still crashingglz

looks like the image came also from Drawable... so now keeping also
the drawable spice-server asserts failure when resolution is changed
as drawables are still retained.

not clear the previous conditions :(

so possibly the reason not to keep a reference to drawable and the
link in drawable... one possible solution would be a reference in
SpiceImage!

NO! the problem is that old code was so complicated to handle
freeing release, current one assume glz dictionary release resources
but actually the problem is that nobody release them and guest crash
when no resource are available!

2 files changed, 12 insertions, 5 deletions

diff --git a/server/dcc.c b/server/dcc.c
index fa2d40ae..d8843c0b 100644
--- a/server/dcc.c
+++ b/server/dcc.c
@@ -485,6 +485,7 @@ void dcc_stop(DisplayChannelClient *dcc)
 
     pixmap_cache_unref(dcc->pixmap_cache);
     dcc->pixmap_cache = NULL;
+    image_encoders_free_glz_contextes_to_free(&dcc->encoders);
     dcc_palette_cache_reset(dcc);
     free(dcc->send_data.free_list.res);
     dcc_destroy_stream_agents(dcc);
diff --git a/server/image-encoders.c b/server/image-encoders.c
index ec9abe82..7415c40d 100644
--- a/server/image-encoders.c
+++ b/server/image-encoders.c
@@ -55,7 +55,8 @@ struct GlzContext {
     //struct DisplayChannel *dc;
     ImageEncoderSharedData *shared;
     /** hold a reference to this object */
-    RedDrawable *red_drawable;
+    RedDrawable *red_drawable_;
+    Drawable *drawable;
 };
 
 static void encoder_data_init(EncoderData *data);
@@ -363,14 +364,15 @@ static void image_encoders_init_lz(ImageEncoders *enc)
 
 static void glz_usr_free_image(GlzEncoderUsrContext *usr, GlzUsrImageContext *image)
 {
-    printf("Glz free image called\n");
     GlzData *lz_data = (GlzData *)usr;
     GlzContext *glz_context = (GlzContext*) image;
     ImageEncoderSharedData *drawable_shared = glz_context->shared;
     ImageEncoders *this_enc = SPICE_CONTAINEROF(lz_data, ImageEncoders, glz_data);
     if (this_enc->shared_data == drawable_shared || drawable_shared == NULL) {
+        printf("Glz free image called - freeing, from %p\n", drawable_shared);
         dcc_free_glz_context(glz_context);
     } else {
+        printf("Glz free image called - appending to %p\n", drawable_shared);
         /* The glz dictionary is shared between all DisplayChannelClient
          * instances that belong to the same client, and glz_usr_free_image
          * can be called by the dictionary code
@@ -503,7 +505,8 @@ static void dcc_free_glz_context(GlzContext *instance)
         ring_remove(&instance->free_link);
     }
 
-    red_drawable_unref(instance->red_drawable);
+    red_drawable_unref(instance->red_drawable_);
+    drawable_unref(instance->drawable);
     if (shared)
         shared->glz_drawable_count--;
     g_atomic_int_dec_and_test(&glz_contextes_global_count);
@@ -1017,13 +1020,16 @@ int image_encoders_compress_lz4(ImageEncoders *enc, SpiceImage *dest,
 gint glz_contextes_global_count = 0;
 /* allocates new instance and adds it to instances in the given drawable.
    NOTE - the caller should set the glz_instance returned by the encoder by itself.*/
-static GlzContext *glz_context_new(ImageEncoders *enc, RedDrawable *red_drawable)
+static GlzContext *glz_context_new(ImageEncoders *enc, Drawable *drawable)
 {
     GlzContext *ret = spice_new0(GlzContext, 1);
+    ring_item_init(&ret->glz_context_link);
     ring_item_init(&ret->free_link);
     ret->context = NULL;
     ret->shared = enc->shared_data;
-    ret->red_drawable = red_drawable_ref(red_drawable);
+    ret->red_drawable_ = red_drawable_ref(drawable->red_drawable);
+    ret->drawable = drawable;
+    drawable->refs++;
     g_atomic_int_inc(&glz_contextes_global_count);
 
     return ret;