It looks like the bug is in red_worker::destroy_surface_wait. destroy_surface_wait, doesn't really assure that all the references to the surface were destroyed. Specifically, if there are drawables that depends on this surface in the pipe, they stay in the pipe, and also all other drawables that belong to this surface and precede them; see red_worker::red_clear_surface_drawables_from_pipe. The same bug can also occur in handle_dev_destroy_surfaces We need to wait till the last item in the pipe that depends on the surface is sent.
This was commited as 27f18287e899ff90fc0ee5ab697a8697d85953b2
I just got this assert failure with the upstream Spice server (071647780dbda4fabf31e6b09940c14b62313913) I wasn't doing anything special, just started qemu, connect using remote-viewer in fullscreen with 2 monitors. Guest: RHEL6.7
Created attachment 117201 [details] qemu output I will try reproduce and get better backtrace
-- GitLab Migration Automatic Message -- This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity. You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/spice/spice-server/issues/7.
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.