From 1304b8b27cb12c803c4f51f04cb6f9d508b82c69 Mon Sep 17 00:00:00 2001 From: Aaron Plattner Date: Fri, 28 May 2010 09:35:54 -0700 Subject: [PATCH] Fix pixmap validation in miDbePositionWindow. miDbePositionWindow allocates two pixmaps: a front buffer, and a back buffer. If the buffers are supposed to be initialized, it validates a GC against the front buffer, then uses it to fill and/or copy both the front buffer *and* the back buffer, without revalidating. If the acceleration architecture needs different GC funcs for the two pixmaps -- for example if allocation of the front buffer exhausted video memory -- then this can cause crashes because the GC is not validated for the back buffer pixmap. Fix this by performing the rendering for the front buffer first, then revalidating against the back buffer before performing the back buffer rendering. Signed-off-by: Aaron Plattner Reviewed-by: Jamey Sharp Signed-off-by: Keith Packard --- dbe/midbe.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/dbe/midbe.c b/dbe/midbe.c index e47a25355..49689c529 100644 --- a/dbe/midbe.c +++ b/dbe/midbe.c @@ -695,25 +695,33 @@ miDbePositionWindow(WindowPtr pWin, int x, int y) pDbeWindowPrivPriv = MI_DBE_WINDOW_PRIV_PRIV(pDbeWindowPriv); - ValidateGC((DrawablePtr)pFrontBuffer, pGC); /* I suppose this could avoid quite a bit of work if * it computed the minimal area required. */ + ValidateGC(&pFrontBuffer->drawable, pGC); if (clear) { (*pGC->ops->PolyFillRect)((DrawablePtr)pFrontBuffer, pGC, 1, &clearRect); - (*pGC->ops->PolyFillRect)((DrawablePtr)pBackBuffer , pGC, 1, - &clearRect); - } - - /* Copy the contents of the old DBE pixmaps to the new pixmaps. */ + } + /* Copy the contents of the old front pixmap to the new one. */ if (pWin->bitGravity != ForgetGravity) { (*pGC->ops->CopyArea)((DrawablePtr)pDbeWindowPrivPriv->pFrontBuffer, (DrawablePtr)pFrontBuffer, pGC, sourcex, sourcey, savewidth, saveheight, destx, desty); + } + + ValidateGC(&pBackBuffer->drawable, pGC); + if (clear) + { + (*pGC->ops->PolyFillRect)((DrawablePtr)pBackBuffer , pGC, 1, + &clearRect); + } + /* Copy the contents of the old back pixmap to the new one. */ + if (pWin->bitGravity != ForgetGravity) + { (*pGC->ops->CopyArea)((DrawablePtr)pDbeWindowPrivPriv->pBackBuffer, (DrawablePtr)pBackBuffer, pGC, sourcex, sourcey, savewidth, saveheight, destx, desty);