Re: [gtk-vnc-devel] crash on disconnect

["Daniel P. Berrange" <berrange redhat com>]

On Tue, Apr 15, 2008 at 10:11:44AM -0300, Jonh Wendell wrote:
> Em Ter, 2008-04-15 às 03:55 +0100, Daniel P. Berrange escreveu:
> > 
> > Ahhhhh, I see what is going on.
> > 
> >  - You destroy the container
> >  - This calls vnc_display_destroy()
> >  - Which calls vnc_display_close()
> >  - Which requests that the co-routine shuts down asynchronously
> > 
> > So the vnc_display object still exists at this point, and will continue
> > to exist until the co-routine actually exits  and releases the last
> > reference.
> > 
> > Unfortunately....
> > 
> > ....just after asking the coroutine todo async shutdown, vnc_display_close()
> > goes ahead and free's the XImage / OpenGL texture.
> > 
> > But if the co-routine is in middle of an update it may well try to memcpy()
> > data into the image we just free'd before checking its shutdown flag...
> > 
> > ... kaboom !
> > 
> > 
> > Basically, the code in vnc_display_close()  that free's the image / texture
> > needs to be changed so that it is only run after the coroutine has actually
> > exited.
> > 
> > Dan.
> 
> Thanks Dan!
> 
> In this patch, I just moved the free() calls in vnc_close() to
> vnc_delayed_unref(). It has fixed the crash to me.

That seems to be a reasonabl place to put it - I was going to suggest the
bottom of the vnc_coroutine() method, but this is effectively the same.

Dan.
-- 
|: Red Hat, Engineering, Boston   -o-   http://people.redhat.com/berrange/ :|
|: http://libvirt.org  -o-  http://virt-manager.org  -o-  http://ovirt.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: GnuPG: 7D3B9505  -o-  F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 :|