Fix use-after-free in gdk_window_end_paint()

It's a miracle that this code ever worked.

diff --git a/gdk/gdkwindow.c b/gdk/gdkwindow.c
index 8c85cb79cb426457fcf45e7022d274f78706b606..65db5e8753ceca5ca32f957f78970447725413b2 100644 (file)
--- a/gdk/gdkwindow.c
+++ b/gdk/gdkwindow.c
@@ -3111,7 +3111,6 @@ gdk_window_end_paint (GdkWindow *window)
         {
           surface = gdk_window_ref_impl_surface (window);
           cr = cairo_create (surface);
-          cairo_surface_destroy (surface);
 
           cairo_set_source_surface (cr, window->current_paint.surface, 0, 0);
           gdk_cairo_region (cr, window->current_paint.region);
@@ -3123,6 +3122,7 @@ gdk_window_end_paint (GdkWindow *window)
           cairo_destroy (cr);
 
           cairo_surface_flush (surface);
+          cairo_surface_destroy (surface);
         }
     }