On Wed, Oct 23, 2013 at 01:58:31PM +0800, Xiong Zhang wrote:
> In drm backend, the cursor_surface->plane point to
> drm_output->cursor_plane.when this output is removed,
> drm_output->cursor_plane is destroyed, butcursor_surface->plane
> still point to destroyed plane. So once mouse move to this
> cursor_surface and system will repaint this cursor_surface,
> segment fault will generate in weston_surface_damage_below() function.
>
> V2:
> -set surface->plane to NULL whose plane point to unplugged output,
> then change weston_surface_damage_below() to do nothing if
> surface->plane is NULL (Kristian)
> -set surface->plane to NULL in weston_surface_unmap(),
> so that all surfaces that have a non-NULL plane pointer wil be
> on compositor->surface_list (Kristian).
>
> bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=69777
>
> Signed-off-by: Xiong Zhang <xiong.y.zhang at intel.com>
> ---
> src/compositor-drm.c | 6 +++---
> src/compositor.c | 22 +++++++++++++++++-----
> src/compositor.h | 5 ++++-
> 3 files changed, 24 insertions(+), 9 deletions(-)
This one looks good now, thanks. Applied to master.
Kristian
> diff --git a/src/compositor-drm.c b/src/compositor-drm.c
> index ffdec89..b5c3051 100644
> --- a/src/compositor-drm.c
> +++ b/src/compositor-drm.c
> @@ -1974,8 +1974,8 @@ create_output_for_connector(struct drm_compositor *ec,
> output->base.gamma_size = output->original_crtc->gamma_size;
> output->base.set_gamma = drm_output_set_gamma;
>
> - weston_plane_init(&output->cursor_plane, 0, 0);
> - weston_plane_init(&output->fb_plane, 0, 0);
> + weston_plane_init(&output->cursor_plane, &ec->base, 0, 0);
> + weston_plane_init(&output->fb_plane, &ec->base, 0, 0);
>
> weston_compositor_stack_plane(&ec->base, &output->cursor_plane, NULL);
> weston_compositor_stack_plane(&ec->base, &output->fb_plane,
> @@ -2050,7 +2050,7 @@ create_sprites(struct drm_compositor *ec)
> memcpy(sprite->formats, plane->formats,
> plane->count_formats * sizeof(plane->formats[0]));
> drmModeFreePlane(plane);
> - weston_plane_init(&sprite->plane, 0, 0);
> + weston_plane_init(&sprite->plane, &ec->base, 0, 0);
> weston_compositor_stack_plane(&ec->base, &sprite->plane,
> &ec->base.primary_plane);
>
> diff --git a/src/compositor.c b/src/compositor.c
> index 376ddfd..9eb3d5d 100644
> --- a/src/compositor.c
> +++ b/src/compositor.c
> @@ -377,7 +377,7 @@ weston_surface_create(struct weston_compositor *compositor)
> surface->pending.buffer_transform = surface->buffer_transform;
> surface->pending.buffer_scale = surface->buffer_scale;
> surface->output = NULL;
> - surface->plane = &compositor->primary_plane;
> + surface->plane = NULL;
> surface->pending.newly_attached = 0;
>
> pixman_region32_init(&surface->damage);
> @@ -578,8 +578,9 @@ weston_surface_damage_below(struct weston_surface *surface)
> pixman_region32_init(&damage);
> pixman_region32_subtract(&damage, &surface->transform.boundingbox,
> &surface->clip);
> - pixman_region32_union(&surface->plane->damage,
> - &surface->plane->damage, &damage);
> + if (surface->plane)
> + pixman_region32_union(&surface->plane->damage,
> + &surface->plane->damage, &damage);
> pixman_region32_fini(&damage);
> }
>
> @@ -1056,6 +1057,7 @@ weston_surface_unmap(struct weston_surface *surface)
>
> weston_surface_damage_below(surface);
> surface->output = NULL;
> + surface->plane = NULL;
> wl_list_remove(&surface->layer_link);
> wl_list_remove(&surface->link);
> wl_list_init(&surface->link);
> @@ -2604,12 +2606,15 @@ idle_handler(void *data)
> }
>
> WL_EXPORT void
> -weston_plane_init(struct weston_plane *plane, int32_t x, int32_t y)
> +weston_plane_init(struct weston_plane *plane,
> + struct weston_compositor *ec,
> + int32_t x, int32_t y)
> {
> pixman_region32_init(&plane->damage);
> pixman_region32_init(&plane->clip);
> plane->x = x;
> plane->y = y;
> + plane->compositor = ec;
>
> /* Init the link so that the call to wl_list_remove() when releasing
> * the plane without ever stacking doesn't lead to a crash */
> @@ -2619,9 +2624,16 @@ weston_plane_init(struct weston_plane *plane, int32_t x, int32_t y)
> WL_EXPORT void
> weston_plane_release(struct weston_plane *plane)
> {
> + struct weston_surface *surface;
> +
> pixman_region32_fini(&plane->damage);
> pixman_region32_fini(&plane->clip);
>
> + wl_list_for_each(surface, &plane->compositor->surface_list, link) {
> + if (surface->plane == plane)
> + surface->plane = NULL;
> + }
> +
> wl_list_remove(&plane->link);
> }
>
> @@ -3015,7 +3027,7 @@ weston_compositor_init(struct weston_compositor *ec,
> wl_list_init(&ec->axis_binding_list);
> wl_list_init(&ec->debug_binding_list);
>
> - weston_plane_init(&ec->primary_plane, 0, 0);
> + weston_plane_init(&ec->primary_plane, ec, 0, 0);
> weston_compositor_stack_plane(ec, &ec->primary_plane, NULL);
>
> s = weston_config_get_section(ec->config, "keyboard", NULL, NULL);
> diff --git a/src/compositor.h b/src/compositor.h
> index a19d966..ae7008d 100644
> --- a/src/compositor.h
> +++ b/src/compositor.h
> @@ -505,6 +505,7 @@ struct weston_layer {
> };
>
> struct weston_plane {
> + struct weston_compositor *compositor;
> pixman_region32_t damage;
> pixman_region32_t clip;
> int32_t x, y;
> @@ -927,7 +928,9 @@ void
> weston_layer_init(struct weston_layer *layer, struct wl_list *below);
>
> void
> -weston_plane_init(struct weston_plane *plane, int32_t x, int32_t y);
> +weston_plane_init(struct weston_plane *plane,
> + struct weston_compositor *ec,
> + int32_t x, int32_t y);
> void
> weston_plane_release(struct weston_plane *plane);
>
> --
> 1.8.3.2
>
> _______________________________________________
> wayland-devel mailing list
> wayland-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/wayland-devel