xf86-video-intel: 2 commits - src/sna/sna_display.c src/sna/sna_dri.c

[Chris Wilson]

 src/sna/sna_display.c |    1 +
 src/sna/sna_dri.c     |   17 +++++++++++++++--
 2 files changed, 16 insertions(+), 2 deletions(-)

New commits:
commit 6ee9969f0e99975a24e113af9591909d9023d8af
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Fri Sep 14 13:04:50 2012 +0100

    sna/dri: Update AsyncSwap for recent changes in tracking DRI drawables
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/sna_dri.c b/src/sna/sna_dri.c
index de0f84d..2296ab6 100644
--- a/src/sna/sna_dri.c
+++ b/src/sna/sna_dri.c
@@ -1417,7 +1417,9 @@ static void sna_dri_flip_event(struct sna *sna,
 		     __FUNCTION__, flip->pipe,
 		     sna->dri.flip_pending != NULL,
 		     flip->front->name != flip->old_front.name));
-		assert(sna->dri.flip_pending == flip);
+
+		if (sna->dri.flip_pending)
+			goto finish_async_flip;
 
 		if (flip->front->name != flip->next_front.name) {
 			DBG(("%s: async flip continuing\n", __FUNCTION__));
@@ -1435,6 +1437,8 @@ static void sna_dri_flip_event(struct sna *sna,
 			flip->next_front.bo = get_private(flip->front)->bo;
 			flip->next_front.name = flip->front->name;
 			flip->off_delay = 5;
+
+			sna->dri.flip_pending = flip;
 		} else if (--flip->off_delay) {
 			DBG(("%s: queuing no-flip [delay=%d]\n",
 			     __FUNCTION__, flip->off_delay));
@@ -1444,12 +1448,13 @@ static void sna_dri_flip_event(struct sna *sna,
 						    flip, flip->pipe);
 			if (flip->count == 0)
 				goto finish_async_flip;
+
+			sna->dri.flip_pending = flip;
 		} else {
 finish_async_flip:
 			flip->next_front.bo = NULL;
 
 			DBG(("%s: async flip completed\n", __FUNCTION__));
-			sna->dri.flip_pending = NULL;
 			sna_dri_frame_event_info_free(sna, draw, flip);
 		}
 		break;
@@ -1992,6 +1997,7 @@ blit:
 			goto blit;
 
 		info->client = client;
+		info->draw = draw;
 		info->type = DRI2_ASYNC_FLIP;
 		info->pipe = pipe;
 		info->front = front;
commit d2dbb991384f2b820a714eba262691ed97a6a22a
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Fri Sep 14 13:04:14 2012 +0100

    sna/dri: Add a bunch of assertions for hunting a use-after-free
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/sna_display.c b/src/sna/sna_display.c
index 36122e2..a0129e4 100644
--- a/src/sna/sna_display.c
+++ b/src/sna/sna_display.c
@@ -2495,6 +2495,7 @@ sna_page_flip(struct sna *sna,
 	int count;
 
 	DBG(("%s: handle %d attached\n", __FUNCTION__, bo->handle));
+	assert(bo->refcnt);
 
 	kgem_submit(&sna->kgem);
 
diff --git a/src/sna/sna_dri.c b/src/sna/sna_dri.c
index ff6b587..de0f84d 100644
--- a/src/sna/sna_dri.c
+++ b/src/sna/sna_dri.c
@@ -115,6 +115,7 @@ get_private(DRI2Buffer2Ptr buffer)
 
 static inline struct kgem_bo *ref(struct kgem_bo *bo)
 {
+	assert(bo->refcnt);
 	bo->refcnt++;
 	return bo;
 }
@@ -877,6 +878,8 @@ sna_dri_remove_frame_event(WindowPtr win,
 
 	while (chain->chain != info)
 		chain = chain->chain;
+	assert(chain != info);
+	assert(info->chain != chain);
 	chain->chain = info->chain;
 }
 
@@ -912,8 +915,11 @@ sna_dri_add_frame_event(DrawablePtr draw, struct sna_dri_frame_event *info)
 		return;
 	}
 
+	assert(chain != info);
 	while (chain->chain != NULL)
 		chain = chain->chain;
+
+	assert(chain != info);
 	chain->chain = info;
 }
 
@@ -2031,6 +2037,7 @@ blit:
 				    CREATE_SCANOUT | CREATE_EXACT);
 		name = kgem_bo_flink(&sna->kgem, bo);
 	}
+	assert(bo->refcnt);
 	get_private(info->back)->bo = bo;
 	info->back->name = name;