-
Committer:
Tarmac
-
Author(s):
Sam Spilsbury
-
Date:
2012-09-18 07:27:23 UTC
-
mfrom:
(3375.1.5 compiz)
-
Revision ID:
tarmac-20120918072723-eumu2mqjd01m9i70
Check that pixmaps which aren't managed by us actually exist before binding.
It was possible for there to be a race condition for a pixmap to become
invalid on the server side if the client which did have control over thier
lifecycle freed them before we were done with them or disconnected. Drivers
have normally handled this condition by reading the contents of the undefined
memory directly without an error, however drivers such as LLVMpipe will
effectively dereference an invalid pointer and crash when you do this.
LP: #927168:
compiz crashed with SIGSEGV in
memmove() from
drisw_update_tex_buffer() from
dri_set_tex_buffer2() from
drisw_bind_tex_image() from
__glXBindTexImageEXT() from
TfpTexture::enable()
Most of the time we don't need to employ this check. Its only when we know
that we don't control the lifecycle of a pixmap that race conditions
such as these can occur.. Fixes: https://bugs.launchpad.net/bugs/927168. Approved by Daniel van Vugt, jenkins.