */
diff --git a/hw/xfree86/xwayland/xwayland-private.h b/hw/xfree86/xwayland/xwayland-private.h
index e337b7a25..47cdd6347 100644
--- a/hw/xfree86/xwayland/xwayland-private.h
+++ b/hw/xfree86/xwayland/xwayland-private.h
@@ -66,6 +66,7 @@ struct xwl_screen {
     int32_t			 root_x, root_y;
 
     CreateWindowProcPtr		 CreateWindow;
+    DestroyWindowProcPtr	 DestroyWindow;
     RealizeWindowProcPtr	 RealizeWindow;
     UnrealizeWindowProcPtr	 UnrealizeWindow;
     SetWindowPixmapProcPtr	 SetWindowPixmap;
diff --git a/hw/xfree86/xwayland/xwayland-window.c b/hw/xfree86/xwayland/xwayland-window.c
index c2d31cbd7..fcda2f2f8 100644
--- a/hw/xfree86/xwayland/xwayland-window.c
+++ b/hw/xfree86/xwayland/xwayland-window.c
@@ -125,6 +125,26 @@ xwl_create_window(WindowPtr window)
     return ret;
 }
 
+static int
+xwl_destroy_window (WindowPtr window)
+{
+    ScreenPtr screen = window->drawable.pScreen;
+    struct xwl_screen *xwl_screen;
+    Bool ret;
+
+    if (window->parent == NULL)
+	CompositeUnRedirectSubwindows (window, CompositeRedirectManual);
+
+    xwl_screen = xwl_screen_get(screen);
+
+    screen->DestroyWindow = xwl_screen->DestroyWindow;
+    ret = (*screen->DestroyWindow)(window);
+    xwl_screen->DestroyWindow = screen->DestroyWindow;
+    screen->DestroyWindow = xwl_destroy_window;
+
+    return ret;
+}
+
 static void
 damage_report(DamagePtr pDamage, RegionPtr pRegion, void *data)
 {
@@ -287,6 +307,9 @@ xwl_screen_init_window(struct xwl_screen *xwl_screen, ScreenPtr screen)
     xwl_screen->CreateWindow = screen->CreateWindow;
     screen->CreateWindow = xwl_create_window;
 
+    xwl_screen->DestroyWindow = screen->DestroyWindow;
+    screen->DestroyWindow = xwl_destroy_window;
+
     xwl_screen->RealizeWindow = screen->RealizeWindow;
     screen->RealizeWindow = xwl_realize_window;