[PATCH] dix: In MakeWindowOptional: Fix crash if parentOptional->cursor is NULL.

[Peter Hutterer]

On Sun, Sep 27, 2009 at 09:16:00PM +0200, Kim Woelders wrote:
> On Fri, 25 Sep 2009 03:11:59 +0200, Peter Hutterer
> <peter.hutterer at who-t.net> wrote:
>
>> On Fri, Sep 25, 2009 at 12:05:35AM +0200, Kim Woelders wrote:
>>>
>>> Signed-off-by: Kim Woelders <kim at woelders.dk>
>>> ---
>>>  dix/window.c |    3 ++-
>>>  1 files changed, 2 insertions(+), 1 deletions(-)
>>>
>>> diff --git a/dix/window.c b/dix/window.c
>>> index caff1cb..d4bc41c 100644
>>> --- a/dix/window.c
>>> +++ b/dix/window.c
>>> @@ -3470,7 +3470,8 @@ MakeWindowOptional (WindowPtr pWin)
>>>      if (!pWin->cursorIsNone)
>>>      {
>>>  	optional->cursor = parentOptional->cursor;
>>> -	optional->cursor->refcnt++;
>>> +	if (optional->cursor)
>>> +	    optional->cursor->refcnt++;
>>>      }
>>>      else
>>>      {
>>> --
>>> 1.6.4.4
>> Out of interest, what's the test scenario for that?
>>
>> I've looked at the code and can't find the trigger. If  
>> (!pWin->cursorIsNone),
>> the window has to have a cursor set (and thus already have a  
>> WindowOptional).
>> If the parent had a cursor and it was inherited here, then setting the
>> parent to a NoneCursor should patch up the child accordingly anyway.
>> So right now, I'm not sure about the actual flow to trigger that and  
>> worry
>> that it may be part of a larger screwup.
>>
> Yeah, I was suspecting that this might not be a proper fix, and I must  
> admit I cannot reproduce the crash.

Ok, I'll skip this patch then.

> There definitely is something wrong though, I have the server crashing on 
> me in about ten different ways, and I'm suspecting some kind of memory  
> corruption.
>
> One crash I can reproduce reliably is this:
>
> Start server. Start xterm. Kill xterm. Server dies:

try testing with -noreset, as Julien said the regeneration support was
busted in the driver. If you see crashes that happen outside of a regen,
that'd be serious.

Cheers,
  Peter