xserver: Branch 'master'

[Keith Packard]

 Xext/shm.c |   15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

New commits:
commit 9b29fa957a397664463c7c78fbcc2f34d1993271
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Thu Oct 16 14:09:08 2014 +0100

    Xext/shm: Detach SHM segment after Pixmap is released
    
    The GPU may still have a reference to the SHM segment which would only
    be finally released when the Pixmap is destroy. So we can only detach
    the SHM segment (and thereby making the memory unaccessible) after the
    backend has had a chance to flush any remaining references.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=85058
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Reported-and-tested-by: gedgon at gmail.com
    Reviewed-by: Adam Jackson <ajax at redhat.com>
    Signed-off-by: Keith Packard <keithp at keithp.com>

diff --git a/Xext/shm.c b/Xext/shm.c
index 4dad8b6..b787918 100644
--- a/Xext/shm.c
+++ b/Xext/shm.c
@@ -248,21 +248,20 @@ ShmDestroyPixmap(PixmapPtr pPixmap)
 {
     ScreenPtr pScreen = pPixmap->drawable.pScreen;
     ShmScrPrivateRec *screen_priv = ShmGetScreenPriv(pScreen);
+    void *shmdesc = NULL;
     Bool ret;
 
-    if (pPixmap->refcnt == 1) {
-        ShmDescPtr shmdesc;
-
-        shmdesc = (ShmDescPtr) dixLookupPrivate(&pPixmap->devPrivates,
-                                                shmPixmapPrivateKey);
-        if (shmdesc)
-            ShmDetachSegment((void *) shmdesc, pPixmap->drawable.id);
-    }
+    if (pPixmap->refcnt == 1)
+        shmdesc = dixLookupPrivate(&pPixmap->devPrivates, shmPixmapPrivateKey);
 
     pScreen->DestroyPixmap = screen_priv->destroyPixmap;
     ret = (*pScreen->DestroyPixmap) (pPixmap);
     screen_priv->destroyPixmap = pScreen->DestroyPixmap;
     pScreen->DestroyPixmap = ShmDestroyPixmap;
+
+    if (shmdesc)
+	ShmDetachSegment(shmdesc, pPixmap->drawable.id);
+
     return ret;
 }