1. 21 Dec, 2010 32 commits
  2. 20 Dec, 2010 1 commit
  3. 18 Dec, 2010 1 commit
  4. 17 Dec, 2010 3 commits
    • Colin Walters's avatar
      gdkwindow: Fix event unref iteration · d08ff485
      Colin Walters authored
      We were double looping previously which caused a NULL deref.
      d08ff485
    • Colin Walters's avatar
      gdk: Fix GdkWindowFilter internal refcounting · 806c0441
      Colin Walters authored
      Running gnome-shell under valgrind, I saw the attached invalid write.
      Basically we can destroy a window during event processing, and the old
      window_remove_filters simply called g_free() on the filter, ignoring
      the refcount.  Then later in event processing we call filter->refcount--,
      which is writing to free()d memory.
      
      Fix this by centralizing list mutation and refcount handling inside
      a new shared _gdk_window_filter_unref() function, and using that
      everywhere.
      
      ==13876== Invalid write of size 4
      ==13876==    at 0x446B181: gdk_event_apply_filters (gdkeventsource.c:86)
      ==13876==    by 0x446B411: _gdk_events_queue (gdkeventsource.c:188)
      ==13876==    by 0x44437EF: gdk_display_get_event (gdkdisplay.c:410)
      ==13876==    by 0x446B009: gdk_event_source_dispatch (gdkeventsource.c:317)
      ==13876==    by 0x4AB7159: g_main_context_dispatch (gmain.c:2436)
      ==13876==    by 0x4AB7957: g_main_context_iterate.clone.5 (gmain.c:3087)
      ==13876==    by 0x4AB806A: g_main_loop_run (gmain.c:3295)
      ==13876==    by 0x8084D6B: main (main.c:722)
      ==13876==  Address 0x1658bcac is 12 bytes inside a block of size 16 free'd
      ==13876==    at 0x4005EAD: free (vg_replace_malloc.c:366)
      ==13876==    by 0x4ABE515: g_free (gmem.c:263)
      ==13876==    by 0x444BCC9: window_remove_filters (gdkwindow.c:1873)
      ==13876==    by 0x4454BA3: _gdk_window_destroy_hierarchy (gdkwindow.c:2043)
      ==13876==    by 0x447BF6E: gdk_window_destroy_notify (gdkwindow-x11.c:1115)
      ==13876==    by 0x43588E2: _gtk_socket_windowing_filter_func (gtksocket-x11.c:518)
      ==13876==    by 0x446B170: gdk_event_apply_filters (gdkeventsource.c:79)
      ==13876==    by 0x446B411: _gdk_events_queue (gdkeventsource.c:188)
      ==13876==    by 0x44437EF: gdk_display_get_event (gdkdisplay.c:410)
      ==13876==    by 0x446B009: gdk_event_source_dispatch (gdkeventsource.c:317)
      ==13876==    by 0x4AB7159: g_main_context_dispatch (gmain.c:2436)
      ==13876==    by 0x4AB7957: g_main_context_iterate.clone.5 (gmain.c:3087)
      
      https://bugzilla.gnome.org/show_bug.cgi?id=637464
      806c0441
    • Carlos Garnacho's avatar
      Remove *_set_extension_events() and old API to query devices. · 2c8c1c6d
      Carlos Garnacho authored
      The old functions to get core pointer and devices list are gone as
      well. This slice is entirely replaced internally by multidevice
      handling and may just go.
      2c8c1c6d
  5. 15 Dec, 2010 3 commits