xserver: Branch 'master'

[Aaron Plattner]

 fb/fb.h        |    1 +
 fb/fbpict.c    |   23 ++++++++++++-----------
 fb/fbtrap.c    |    8 ++------
 fb/wfbrename.h |    1 +
 4 files changed, 16 insertions(+), 17 deletions(-)

New commits:
diff-tree 74feba4d77d74979a0ea478d666439ffc55001e5 (from f6aa2200f2fb4f4d4bb51e67d68e86aabcac0c4b)
Author: Aaron Plattner <aplattner at nvidia.com>
Date:   Wed Aug 1 14:30:03 2007 -0700

    Don't unwrap too early in libwfb for Composite.
    
    Don't call fbFinishWrap until the pixman_image_t that stores the pointer is
    actually freed.  This prevents corruption or crashes caused by accessing a
    wrapped pointer after the wrapping is torn down.

diff --git a/fb/fb.h b/fb/fb.h
index 3782fae..27b49f6 100644
--- a/fb/fb.h
+++ b/fb/fb.h
@@ -2117,6 +2117,7 @@ fbPaintWindow(WindowPtr pWin, RegionPtr 
 
 pixman_image_t *image_from_pict (PicturePtr pict,
 				 Bool       has_clip);
+void free_pixman_pict (PicturePtr, pixman_image_t *);
 
 #endif /* _FB_H_ */
 
diff --git a/fb/fbpict.c b/fb/fbpict.c
index 9efa0e8..4d1ad0b 100644
--- a/fb/fbpict.c
+++ b/fb/fbpict.c
@@ -185,15 +185,11 @@ fbComposite (CARD8      op,
 	pixman_image_composite (op, src, mask, dest,
 				xSrc, ySrc, xMask, yMask, xDst, yDst,
 				width, height);
-	    
     }
-    
-    if (src)
-	pixman_image_unref (src);
-    if (mask)
-	pixman_image_unref (mask);
-    if (dest)
-	pixman_image_unref (dest);
+
+    free_pixman_pict (pSrc, src);
+    free_pixman_pict (pMask, mask);
+    free_pixman_pict (pDst, dest);
 }
 
 void
@@ -332,8 +328,6 @@ create_bits_picture (PicturePtr pict,
     /* Indexed table */
     if (pict->pFormat->index.devPrivate)
 	pixman_image_set_indexed (image, pict->pFormat->index.devPrivate);
-    
-    fbFinishAccess (pict->pDrawable);
 
     return image;
 }
@@ -379,7 +373,7 @@ set_image_properties (pixman_image_t *im
 	pixman_image_set_alpha_map (
 	    image, alpha_map, pict->alphaOrigin.x, pict->alphaOrigin.y);
 	
-	pixman_image_unref (alpha_map);
+	free_pixman_pict (pict->alphaMap, alpha_map);
     }
     
     pixman_image_set_component_alpha (image, pict->componentAlpha);
@@ -445,6 +439,13 @@ image_from_pict (PicturePtr pict,
     return image;
 }
 
+void
+free_pixman_pict (PicturePtr pict, pixman_image_t *image)
+{
+    if (image && pixman_image_unref (image) && pict->pDrawable)
+	fbFinishAccess (pict->pDrawable);
+}
+
 Bool
 fbPictureInit (ScreenPtr pScreen, PictFormatPtr formats, int nformats)
 {
diff --git a/fb/fbtrap.c b/fb/fbtrap.c
index e70336c..830603a 100644
--- a/fb/fbtrap.c
+++ b/fb/fbtrap.c
@@ -47,9 +47,7 @@ fbAddTraps (PicturePtr	pPicture,
     
     pixman_add_traps (image, x_off, y_off, ntrap, (pixman_trap_t *)traps);
 
-    fbFinishAccess (pPicture->pDrawable);
-
-    pixman_image_unref (image);
+    free_pixman_pict (pPicture, image);
 }
 
 void
@@ -65,9 +63,7 @@ fbRasterizeTrapezoid (PicturePtr    pPic
 
     pixman_rasterize_trapezoid (image, (pixman_trapezoid_t *)trap, x_off, y_off);
 
-    fbFinishAccess (pPicture->pDrawable);
-
-    pixman_image_unref (image);
+    free_pixman_pict (pPicture, image);
 }
 
 static int
diff --git a/fb/wfbrename.h b/fb/wfbrename.h
index 952512e..5ea9092 100644
--- a/fb/wfbrename.h
+++ b/fb/wfbrename.h
@@ -188,6 +188,7 @@
 #define fbWinPrivateIndex wfbWinPrivateIndex
 #define fbZeroLine wfbZeroLine
 #define fbZeroSegment wfbZeroSegment
+#define free_pixman_pict wfb_free_pixman_pict
 #define image_from_pict wfb_image_from_pict
 #define xxScrPrivateIndex wfbxxScrPrivateIndex
 #define xxGCPrivateIndex wfbxxGCPrivateIndex