Index: uspace/srv/hid/compositor/compositor.c
===================================================================
--- uspace/srv/hid/compositor/compositor.c	(revision 289cb7dde5a430de83c0f30f460de47fb564b1fd)
+++ uspace/srv/hid/compositor/compositor.c	(revision 1e3ea91748c924fbf2cbe22046f01c20416c283e)
@@ -90,4 +90,5 @@
 typedef struct {
 	link_t link;
+	atomic_t ref_cnt;
 	service_id_t in_dsid;
 	service_id_t out_dsid;
@@ -215,4 +216,5 @@
 
 	link_initialize(&win->link);
+	atomic_set(&win->ref_cnt, 0);
 	prodcons_initialize(&win->queue);
 	transform_identity(&win->transform);
@@ -232,5 +234,11 @@
 static void window_destroy(window_t *win)
 {
-	if (win) {
+	if (win && atomic_get(&win->ref_cnt) == 0) {
+		while (!list_empty(&win->queue.list)) {
+			window_event_t *event = (window_event_t *) list_first(&win->queue.list);
+			list_remove(&event->link);
+			free(event);
+		}
+
 		if (win->surface) {
 			surface_destroy(win->surface);
@@ -695,4 +703,15 @@
 	}
 
+	loc_service_unregister(win->in_dsid);
+	loc_service_unregister(win->out_dsid);
+
+	/* In case the client was killed, input fibril of the window might be
+	 * still blocked on the condition within comp_window_get_event. */
+	window_event_t *event_dummy = (window_event_t *) malloc(sizeof(window_event_t));
+	if (event_dummy) {
+		link_initialize(&event_dummy->link);
+		prodcons_produce(&win->queue, &event_dummy->link);
+	}
+
 	/* Calculate damage. */
 	sysarg_t x = 0;
@@ -706,12 +725,4 @@
 	}
 
-	/* Release window resources. */
-	loc_service_unregister(win->in_dsid);
-	loc_service_unregister(win->out_dsid);
-	while (!list_empty(&win->queue.list)) {
-		list_remove(list_first(&win->queue.list));
-	}
-	window_destroy(win);
-
 	comp_damage(x, y, width, height);
 
@@ -813,4 +824,5 @@
 
 	if (win) {
+		atomic_inc(&win->ref_cnt);
 		async_answer_0(iid, EOK);
 	} else {
@@ -825,5 +837,7 @@
 
 			if (!IPC_GET_IMETHOD(call)) {
-				async_answer_0(callid, EINVAL);
+				async_answer_0(callid, EOK);
+				atomic_dec(&win->ref_cnt);
+				window_destroy(win);
 				return;
 			}
@@ -842,5 +856,7 @@
 
 			if (!IPC_GET_IMETHOD(call)) {
-				async_answer_0(callid, EINVAL);
+				comp_window_close(win, callid, &call);
+				atomic_dec(&win->ref_cnt);
+				window_destroy(win);
 				return;
 			}
@@ -857,5 +873,7 @@
 				break;
 			case WINDOW_CLOSE:
-				comp_window_close(win, callid, &call);
+				/* Postpone the closing until the phone is hung up to cover
+				 * the case when the client is killed abruptly. */
+				async_answer_0(callid, EOK);
 				break;
 			case WINDOW_CLOSE_REQUEST: