Merge lp:~compiz-team/compiz/compiz.fix_927168 into lp:compiz/0.9.8
Status: | Merged |
---|---|
Approved by: | Daniel van Vugt |
Approved revision: | 3380 |
Merged at revision: | 3376 |
Proposed branch: | lp:~compiz-team/compiz/compiz.fix_927168 |
Merge into: | lp:compiz/0.9.8 |
Diff against target: |
736 lines (+489/-40) 14 files modified
plugins/copytex/src/copytex.cpp (+5/-4) plugins/copytex/src/copytex.h (+5/-4) plugins/decor/src/decor.cpp (+3/-1) plugins/opengl/CMakeLists.txt (+4/-0) plugins/opengl/include/opengl/opengl.h (+1/-1) plugins/opengl/include/opengl/pixmapsource.h (+40/-0) plugins/opengl/include/opengl/texture.h (+10/-5) plugins/opengl/src/glxtfpbind/CMakeLists.txt (+31/-0) plugins/opengl/src/glxtfpbind/include/glx-tfp-bind.h (+53/-0) plugins/opengl/src/glxtfpbind/src/glx-tfp-bind.cpp (+53/-0) plugins/opengl/src/glxtfpbind/tests/CMakeLists.txt (+24/-0) plugins/opengl/src/glxtfpbind/tests/test-opengl-glx-tfp-bind.cpp (+157/-0) plugins/opengl/src/privatetexture.h (+16/-12) plugins/opengl/src/texture.cpp (+87/-13) |
To merge this branch: | bzr merge lp:~compiz-team/compiz/compiz.fix_927168 |
Related bugs: |
Reviewer | Review Type | Date Requested | Status |
---|---|---|---|
Daniel van Vugt | Approve | ||
jenkins (community) | continuous-integration | Approve | |
Review via email: mp+124709@code.launchpad.net |
Commit message
Check that pixmaps which aren't managed by us actually exist before binding.
It was possible for there to be a race condition for a pixmap to become
invalid on the server side if the client which did have control over thier
lifecycle freed them before we were done with them or disconnected. Drivers
have normally handled this condition by reading the contents of the undefined
memory directly without an error, however drivers such as LLVMpipe will
effectively dereference an invalid pointer and crash when you do this.
LP: #927168:
compiz crashed with SIGSEGV in
memmove() from
drisw_update_
dri_set_
drisw_bind_
__glXBindTexIma
TfpTexture:
Most of the time we don't need to employ this check. Its only when we know
that we don't control the lifecycle of a pixmap that race conditions
such as these can occur.
Description of the change
== Change:
Check that pixmaps which aren't managed by us actually exist before binding.
It was possible for there to be a race condition for a pixmap to become
invalid on the server side if the client which did have control over thier
lifecycle freed them before we were done with them or disconnected. Drivers
have normally handled this condition by reading the contents of the undefined
memory directly without an error, however drivers such as LLVMpipe will
effectively dereference an invalid pointer and crash when you do this.
Eg:
compiz crashed with SIGSEGV in memmove() from drisw_update_
Most of the time we don't need to employ this check. Its only when we know
that we don't control the lifecycle of a pixmap that race conditions
such as these can occurr.
== Test
Five unit tests included. Testing that this fix can be effective can be done as follows:
1. Start compiz with llvmpipe (eg LIBGL_ALWAYS_
2. Set a breakpoint on TfpTexture:
3. Hover over the decoration buttons so as to cause a damage event (and a require rebind)
4. Once the breakpoint is hit, run killall -9 gtk-window-
5. Continue the program. It shouldn't crash.
PASSED: Continuous integration, rev:3379 jenkins. qa.ubuntu. com/job/ compiz- ci/80/ jenkins. qa.ubuntu. com/job/ compiz- ci/./build= pbuilder, distribution= quantal, flavor= amd64/80/ console
http://
Executed test runs:
SUCCESS: http://