[Bug 73856] Server terminates with sna_do_copy: damage box is beyond the drawable

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=73856

--- Comment #5 from Chris Wilson <chris at chris-wilson.co.uk> ---
Ok, I think this is the culprit:

diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c
index 4a2b614..b1744ae 100644
--- a/src/sna/sna_accel.c
+++ b/src/sna/sna_accel.c
@@ -4021,7 +4021,8 @@ static bool must_check sna_gc_move_to_cpu(GCPtr gc,
        } else
                changes &= ~GCClipMask;

-       if (changes || drawable->serialNumber != sgc->serial) {
+       if (changes || drawable->serialNumber != (sgc->serial &
DRAWABLE_SERIAL_BITS)) {
+               long tmp = gc->serialNumber;
                gc->serialNumber = sgc->serial;

                if (fb_gc(gc)->bpp != drawable->bitsPerPixel) {
@@ -4042,8 +4043,7 @@ static bool must_check sna_gc_move_to_cpu(GCPtr gc,
                }

                fbValidateGC(gc, changes, drawable);
-
-               sgc->serial = drawable->serialNumber;
+               gc->serialNumber = tmp;
        }
        sgc->changes = 0;

@@ -15733,6 +15733,7 @@ sna_validate_gc(GCPtr gc, unsigned long changes,
DrawablePtr drawable)
        assert(RegionNil(gc->pCompositeClip) || gc->pCompositeClip->extents.y2
- drawable->y <= drawable->height);

        sna_gc(gc)->changes |= changes;
+       sna_gc(gc)->serial = gc->serialNumber;
 }

 static const GCFuncs sna_gc_funcs = {

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/intel-gfx-bugs/attachments/20140121/bf77e5b1/attachment.html>