The following crash was observed with xserver 1.20.1 on exiting xserver
after enabling a PRIME output source with the Intel driver:
Old value = (WindowPtr) 0x612000159dc0
New value = (WindowPtr) 0x0 // pWin->drawable.pScreen->root = NULL;
DeleteWindow (value=0x612000159dc0, wid=<optimized out>) at dix/window.c:1112
1112 dixFreeObjectWithPrivates(pWin, PRIVATE_WINDOW);
(gdb) bt
#0 DeleteWindow (value=0x612000159dc0, wid=<optimized out>) at dix/window.c:1112
#1 0x0000557e7842535b in doFreeResource (res=0x60300000ebf0, skip=<optimized out>) at dix/resource.c:880
#2 0x0000557e784289ed in FreeClientResources (client=0x60e000000040) at dix/resource.c:1146
#3 0x0000557e78428c46 in FreeAllResources () at dix/resource.c:1161
#4 0x0000557e783c25d8 in dix_main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at dix/main.c:292
...
Thread 1 "Xorg" received signal SIGSEGV, Segmentation fault.
0x0000557e7841138c in PixmapStopDirtyTracking (src=0x0, slave_dst=0x61100002ea80) at dix/pixmap.c:251
251 ScreenPtr screen = src->pScreen;
(gdb) bt
#0 0x0000558e598a938c in PixmapStopDirtyTracking (src=0x0, slave_dst=0x611000038d00) at ../xserver/dix/pixmap.c:251
#1 0x0000558e5990ccd5 in RRCrtcDetachScanoutPixmap (crtc=0x617000004680) at ../xserver/randr/rrcrtc.c:413
#2 0x0000558e5990d001 in RRCrtcDestroyResource (value=0x617000004680, pid=<optimized out>) at ../xserver/randr/rrcrtc.c:900
#3 0x0000558e598bd35b in doFreeResource (res=0x60300000a2a0, skip=<optimized out>) at ../xserver/dix/resource.c:880
#4 0x0000558e598c09ed in FreeClientResources (client=0x60e000000040) at ../xserver/dix/resource.c:1146
#5 0x0000558e598c0c46 in FreeAllResources () at ../xserver/dix/resource.c:1161
#6 0x0000558e5985a5d8 in dix_main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at ../xserver/dix/main.c:292
For some reason, the Window resource ends up being freed before a pixmap
when using the intel driver. It does not occur with modesetting (there
RRCrtcDestroyResource is called before deleting the root window).
Before "Make PixmapDirtyUpdateRec::src a DrawablePtr" the "src" argument
was "master->GetScreenPixmap(master)". After that commit, it becomes the
root window drawable which can be NULL as shown above.
Signed-off-by: Peter Wu <peter@xxxxxxxxxxxxx>
---
randr/rrcrtc.c | 26 ++++++++++++++------------
1 file changed, 14 insertions(+), 12 deletions(-)
diff --git a/randr/rrcrtc.c b/randr/rrcrtc.c
index 5d9026266..d5dc235b7 100644
--- a/randr/rrcrtc.c
+++ b/randr/rrcrtc.c
@@ -398,20 +398,22 @@ RRCrtcDetachScanoutPixmap(RRCrtcPtr crtc)
ScreenPtr master = crtc->pScreen->current_master;
DrawablePtr mrootdraw = &master->root->drawable;
- if (crtc->scanout_pixmap_back) {
- pScrPriv->rrDisableSharedPixmapFlipping(crtc);
+ if (mrootdraw) {
+ if (crtc->scanout_pixmap_back) {
+ pScrPriv->rrDisableSharedPixmapFlipping(crtc);
- master->StopFlippingPixmapTracking(mrootdraw,
- crtc->scanout_pixmap,
- crtc->scanout_pixmap_back);
+ master->StopFlippingPixmapTracking(mrootdraw,
+ crtc->scanout_pixmap,
+ crtc->scanout_pixmap_back);
- rrDestroySharedPixmap(crtc, crtc->scanout_pixmap_back);
- crtc->scanout_pixmap_back = NULL;
- }
- else {
- pScrPriv->rrCrtcSetScanoutPixmap(crtc, NULL);
- master->StopPixmapTracking(mrootdraw,
- crtc->scanout_pixmap);
+ rrDestroySharedPixmap(crtc, crtc->scanout_pixmap_back);
+ crtc->scanout_pixmap_back = NULL;
+ }
+ else {
+ pScrPriv->rrCrtcSetScanoutPixmap(crtc, NULL);
+ master->StopPixmapTracking(mrootdraw,
+ crtc->scanout_pixmap);
+ }
}
rrDestroySharedPixmap(crtc, crtc->scanout_pixmap);
--
2.18.0
_______________________________________________
Intel-gfx mailing list
Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
