1. 01 Sep, 2010 8 commits
  2. 21 Aug, 2010 1 commit
  3. 20 Aug, 2010 4 commits
  4. 18 Aug, 2010 1 commit
  5. 16 Aug, 2010 1 commit
    • Keith Packard's avatar
      dix: reset pScreen->root to NULL when root window is deleted. · 6e3e559e
      Keith Packard authored
      From: Dave Airlie <airlied@linux.ie>
      
      We were seeing a crash in the FreeAllResources codepath,
      running valgrind revealed this,
      
      ==12536== Invalid read of size 4
      ==12536==    at 0x810BCAB: DeliverPropertyEvent (rrproperty.c:33)
      ==12536==    by 0x80958A4: TraverseTree (window.c:227)
      ==12536==    by 0x809593E: WalkTree (window.c:255)
      ==12536==    by 0x810BC66: RRDeliverPropertyEvent (rrproperty.c:53)
      ==12536==    by 0x810BD5D: RRDeleteProperty.clone.0 (rrproperty.c:76)
      ==12536==    by 0x810BD98: RRDeleteAllOutputProperties (rrproperty.c:88)
      ==12536==    by 0x810A36E: RROutputDestroyResource (rroutput.c:407)
      ==12536==    by 0x808DF4E: FreeClientResources (resource.c:859)
      ==12536==    by 0x808E005: FreeAllResources (resource.c:876)
      ==12536==    by 0x8062300: main (main.c:305)
      ==12536==  Address 0x46ba8ac is 4 bytes inside a block of size 164 free'd
      ==12536==    at 0x40057F6: free (vg_replace_malloc.c:325)
      ==12536==    by 0x8087F1F: _dixFreeObjectWithPrivates (privates.c:357)
      ==12536==    by 0x809832A: DeleteWindow (window.c:926)
      ==12536==    by 0x808DF4E: FreeClientResources (resource.c:859)
      ==12536==    by 0x808E005: FreeAllResources (resource.c:876)
      ==12536==    by 0x8062300: main (main.c:305)
      
      Its a use after free on the root window, since we have already deleted it
      at this point. This patch checks if the window we are destroying is the root
      window and resets the pointer to NULL if it is.
      Signed-off-by: Keith Packard's avatarKeith Packard <keithp@keithp.com>
      Reviewed-by: default avatarDave Airlie <airlied@redhat.com>
      Tested-by: default avatarDave Airlie <airlied@redhat.com>
      6e3e559e
  6. 13 Aug, 2010 11 commits
  7. 10 Aug, 2010 10 commits
  8. 06 Aug, 2010 2 commits
    • Kristian Høgsberg's avatar
      Set DamageSetReportAfterOp to true for the damage extension · 8d7b7a0d
      Kristian Høgsberg authored
      Change the damage extension reporter to queue up events after we chain
      to the wrapped functions.  Damage events are typically sent out after
      the rendering happens anyway, since we submit batch buffers from the
      flush callback chain and then flush client io buffers.  Compositing
      managers relie on this order, and there is no way we could reliably
      provide damage events to clients before the rendering happens anyway.
      
      By queueing up the damage events before the rendering happens, there's
      a risk that the client io buffer may overflow and send the damage
      events to the client before the driver has even seen the rendering
      request.  Reporting damage events after the rendering fixes this
      corner case and better corresponds with how we expect this to work.
      Signed-off-by: Kristian H. Kristensen's avatarKristian Høgsberg <krh@bitplanet.net>
      Reviewed-by: Keith Packard's avatarKeith Packard <keithp@keithp.com>
      8d7b7a0d
    • Kristian Høgsberg's avatar
      Always call the flush callback chain when we flush client buffers · c65f610e
      Kristian Høgsberg authored
      We were missing the callback in a couple of places.  Drivers may use
      the flush callback to submit batched up rendering before events (for
      example, damage events) are sent out, to ensure that the rendering
      has been queued when the client receives the event.
      Signed-off-by: Kristian H. Kristensen's avatarKristian Høgsberg <krh@bitplanet.net>
      Reviewed-by: Keith Packard's avatarKeith Packard <keithp@keithp.com>
      c65f610e
  9. 02 Aug, 2010 1 commit
  10. 29 Jul, 2010 1 commit