snapshot: Perform the cow under a mutex

In order to prevent a race between concurrent destroy and use in another
thread, we need to acquire a reference to the snapshot->target under a
mutex. Whilst we hold that reference, it prevents the internal destroy
mechanism from freeing the memory we are using (if we have a pointer to
the original surface) and the client drops their final reference.

Oh boy, talk about opening a can of worms...

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

1 files changed, 2 insertions, 0 deletions

diff --git a/src/cairo-surface-snapshot-private.h b/src/cairo-surface-snapshot-private.h
index 4c3369ba..58bee7b4 100644
--- a/src/cairo-surface-snapshot-private.h
+++ b/src/cairo-surface-snapshot-private.h
@@ -36,12 +36,14 @@
 #ifndef CAIRO_SURFACE_SNAPSHOT_PRIVATE_H
 #define CAIRO_SURFACE_SNAPSHOT_PRIVATE_H
 
+#include "cairo-mutex-private.h"
 #include "cairo-surface-private.h"
 #include "cairo-surface-backend-private.h"
 
 struct _cairo_surface_snapshot {
     cairo_surface_t base;
 
+    cairo_mutex_t mutex;
     cairo_surface_t *target;
     cairo_surface_t *clone;
 };