input/keyboard: defer wlr_keyboard_group destroy

This defers the destruction of wlr_keyboard_groups until idle. This is
to prevent the keyboard group's keyboard from being destroyed in the
middle of handling a keyboard event. This would occur when changing the
keymap of the last keyboard in a group with a keyboard binding. The
prevents crashing when attempting to update the xkb state of the
keyboard group's keyboard. The sway_keyboard_group is still immediately
destroyed so that the group is no longer used
This commit is contained in:
Brian Ashworth 2019-12-13 00:06:48 -05:00 committed by Simon Ser
parent f365ffef34
commit f9ce8749dc

View file

@ -659,6 +659,10 @@ static bool keymaps_match(struct xkb_keymap *km1, struct xkb_keymap *km2) {
return result; return result;
} }
static void destroy_empty_wlr_keyboard_group(void *data) {
wlr_keyboard_group_destroy(data);
}
static void sway_keyboard_group_remove(struct sway_keyboard *keyboard) { static void sway_keyboard_group_remove(struct sway_keyboard *keyboard) {
struct sway_input_device *device = keyboard->seat_device->input_device; struct sway_input_device *device = keyboard->seat_device->input_device;
struct wlr_keyboard *wlr_keyboard = device->wlr_device->keyboard; struct wlr_keyboard *wlr_keyboard = device->wlr_device->keyboard;
@ -681,7 +685,11 @@ static void sway_keyboard_group_remove(struct sway_keyboard *keyboard) {
free(sway_group->seat_device->input_device); free(sway_group->seat_device->input_device);
free(sway_group->seat_device); free(sway_group->seat_device);
free(sway_group); free(sway_group);
wlr_keyboard_group_destroy(wlr_group);
// To prevent use-after-free conditions when handling key events, defer
// freeing the wlr_keyboard_group until idle
wl_event_loop_add_idle(server.wl_event_loop,
destroy_empty_wlr_keyboard_group, wlr_group);
} }
} }