Fix crash when assigning nullptr to ShellSurfaceItem.shellSurface

This also fixes a memory leak when switching shellSurfaces.

Task-number: QTBUG-59591
Change-Id: I196ea7238d9139c8ac281f82bbae8dd066b1fcd7
Reviewed-by: Paul Olav Tvete <paul.tvete@qt.io>
Reviewed-by: Andreas Cord-Landwehr <cordlandwehr@kde.org>

7 files changed, 34 insertions, 1 deletions

diff --git a/src/compositor/extensions/qwaylandivisurfaceintegration.cpp b/src/compositor/extensions/qwaylandivisurfaceintegration.cpp
index 3a3d9c1c9..88b727df4 100644
--- a/src/compositor/extensions/qwaylandivisurfaceintegration.cpp
+++ b/src/compositor/extensions/qwaylandivisurfaceintegration.cpp
@@ -54,6 +54,11 @@ IviSurfaceIntegration::IviSurfaceIntegration(QWaylandQuickShellSurfaceItem *item
     connect(m_shellSurface, &QWaylandIviSurface::destroyed, this, &IviSurfaceIntegration::handleIviSurfaceDestroyed);
 }
 
+IviSurfaceIntegration::~IviSurfaceIntegration()
+{
+    m_item->setSurface(nullptr);
+}
+
 void IviSurfaceIntegration::handleIviSurfaceDestroyed()
 {
     m_shellSurface = nullptr;
diff --git a/src/compositor/extensions/qwaylandivisurfaceintegration_p.h b/src/compositor/extensions/qwaylandivisurfaceintegration_p.h
index 534caf642..eaccd9591 100644
--- a/src/compositor/extensions/qwaylandivisurfaceintegration_p.h
+++ b/src/compositor/extensions/qwaylandivisurfaceintegration_p.h
@@ -61,6 +61,7 @@ class IviSurfaceIntegration : public QWaylandQuickShellIntegration
     Q_OBJECT
 public:
     IviSurfaceIntegration(QWaylandQuickShellSurfaceItem *item);
+    ~IviSurfaceIntegration();
 
 private Q_SLOTS:
     void handleIviSurfaceDestroyed();
diff --git a/src/compositor/extensions/qwaylandquickshellsurfaceitem.cpp b/src/compositor/extensions/qwaylandquickshellsurfaceitem.cpp
index 91f9d7771..64d895613 100644
--- a/src/compositor/extensions/qwaylandquickshellsurfaceitem.cpp
+++ b/src/compositor/extensions/qwaylandquickshellsurfaceitem.cpp
@@ -112,7 +112,14 @@ void QWaylandQuickShellSurfaceItem::setShellSurface(QWaylandShellSurface *shellS
 
     d->m_shellSurface = shellSurface;
 
-    d->m_shellIntegration = shellSurface->createIntegration(this);
+    if (d->m_shellIntegration) {
+        delete d->m_shellIntegration;
+        d->m_shellIntegration = nullptr;
+    }
+
+    if (shellSurface)
+        d->m_shellIntegration = shellSurface->createIntegration(this);
+
     emit shellSurfaceChanged();
 }
 
diff --git a/src/compositor/extensions/qwaylandwlshellintegration.cpp b/src/compositor/extensions/qwaylandwlshellintegration.cpp
index b32416764..c3d278a52 100644
--- a/src/compositor/extensions/qwaylandwlshellintegration.cpp
+++ b/src/compositor/extensions/qwaylandwlshellintegration.cpp
@@ -68,6 +68,11 @@ WlShellIntegration::WlShellIntegration(QWaylandQuickShellSurfaceItem *item)
     connect(m_shellSurface.data(), &QWaylandWlShellSurface::destroyed, this, &WlShellIntegration::handleShellSurfaceDestroyed);
 }
 
