wl_seat::get_* requests are racy
Submitted by Daniel Stone @daniels
Assigned to Daniel Stone @daniels
Description
The get_pointer, get_keyboard and get_touch methods of wl_seat contain a fundamental race:
- client binds to wl_seat
- compositor sends wl_seat::capabilities(KEYBOARD)
- keyboard is unplugged, compositor destroys seat->keyboard
- client calls wl_seat::get_keyboard()
- oops ...
Instead of having the advertise/get methods, we should instead just send the objects directly to the clients with a new_id event, and let the clients destroy them if they don't want them. This would also require a destroy request from the client.