Commit 0bdd370ab720 ("dri2: hold extra buffer ref during swap") started
increasing pPixmap->refcnt for DRI2BufferFrontLeft, but that gets never
decremented in OMAPDRI2DestroyBuffer.

Let's fix the issue by pairing the increment with a decrement in
OMAPDRI2DestroyBuffer. Otherwise we get a segfault after rotating an
sgx accelerated opengl es app and then terminating it.

Fixes: 0bdd370ab720 ("dri2: hold extra buffer ref during swap")
Cc: Ivaylo Dimitrov <ivo.g.dimitrov...@gmail.com>
Cc: Laurent Pinchart <laurent.pinch...@ideasonboard.com>
Cc: Matthijs van Duin <matthijsvand...@gmail.com>
Cc: Merlijn Wajer <merl...@wizzup.org>
Cc: Rob Clark <robdcl...@chromium.org>
Cc: Sebastian Reichel <s...@kernel.org>
Cc: Tomi Valkeinen <tomi.valkei...@ti.com>
Signed-off-by: Tony Lindgren <t...@atomide.com>
---
 src/omap_dri2.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/omap_dri2.c b/src/omap_dri2.c
--- a/src/omap_dri2.c
+++ b/src/omap_dri2.c
@@ -316,7 +316,11 @@ OMAPDRI2DestroyBuffer(DrawablePtr pDraw, DRI2BufferPtr 
buffer)
                pPriv->pThirdBuffer = NULL;
        }
 
-       pScreen->DestroyPixmap(buf->pPixmap);
+       /* Pair refcount increment done in OMAPDRI2CreateBuffer */
+       if (buffer->attachment == DRI2BufferFrontLeft && buf->pPixmap->refcnt)
+               buf->pPixmap->refcnt--;
+       else
+               pScreen->DestroyPixmap(buf->pPixmap);
 
        free(buf);
 }
-- 
2.25.0
_______________________________________________
xorg-devel@lists.x.org: X.Org development
Archives: http://lists.x.org/archives/xorg-devel
Info: https://lists.x.org/mailman/listinfo/xorg-devel

Reply via email to