[PATCH] xnest: Fix cursor crash at regeneration

[Eric Anholt]

Adam Jackson <ajax at redhat.com> writes:

>     (EE) Backtrace:
>     (EE) 0: ./hw/xnest/Xnest (OsSigHandler+0x29) [0x468ba9]
>     (EE) 1: /lib64/libc.so.6 (__restore_rt+0x0) [0x30d7034a4f]
>     (EE) 2: ./hw/xnest/Xnest (xnestUnrealizeCursor+0x31) [0x419a81]
>     (EE) 3: ./hw/xnest/Xnest (FreeCursor+0x71) [0x425b21]
>     (EE) 4: ./hw/xnest/Xnest (doFreeResource+0x62) [0x453c22]
>     (EE) 5: ./hw/xnest/Xnest (FreeClientResources+0x97) [0x454cc7]
>     (EE) 6: ./hw/xnest/Xnest (FreeAllResources+0x47) [0x454d77]
>     (EE) 7: ./hw/xnest/Xnest (dix_main+0x3fe) [0x434e7e]
>     (EE) 8: /lib64/libc.so.6 (__libc_start_main+0xf0) [0x30d7020700]
>     (EE) 9: ./hw/xnest/Xnest (_start+0x29) [0x417de9]
>     (EE) 10: ? (?+0x29) [0x29]
>     (EE)
>     (EE) Segmentation fault at address 0x0
>
> The cursor private handling here was fairly stupid anyway, mallocing a
> struct just to hold a single XID is wasteful.  Fix this by storing the
> XID directly in the private slot.
>
> Bugzilla: https://bugs.freedesktop.org/27845
> Signed-off-by: Adam Jackson <ajax at redhat.com>

The bug report doesn't appear to be about regen, and I couldn't trigger
a crash at regen.  This does fix the Xnest - scrns 2 and cursor movement
bug, though.

I think the following diff to squash into yours would make it look more
normal (I had to do some gymnastics to not directly cast the return val
of dixLookupScreenPrivate, because apparently I can't avoid a warn about
the uintrptr_t cast directly from a function return).

Either way, with the subject fixed it'll get my r-b.

diff --git a/hw/xnest/Cursor.c b/hw/xnest/Cursor.c
index 3ee0472..071656a 100644
--- a/hw/xnest/Cursor.c
+++ b/hw/xnest/Cursor.c
@@ -36,17 +36,19 @@ is" without express or implied warranty.
 #include "Keyboard.h"
 #include "Args.h"
 
-static Cursor *
-xnestCursorAddr(CursorPtr pCursor, ScreenPtr pScreen)
+static void
+xnestSetCursorPriv(CursorPtr pCursor, ScreenPtr pScreen, Cursor cursor)
 {
-    return (Cursor *)dixLookupScreenPrivateAddr(&pCursor->devPrivates,
-                                                CursorScreenKey, pScreen);
+    dixSetScreenPrivate(&pCursor->devPrivates, CursorScreenKey, pScreen,
+                        (void *)(uintptr_t)cursor);
 }
 
 static Cursor
 xnestCursor(CursorPtr pCursor, ScreenPtr pScreen)
 {
-    return *xnestCursorAddr(pCursor, pScreen);
+    void *priv = dixLookupScreenPrivate(&pCursor->devPrivates,
+                                        CursorScreenKey, pScreen);;
+    return (Cursor)(uintptr_t)priv;
 }
 
 xnestCursorFuncRec xnestCursorFuncs = { NULL };
@@ -59,7 +61,6 @@ xnestRealizeCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCursor)
     XColor fg_color, bg_color;
     unsigned long valuemask;
     XGCValues values;
-    Cursor *cursor;
 
     valuemask = GCFunction |
         GCPlaneMask | GCForeground | GCBackground | GCClipMask;
@@ -112,10 +113,11 @@ xnestRealizeCursor(DeviceIntPtr pDev, ScreenPtr pScreen, CursorPtr pCursor)
     bg_color.green = pCursor->backGreen;
     bg_color.blue = pCursor->backBlue;
 
-    cursor = xnestCursorAddr(pCursor, pScreen);
-    *cursor = XCreatePixmapCursor(xnestDisplay, source, mask,
-                                  &fg_color, &bg_color,
-                                  pCursor->bits->xhot, pCursor->bits->yhot);
+    xnestSetCursorPriv(pCursor, pScreen,
+                       XCreatePixmapCursor(xnestDisplay, source, mask,
+                                           &fg_color, &bg_color,
+                                           pCursor->bits->xhot,
+                                           pCursor->bits->yhot));
 
     XFreePixmap(xnestDisplay, source);
     XFreePixmap(xnestDisplay, mask);
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 818 bytes
Desc: not available
URL: <http://lists.x.org/archives/xorg-devel/attachments/20150727/6312d007/attachment.sig>