From 9236c58252511d3e985cbd4c022a202c36314e3c Mon Sep 17 00:00:00 2001 From: Chris Wilson Date: Thu, 26 Nov 2020 20:15:58 +0000 Subject: sna: Defer fbGetWindowPixmap() for sna_composite Mike Lothian ran into a surprising situation where compScreenUpdate was calling CompositePicture without a pixmap attached to the destination Window, and so we found ourselves chasing a NULL PixmapPtr. #1 to_sna_from_pixmap (pixmap=0x0) at sna.h:521 #2 sna_composite (op=, src=0x55b3346c1420, mask=0x0, dst=0x55b3346c1d50, src_x=, src_y=, mask_x=0, mask_y=0, dst_x=0, dst_y=0, width=3840, height=2160) at sna_composite.c:652 #3 0x000055b33202c208 in damageComposite (op=, pSrc=0x55b3346c1420, pMask=0x0, pDst=0x55b3346c1d50, xSrc=, ySrc=, xMask=0, yMask=0, xDst=0, yDst=0, width=3840, height=2160) at damage.c:513 #4 0x000055b33201820c in CompositePicture (op=, op@entry=1 '\001', pSrc=pSrc@entry=0x55b3346c1420, pMask=pMask@entry=0x0, pDst=pDst@entry=0x55b3346c1d50, xSrc=xSrc@entry=0, ySrc=ySrc@entry=0, xMask=0, yMask=0, xDst=0, yDst=0, width=3840, height=2160) at picture.c:1547 #5 0x000055b331fc85d3 in compWindowUpdateAutomatic ( pWin=pWin@entry=0x55b3343a6bc0) at compwindow.c:705 #6 0x000055b331fca029 in compPaintWindowToParent (pWin=pWin@entry=0x55b3343a6bc0) at compwindow.c:729 #7 0x000055b331fc9fbb in compPaintChildrenToWindow (pWin=0x55b333e77b50) at compwindow.c:744 #8 0x000055b331fca59f in compScreenUpdate (pClient=, closure=) at compalloc.c:57 #9 0x000055b331f3abf4 in ProcessWorkQueue () at dixutils.c:536 #10 0x000055b3320aaa51 in WaitForSomething (are_ready=) at WaitFor.c:192 #11 0x000055b331f361a9 in Dispatch () at dispatch.c:421 #12 0x000055b331f39cec in dix_main (argc=13, argv=0x7ffcf273f538, envp=) at main.c:276 #13 0x000055b331f247de in main (argc=, argv=, envp=) at stubmain.c:34 Fortuitously, that drawable was also fully clipped so that it took an early exit and so we can hide the segfault by delaying querying the pixmap until after the clip check. The ongoing mystery is how we ended up in that state in the first place. Closes: https://gitlab.freedesktop.org/xorg/driver/xf86-video-intel/-/issues/204 Signed-off-by: Chris Wilson --- src/sna/sna_composite.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/src/sna/sna_composite.c b/src/sna/sna_composite.c index 3a8e8684..f7a44d56 100644 --- a/src/sna/sna_composite.c +++ b/src/sna/sna_composite.c @@ -649,15 +649,15 @@ sna_composite(CARD8 op, CARD16 width, CARD16 height) { PixmapPtr pixmap = get_drawable_pixmap(dst->pDrawable); - struct sna *sna = to_sna_from_pixmap(pixmap); struct sna_pixmap *priv; struct sna_composite_op tmp; RegionRec region; + struct sna *sna; int dx, dy; DBG(("%s(pixmap=%ld, op=%d, src=%ld+(%d, %d), mask=%ld+(%d, %d), dst=%ld+(%d, %d)+(%d, %d), size=(%d, %d)\n", __FUNCTION__, - pixmap->drawable.serialNumber, op, + pixmap ? pixmap->drawable.serialNumber : 0, op, get_picture_id(src), src_x, src_y, get_picture_id(mask), mask_x, mask_y, get_picture_id(dst), dst_x, dst_y, @@ -672,8 +672,7 @@ sna_composite(CARD8 op, if (op == PictOpClear) { DBG(("%s: discarding source and mask for clear\n", __FUNCTION__)); mask = NULL; - if (sna->clear) - src = sna->clear; + src = NULL; } if (!sna_compute_composite_region(®ion, @@ -694,11 +693,6 @@ sna_composite(CARD8 op, if (NO_COMPOSITE) goto fallback; - if (wedged(sna)) { - DBG(("%s: fallback -- wedged\n", __FUNCTION__)); - goto fallback; - } - if (!can_render_to_picture(dst)) { DBG(("%s: fallback due to unhandled picture\n", __FUNCTION__)); goto fallback; @@ -711,6 +705,15 @@ sna_composite(CARD8 op, goto fallback; } + sna = to_sna_from_pixmap(pixmap); + if (wedged(sna)) { + DBG(("%s: fallback -- wedged\n", __FUNCTION__)); + goto fallback; + } + + if (op == PictOpClear) + src = sna->clear; + if (use_cpu(pixmap, priv, op, width, height) && !picture_is_gpu(sna, src, PREFER_GPU_RENDER) && !picture_is_gpu(sna, mask, PREFER_GPU_RENDER)) { -- cgit v1.2.3