Bug 35707

Summary:	Crash on termination - reference to freed damage of Sprite screen
Product:	xorg	Reporter:	Bryan Henderson <bryanh>
Component:	Server/General	Assignee:	Xorg Project Team <xorg-team>
Status:	RESOLVED FIXED	QA Contact:	Xorg Project Team <xorg-team>
Severity:	normal
Priority:	medium
Version:	7.5 (2009.10)
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:

Description Bryan Henderson 2011-03-26 14:53:59 UTC

miSprintCloseScreen() destroys a damage that is still registered, thus corrupting the damage list.  A subsequent reference to the list causes a SIGSEGV.

Adding the following immediately before "DamageDestroy(pScreenPriv->pDamage)" in miSpriteCloseScreen (file mi/misprite.c), may be the fix.  It seems to work for me.

  miSpriteDisableDamage(pScreen, pScreenPriv);

I saw this on xorg-server 1.7.1.

Comment 1 Adam Jackson 2018-06-13 17:06:04 UTC

Should have been fixed by:

commit d08966227e7d567df8d26eebc80f35f886e59a4a
Author: Adam Jackson <ajax@redhat.com>
Date:   Mon Aug 26 14:03:51 2013 -0400

    damage: Simplify DamageUnregister
    
    You can only register one drawable on a given damage, so there's no
    reason to require the caller to specify the drawable, the damage is
    enough.  The implementation would do something fairly horrible if you
    _did_ pass mismatched drawable and damage, so let's avoid the problem
    entirely.
    
    v2: Simplify xf86RotateDestroy even more [anholt]
    
    Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
    Reviewed-by: Eric Anholt <eric@anholt.net>
    Signed-off-by: Adam Jackson <ajax@redhat.com>

commit 28708a045de7d9043d20fb06b61c44a46eb5526b
Author: Adam Jackson <ajax@redhat.com>
Date:   Mon Aug 26 13:52:14 2013 -0400

    damage: Implicitly unregister on destroy
    
    There's no reason not to, and it simplifies quite a few callers.
    
    Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
    Reviewed-by: Eric Anholt <eric@anholt.net>
    Signed-off-by: Adam Jackson <ajax@redhat.com>

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.