client: Fix frame callback leak when window unexposed

If we get a new update while already waiting for a frame callback
and the window is unexposed, we would previously destroy the
callback and issue a new one. But if the window is unexposed, the
compositor may accumulate these and answer all the callbacks when
the window is shown again. This may cause overflows and the client
to be killed by the compositor in some cases where the number of
pending updates is too high.

To avoid this, we skip requesting new callbacks if there is already
one pending and the window is unexposed. When the window is
re-exposed, the existing pending callback will be triggered anyway,
and until then there is no need to repeatedly verify that we
still cannot render.

One risk is that there may be compositors which never issues a response
to the callbacks requested while the window was unexposed. But that
would probably be in conflict with the specification and possibly cause
other issues as well. The patch was tested with Weston and Mutter, and
seems to improve behavior in both of these at least.

[ChangeLog][Client] Fixed a bug where Wayland clients would continuously
request frame callbacks while unexposed, which potentially caused crashes
on some compositors.

Fixes: QTBUG-81504
Change-Id: I16dbe51cc5a9acf1f49b4070af91e7f2c8996122
Reviewed-by: Aleix Pol Gonzalez <aleixpol@kde.org>
Reviewed-by: Paul Olav Tvete <paul.tvete@qt.io>

1 files changed, 3 insertions, 0 deletions

diff --git a/src/client/qwaylandwindow.cpp b/src/client/qwaylandwindow.cpp
index 27a9e5628..c35ccab15 100644
--- a/src/client/qwaylandwindow.cpp
+++ b/src/client/qwaylandwindow.cpp
@@ -1204,6 +1204,9 @@ void QWaylandWindow::handleUpdate()
         return;
 
     if (mFrameCallback) {
+        if (!isExposed())
+            return;
+
         wl_callback_destroy(mFrameCallback);
         mFrameCallback = nullptr;
     }