[Mesa-dev] [Bug 54372] GLX_INTEL_swap_event crashes driver when swapping window buffers

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=54372

--- Comment #9 from danmanj at gmail.com ---
Attached is a backtrace from the crash with the 10.1.4 glx libs.

The same patch attached here still fixes the crash.

It would take me days to produce a small test program for you. My program is
quite complex.

Let me give you my take on what is happening <plus 2 years of foggy memmory>.

A bufferswap event has been generated and the app process has received it.

DRI2 WireToEvent is supposed to translate the serialized event into a
memory-resident XEvent struct.

DRI2WireToEvent looks for a GLX Drawable that matches the input event with
GetGLXDrawable. It needs to do this just in case there has been an overflow in
the swap count to do basic ccounting <apparently>.

UNEXPECTEDLY GetGLXDrawable returns NULL. This is allowed. If somebody sends
you a bogus XEvent you SHOULD NOT CRASH.

DRI2WireToEvent doesn't bother checking if the pointer is NULL. Dereferences
it, and CRASH occurs.

My opinion: Even if you decide there is a separate bug causing the NULL return
you still need this patch. As things stand, any random delayed XEvent can crash
any glx program.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/mesa-dev/attachments/20140607/2b57c93c/attachment.html>