Make SurfaceBuffer::destroyTexture be reenterable

When QOpenGLSharedResourceGuard is freed, destroyTexture
might be reentered to cause double free. If a texture has
reference to wl_buffer which is already destroyed, freeing
the texture with decreasing reference counter will call
wl_resource_destroy for wl_buffer. Then destroyTexture will
be reentered through destroy_listener_callback.

Change-Id: I156f410ce1a05b3041b05a310b5d3d79d38e0a8c
Reviewed-by: Jørgen Lind <jorgen.lind@digia.com>

1 files changed, 3 insertions, 1 deletions

diff --git a/src/compositor/wayland_wrapper/qwlsurfacebuffer.cpp b/src/compositor/wayland_wrapper/qwlsurfacebuffer.cpp
index a8ad3e0e1..ccd054cad 100644
--- a/src/compositor/wayland_wrapper/qwlsurfacebuffer.cpp
+++ b/src/compositor/wayland_wrapper/qwlsurfacebuffer.cpp
@@ -188,9 +188,11 @@ void SurfaceBuffer::destroyTexture()
 #ifdef QT_COMPOSITOR_WAYLAND_GL
     if (m_texture) {
         Q_ASSERT(m_guard);
+        /* When QOpenGLSharedResourceGuard is freed, destroyTexture might be reentered
+            to cause double free. So clear m_texture first. */
+        m_texture = 0;
         m_guard->free();
         m_guard = 0;
-        m_texture = 0;
     }
 #endif
 }