NULL pointer dereference on commit for an xdg_surface with destroyed role_object
randfall's xdg_surface_commit_without_role_object
:
struct wl_surface *surface = wl_compositor_create_surface(rf_g_wl_compositor.global);
struct xdg_surface *xdg_surface = xdg_wm_base_get_xdg_surface(rf_g_xdg_wm_base.global, surface);
struct xdg_toplevel *xdg_toplevel = xdg_surface_get_toplevel(xdg_surface);
xdg_toplevel_destroy(xdg_toplevel);
wl_surface_commit(surface);
==357422==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f002ad5cddc bp 0x7ffe622cec30 sp 0x7ffe622ceaa0 T0)
==357422==The signal is caused by a READ memory access.
==357422==Hint: address points to the zero page.
#0 0x7f002ad5cddc in wl_resource_post_event (/lib64/libwayland-server.so.0+0x8ddc) (BuildId: 24125e1697bee5514c95cc823de5e1adbd8c96f2)
#1 0x7f0029b8d6ff in xdg_toplevel_send_configure protocol/xdg-shell-server-protocol.h:2024
#2 0x7f0029b91280 in weston_desktop_xdg_toplevel_send_configure ../libweston/desktop/xdg-shell.c:660
#3 0x7f0029b9578a in weston_desktop_xdg_surface_send_configure ../libweston/desktop/xdg-shell.c:1159
#4 0x7f002ad5da7b in wl_event_loop_dispatch_idle (/lib64/libwayland-server.so.0+0x9a7b) (BuildId: 24125e1697bee5514c95cc823de5e1adbd8c96f2)
#5 0x7f002ad5dcf3 in wl_event_loop_dispatch (/lib64/libwayland-server.so.0+0x9cf3) (BuildId: 24125e1697bee5514c95cc823de5e1adbd8c96f2)
#6 0x7f002ad5fcf4 in wl_display_run (/lib64/libwayland-server.so.0+0xbcf4) (BuildId: 24125e1697bee5514c95cc823de5e1adbd8c96f2)
#7 0x7f002a55e253 in wet_main ../frontend/main.c:4779
#8 0x40116a in main ../frontend/executable.c:33
#9 0x7f002a30d087 in __libc_start_call_main (/lib64/libc.so.6+0x2a087) (BuildId: 77c77fee058b19c6f001cf2cb0371ce3b8341211)
#10 0x7f002a30d14a in __libc_start_main_alias_1 (/lib64/libc.so.6+0x2a14a) (BuildId: 77c77fee058b19c6f001cf2cb0371ce3b8341211)
#11 0x401084 in _start (/home/kira/opt/gfx/weston/build/frontend/weston+0x401084) (BuildId: 65ecbbce5e44577cdbcefb0d7294eaeb335ce219)
(commit 80e47a71)
Instead, I'd expect xdg_surface.error.not_constructed
to be sent.