+WlShellIntegration::~WlShellIntegration()
+{
+    m_item->setSurface(nullptr);
+}
+
 void WlShellIntegration::handleStartMove(QWaylandSeat *seat)
 {
     grabberState = GrabberState::Move;
diff --git a/src/compositor/extensions/qwaylandwlshellintegration_p.h b/src/compositor/extensions/qwaylandwlshellintegration_p.h
index 814f5e12d..15aec01c6 100644
--- a/src/compositor/extensions/qwaylandwlshellintegration_p.h
+++ b/src/compositor/extensions/qwaylandwlshellintegration_p.h
@@ -61,6 +61,7 @@ class WlShellIntegration : public QWaylandQuickShellIntegration
     Q_OBJECT
 public:
     WlShellIntegration(QWaylandQuickShellSurfaceItem *item);
+    ~WlShellIntegration();
     bool mouseMoveEvent(QMouseEvent *event) override;
     bool mouseReleaseEvent(QMouseEvent *event) override;
 
diff --git a/src/compositor/extensions/qwaylandxdgshellv5integration.cpp b/src/compositor/extensions/qwaylandxdgshellv5integration.cpp
index e2aa6b3ea..156d5679b 100644
--- a/src/compositor/extensions/qwaylandxdgshellv5integration.cpp
+++ b/src/compositor/extensions/qwaylandxdgshellv5integration.cpp
@@ -65,6 +65,11 @@ XdgShellV5Integration::XdgShellV5Integration(QWaylandQuickShellSurfaceItem *item
     connect(m_xdgSurface->surface(), &QWaylandSurface::sizeChanged, this, &XdgShellV5Integration::handleSurfaceSizeChanged);
 }
 
+XdgShellV5Integration::~XdgShellV5Integration()
+{
+    m_item->setSurface(nullptr);
+}
+
 bool XdgShellV5Integration::mouseMoveEvent(QMouseEvent *event)
 {
     if (grabberState == GrabberState::Resize) {
@@ -190,6 +195,7 @@ void XdgShellV5Integration::handleSurfaceSizeChanged()
 
 XdgPopupV5Integration::XdgPopupV5Integration(QWaylandQuickShellSurfaceItem *item)
     : QWaylandQuickShellIntegration (item)
+    , m_item(item)
     , m_xdgPopup(qobject_cast<QWaylandXdgPopupV5 *>(item->shellSurface()))
     , m_xdgShell(QWaylandXdgPopupV5Private::get(m_xdgPopup)->m_xdgShell)
 {
@@ -206,6 +212,11 @@ XdgPopupV5Integration::XdgPopupV5Integration(QWaylandQuickShellSurfaceItem *item
     connect(m_xdgPopup, &QWaylandXdgPopupV5::destroyed, this, &XdgPopupV5Integration::handlePopupDestroyed);
 }
 
+XdgPopupV5Integration::~XdgPopupV5Integration()
+{
+    m_item->setSurface(nullptr);
+}
+
 void XdgPopupV5Integration::handlePopupDestroyed()
 {
     QWaylandXdgShellV5Private *shellPrivate = QWaylandXdgShellV5Private::get(m_xdgShell);
diff --git a/src/compositor/extensions/qwaylandxdgshellv5integration_p.h b/src/compositor/extensions/qwaylandxdgshellv5integration_p.h
index 6f02ab399..90c425e6f 100644
--- a/src/compositor/extensions/qwaylandxdgshellv5integration_p.h
+++ b/src/compositor/extensions/qwaylandxdgshellv5integration_p.h
@@ -60,6 +60,7 @@ class XdgShellV5Integration : public QWaylandQuickShellIntegration
     Q_OBJECT
 public:
     XdgShellV5Integration(QWaylandQuickShellSurfaceItem *item);
+    ~XdgShellV5Integration();
     bool mouseMoveEvent(QMouseEvent *event) override;
     bool mouseReleaseEvent(QMouseEvent *event) override;
 
@@ -111,11 +112,13 @@ class XdgPopupV5Integration : public QWaylandQuickShellIntegration
     Q_OBJECT
 public:
     XdgPopupV5Integration(QWaylandQuickShellSurfaceItem *item);
+    ~XdgPopupV5Integration();
 
 private Q_SLOTS:
     void handlePopupDestroyed();
 
 private:
+    QWaylandQuickShellSurfaceItem *m_item;
     QWaylandXdgPopupV5 *m_xdgPopup;
     QWaylandXdgShellV5 *m_xdgShell;
 };