On Thu, 24 Mar 2011 19:31:03 +0100, Julien Cristau <jcris...@debian.org> wrote:

> This will cause a double free as the blit_fallback path does it too.

Argh! So we need to check before we reference the buffers and set
swap_info to NULL. This code is too twisty...

@@ -955,11 +960,16 @@ I830DRI2ScheduleSwap(ClientPtr client, DrawablePtr draw, 
DRI2BufferPtr front,
        swap_info->event_data = data;
        swap_info->front = front;
        swap_info->back = back;
+
+       if (!i830_dri2_add_frame_event(swap_info)) {
+           free(swap_info);
+           swap_info = NULL;
+           goto blit_fallback;
+       }
+
        I830DRI2ReferenceBuffer(front);
        I830DRI2ReferenceBuffer(back);
 
-       i830_dri2_add_frame_event(swap_info);
-
        /* Get current count */
        vbl.request.type = DRM_VBLANK_RELATIVE;
        if (pipe > 0)

-- 
keith.pack...@intel.com

Attachment: pgpIBpvlcMprb.pgp
Description: PGP signature

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/intel-gfx

Reply via email to