It is necessary to add the following line to _cairo_damage_add_boxes function:
@@ -128,6 +128,7 @@ _cairo_damage_add_boxes(cairo_damage_t *damage,
chunk->count = count;
damage->tail->next = chunk;
+ damage->tail = chunk;
damage->remain = size - count;
memcpy (damage->tail->base, boxes + n,
Otherwise the "tail" of the single list is not updated but the "remain" field is. That leads to either crash or memory corruption (which I encountered).
Author: Chris Wilson <email@example.com>
Date: Sat Aug 11 19:28:21 2012 +0100
damage: Update tail pointer after allocating new chunk
Reported and based on a patch by fmot.fics
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct.