xf86-video-intel: src/sna/sna_accel.c src/sna/sna_display.c

[Chris Wilson]

 src/sna/sna_accel.c   |    3 +++
 src/sna/sna_display.c |   33 +++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+)

New commits:
commit b8a0acd615042bee7bdf49c364a4815ade6b9a61
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Wed Feb 27 13:26:18 2013 +0000

    sna: Migrate dirty tracking across ScreenPixmap updates
    
    Otherwise chaos ensues:
    
    Invalid read of size 8
    ==8647==    at 0x8477BC1: has_offload_slaves.isra.38 (sna_accel.c:14402)
    ==8647==    by 0x84958E7: sna_accel_block_handler (sna_accel.c:13729)
    ==8647==    by 0x164B13: BlockHandler (dixutils.c:387)
    ==8647==    by 0x2B5273: WaitForSomething (WaitFor.c:210)
    ==8647==    by 0x160790: Dispatch (dispatch.c:357)
    ==8647==    by 0x14F549: main (main.c:298)
    ==8647==  Address 0xf3383e8 is 24 bytes inside a block of size 152 free'd
    ==8647==    at 0x4C2BA6C: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
    ==8647==    by 0x2403DF: damageDestroyPixmap (damage.c:1549)
    ==8647==    by 0x1FFD88: XvDestroyPixmap (xvmain.c:372)
    ==8647==    by 0x1FE789: ShmDestroyPixmap (shm.c:273)
    ==8647==    by 0x8507C24: _sna_dri_destroy_buffer (sna_dri.c:448)
    ==8647==    by 0x289986: do_get_buffers (dri2.c:521)
    ==8647==    by 0x289C0F: DRI2GetBuffersWithFormat (dri2.c:690)
    ==8647==    by 0x28B68F: ProcDRI2Dispatch (dri2ext.c:306)
    ==8647==    by 0x160A40: Dispatch (dispatch.c:428)
    ==8647==    by 0x14F549: main (main.c:298)
    ==8647==
    ==8647== Invalid read of size 8
    ==8647==    at 0x8477BCA: has_offload_slaves.isra.38 (regionstr.h:74)
    ==8647==    by 0x84958E7: sna_accel_block_handler (sna_accel.c:13729)
    ==8647==    by 0x164B13: BlockHandler (dixutils.c:387)
    ==8647==    by 0x2B5273: WaitForSomething (WaitFor.c:210)
    ==8647==    by 0x160790: Dispatch (dispatch.c:357)
    ==8647==    by 0x14F549: main (main.c:298)
    ==8647==  Address 0xdfdfdfdfdfdfdfe7 is not stack'd, malloc'd or (recently) free'd
    
    Reported-by: Maarten Lankhorst <maarten.lankhorst at canonical.com>
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>

diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c
index f991ebb..bacd431 100644
--- a/src/sna/sna_accel.c
+++ b/src/sna/sna_accel.c
@@ -13701,6 +13701,7 @@ static bool has_offload_slaves(struct sna *sna)
 	PixmapDirtyUpdatePtr dirty;
 
 	xorg_list_for_each_entry(dirty, &screen->pixmap_dirty_list, ent) {
+		assert(dirty->src == sna->front);
 		if (RegionNotEmpty(DamageRegion(dirty->damage)))
 			return true;
 	}
@@ -13853,6 +13854,8 @@ static void sna_accel_post_damage(struct sna *sna)
 		BoxPtr box;
 		int n;
 
+		assert(dirty->src == sna->front);
+
 		damage = DamageRegion(dirty->damage);
 		if (RegionNil(damage))
 			continue;
diff --git a/src/sna/sna_display.c b/src/sna/sna_display.c
index fb282fd..45ae462 100644
--- a/src/sna/sna_display.c
+++ b/src/sna/sna_display.c
@@ -2427,6 +2427,36 @@ static void copy_front(struct sna *sna, PixmapPtr old, PixmapPtr new)
 			       new->drawable.height);
 }
 
+static void
+migrate_dirty_tracking(struct sna *sna, PixmapPtr old_front)
+{
+#if HAS_PIXMAP_SHARING
+	ScreenPtr screen = sna->scrn->pScreen;
+	PixmapDirtyUpdatePtr dirty, safe;
+
+	xorg_list_for_each_entry_safe(dirty, safe, &screen->pixmap_dirty_list, ent) {
+		assert(dirty->src == old_front);
+		if (dirty->src != old_front)
+			continue;
+
+		DamageUnregister(&dirty->src->drawable, dirty->damage);
+		DamageDestroy(dirty->damage);
+
+		dirty->damage = DamageCreate(NULL, NULL,
+					     DamageReportNone,
+					     TRUE, screen, screen);,
+		if (!dirty->damage) {
+			xorg_list_del(&dirty->ent);
+			free(dirty);
+			continue;
+		}
+
+		DamageRegister(&sna->front->drawable, dirty->damage);
+		dirty->src = sna->front;
+	}
+#endif
+}
+
 static Bool
 sna_crtc_resize(ScrnInfoPtr scrn, int width, int height)
 {
@@ -2481,6 +2511,9 @@ sna_crtc_resize(ScrnInfoPtr scrn, int width, int height)
 			sna_crtc_disable(crtc);
 	}
 
+	/* Open-coded screen->SetScreenPixmap */
+	migrate_dirty_tracking(sna, old_front);
+
 	if (root(screen)) {
 		struct sna_visit_set_pixmap_window visit;