shell: Fix segfault from trying to access a destroyed popup shell surface
The shell_destroy_shell_surface function only set the backing resource to
NULL, leaving an unusable surface in the popup_grab list until the surface's
fading animation finished and it could be freed. This caused a segfault if
the shell tried to forcibly break the grab during that time interval due to
the compositor losing the keyboard focus.
https://bugs.freedesktop.org/show_bug.cgi?id=77072
diff --git a/desktop-shell/shell.c b/desktop-shell/shell.c
index 59fa99c..fe03420 100644
--- a/desktop-shell/shell.c
+++ b/desktop-shell/shell.c
@@ -3050,6 +3050,8 @@
{
struct shell_surface *shsurf = wl_resource_get_user_data(resource);
+ if (!wl_list_empty(&shsurf->popup.grab_link))
+ remove_popup_grab(shsurf);
shsurf->resource = NULL;
}