Fixed bug 4394 - Crash in SDL_PumpEvents() after SDL_DestroyWindow()

Cameron Gutman

After updating to SDL 2.0.9, I got a user report that my app was crashing when closing a SDL_WINDOW_FULLSCREEN window to return to my Qt-based UI. It looks like the dead SDL window is getting a spurious updateLayer call which is causing SDL to dereference a null SDL_WindowData pointer.

For some reason, this only happens when using SDL_WINDOW_FULLSCREEN and not windowed or SDL_WINDOW_FULLSCREEN_DESKTOP. I was also unsuccessful in my attempt to get a simple reproducer for this crash. The Session.cpp code is available https://github.com/moonlight-stream/moonlight-qt/blob/688c4a90d994aa23e7b0af3ffcbb8707886db780/app/streaming/session.cpp but I slightly modified it (adding a SDL_PumpEvents() call at 1179 to immediately trigger the issue, otherwise it happened when Qt next pumped the event loop).

The crashing line is:

NSMutableArray *contexts = data->nscontexts;

     1.1 --- a/src/video/cocoa/SDL_cocoawindow.m	Mon Nov 19 21:28:52 2018 -0800
     1.2 +++ b/src/video/cocoa/SDL_cocoawindow.m	Mon Nov 19 21:35:59 2018 -0800
     1.3 @@ -224,6 +224,10 @@
     1.4  static void
     1.5  ScheduleContextUpdates(SDL_WindowData *data)
     1.6  {
     1.7 +    if (!data || !data->nscontexts) {
     1.8 +        return;
     1.9 +    }
    1.10 +
    1.11      NSOpenGLContext *currentContext = [NSOpenGLContext currentContext];
    1.12      NSMutableArray *contexts = data->nscontexts;
    1.13      @synchronized (contexts) {