It is necessary to add the following line to _cairo_damage_add_boxes function:
@@ -128,6 +128,7 @@ _cairo_damage_add_boxes(cairo_damage_t *damage,
chunk->count = count;
damage->tail->next = chunk;
+ damage->tail = chunk;
damage->remain = size - count;
memcpy (damage->tail->base, boxes + n,
Otherwise the "tail" of the single list is not updated but the "remain" field is. That leads to either crash or memory corruption (which I encountered).
Author: Chris Wilson <email@example.com>
Date: Sat Aug 11 19:28:21 2012 +0100
damage: Update tail pointer after allocating new chunk
Reported and based on a patch by fmot.fics
on Dec 02, 2016 at 22:12:46.
(provided by the Example extension).