Client: Fix crash on wl_pointer.up after destroying a window

When wl_pointer version 5 was implemented, we added a raw QWaylandWindow
pointer in QWaylandPointerEvent. This is a problem, because the events
are stored, and the window may be deleted in the meantime.

This manifested itself as flakiness in tst_xdgshell::popup() which is
now fixed.

Fixes: QTBUG-77976
Change-Id: If34eee0286d5a63734535d67503378516d5768c3
Reviewed-by: Paul Olav Tvete <paul.tvete@qt.io>

2 files changed, 10 insertions, 3 deletions

diff --git a/src/client/qwaylandinputdevice.cpp b/src/client/qwaylandinputdevice.cpp
index 8aa0239d0..f2dee75e6 100644
--- a/src/client/qwaylandinputdevice.cpp
+++ b/src/client/qwaylandinputdevice.cpp
@@ -1045,8 +1045,15 @@ void QWaylandInputDevice::Pointer::flushScrollEvent()
 
 void QWaylandInputDevice::Pointer::flushFrameEvent()
 {
-    if (mFrameData.event) {
-        mFrameData.event->surface->handleMouse(mParent, *mFrameData.event);
+    if (auto *event = mFrameData.event) {
+        if (auto window = event->surface) {
+            window->handleMouse(mParent, *event);
+        } else if (mFrameData.event->type == QWaylandPointerEvent::Type::Release) {
+            // If the window has been destroyed, we still need to report an up event, but it can't
+            // be handled by the destroyed window (obviously), so send the event here instead.
+            QWindowSystemInterface::handleMouseEvent(nullptr, event->timestamp, event->local,
+                                                     event->global, event->buttons, event->modifiers);
+        }
         delete mFrameData.event;
         mFrameData.event = nullptr;
     }
diff --git a/src/client/qwaylandinputdevice_p.h b/src/client/qwaylandinputdevice_p.h
index 4ac1dca35..7fbb5667f 100644
--- a/src/client/qwaylandinputdevice_p.h
+++ b/src/client/qwaylandinputdevice_p.h
@@ -446,7 +446,7 @@ public:
     QPoint pixelDelta;
     QPoint angleDelta;
     Qt::MouseEventSource source = Qt::MouseEventNotSynthesized;
-    QWaylandWindow *surface = nullptr;
+    QPointer<QWaylandWindow> surface;
 };
 
 }