xwayland: fix double free wlr_xwayland_shell_v1

include/wlr/xwayland/shell.h

@@ -21,6 +21,7 @@ struct wlr_xwayland_shell_v1 {
 	struct wl_global *global;
 
 	struct {
+		struct wl_signal destroy;
 		struct wl_signal new_surface; // struct wlr_xwayland_surface_v1
 	} events;
 

include/wlr/xwayland/xwayland.h

@@ -49,6 +49,7 @@ struct wlr_xwayland {
 	struct wl_listener server_ready;
 	struct wl_listener server_destroy;
 	struct wl_listener seat_destroy;
+	struct wl_listener shell_destroy;
 
 	void *data;
 };

xwayland/shell.c

@@ -179,6 +179,7 @@ struct wlr_xwayland_shell_v1 *wlr_xwayland_shell_v1_create(
 
 	wl_list_init(&shell->surfaces);
 	wl_signal_init(&shell->events.new_surface);
+	wl_signal_init(&shell->events.destroy);
 
 	shell->display_destroy.notify = handle_display_destroy;
 	wl_display_add_destroy_listener(display, &shell->display_destroy);
@@ -193,6 +194,8 @@ void wlr_xwayland_shell_v1_destroy(struct wlr_xwayland_shell_v1 *shell) {
 		return;
 	}
 
+	wl_signal_emit_mutable(&shell->events.destroy, NULL);
+
 	struct wlr_xwayland_surface_v1 *xwl_surface, *tmp;
 	wl_list_for_each_safe(xwl_surface, tmp, &shell->surfaces, link) {
 		xwl_surface_destroy(xwl_surface);

xwayland/xwayland.c

@@ -63,6 +63,12 @@ static void handle_server_ready(struct wl_listener *listener, void *data) {
 	wl_signal_emit_mutable(&xwayland->events.ready, NULL);
 }
 
+static void handle_shell_destroy(struct wl_listener *listener, void *data) {
+	struct wlr_xwayland *xwayland =
+		wl_container_of(listener, xwayland, shell_destroy);
+	xwayland->shell_v1 = NULL;
+}
+
 void wlr_xwayland_destroy(struct wlr_xwayland *xwayland) {
 	if (!xwayland) {
 		return;
@@ -71,6 +77,7 @@ void wlr_xwayland_destroy(struct wlr_xwayland *xwayland) {
 	wl_list_remove(&xwayland->server_destroy.link);
 	wl_list_remove(&xwayland->server_start.link);
 	wl_list_remove(&xwayland->server_ready.link);
+	wl_list_remove(&xwayland->shell_destroy.link);
 	free(xwayland->cursor);
 
 	wlr_xwayland_set_seat(xwayland, NULL);
@@ -125,6 +132,9 @@ struct wlr_xwayland *wlr_xwayland_create(struct wl_display *wl_display,
 	xwayland->server_ready.notify = handle_server_ready;
 	wl_signal_add(&xwayland->server->events.ready, &xwayland->server_ready);
 
+	xwayland->shell_destroy.notify = handle_shell_destroy;
+	wl_signal_add(&xwayland->shell_v1->events.destroy, &xwayland->shell_destroy);
+
 	return xwayland;
 }