xf86-video-intel: src/i830_uxa.c

[Chris Wilson]

 src/i830_uxa.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

New commits:
commit 73111cf2a212ee5cc2e03af1c600867df0c55b39
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Wed May 26 21:05:27 2010 +0100

    Decouple non-reusuable pixmaps from batch lists on unref.
    
    ==7596== Invalid write of size 4
    ==7596==    at 0x491ACA8: intel_batch_teardown (i830_batchbuffer.c:118)
    ==7596==    by 0x491C9D6: I830CloseScreen (i830_driver.c:1419)
    ==7596==    by 0x8103A9C: RRCloseScreen (randr.c:105)
    ==7596==    by 0x80DE794: xf86CrtcCloseScreen (xf86Crtc.c:759)
    ==7596==    by 0x80BEBA3: DGACloseScreen (xf86DGA.c:268)
    ==7596==    by 0x80D044B: DPMSClose (xf86DPMS.c:134)
    ==7596==    by 0x488B050: XvCloseScreen (xvmain.c:320)
    ==7596==    by 0x81841B1: VidModeClose (xf86VidMode.c:110)
    ==7596==    by 0x80EB12F: CursorCloseScreen (cursor.c:191)
    ==7596==    by 0x810CA17: AnimCurCloseScreen (animcur.c:108)
    ==7596==    by 0x816937E: compCloseScreen (compinit.c:86)
    ==7596==    by 0x48D39B9: glxCloseScreen (glxscreens.c:221)
    ==7596==  Address 0x49c1a50 is 24 bytes inside a block of size 52 free'd
    ==7596==    at 0x4024866: free (vg_replace_malloc.c:325)
    ==7596==    by 0x80B023C: Xfree (utils.c:1096)
    ==7596==    by 0x4927CFD: i830_set_pixmap_bo (i830_uxa.c:647)
    ==7596==    by 0x491C9B4: I830CloseScreen (i830_driver.c:1413)
    ==7596==    by 0x8103A9C: RRCloseScreen (randr.c:105)
    ==7596==    by 0x80DE794: xf86CrtcCloseScreen (xf86Crtc.c:759)
    ==7596==    by 0x80BEBA3: DGACloseScreen (xf86DGA.c:268)
    ==7596==    by 0x80D044B: DPMSClose (xf86DPMS.c:134)
    ==7596==    by 0x488B050: XvCloseScreen (xvmain.c:320)
    ==7596==    by 0x81841B1: VidModeClose (xf86VidMode.c:110)
    ==7596==    by 0x80EB12F: CursorCloseScreen (cursor.c:191)
    ==7596==    by 0x810CA17: AnimCurCloseScreen (animcur.c:108)
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/i830_uxa.c b/src/i830_uxa.c
index 172afe5..b063d0f 100644
--- a/src/i830_uxa.c
+++ b/src/i830_uxa.c
@@ -609,9 +609,12 @@ void i830_set_pixmap_bo(PixmapPtr pixmap, dri_bo * bo)
 		if (priv->bo == bo)
 			return;
 
-		if (list_is_empty(&priv->batch) ||
-		    !drm_intel_bo_is_reusable(priv->bo)) {
+		if (list_is_empty(&priv->batch)) {
 			dri_bo_unreference(priv->bo);
+		} else if (!drm_intel_bo_is_reusable(priv->bo)) {
+			dri_bo_unreference(priv->bo);
+			list_del(&priv->batch);
+			list_del(&priv->flush);
 		} else {
 			list_add(&priv->in_flight, &intel->in_flight);
 			priv = NULL;