From d8342156dda225179cfec781d93bd84d0da88f9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kristian=20H=C3=B8gsberg?= <krh@redhat.com>
Date: Fri, 17 Jul 2009 12:20:06 -0400
Subject: [PATCH] Change DRI2SwapComplete() to not take a DrawablePtr, which
 may have been freed

---
 hw/xfree86/dri2/dri2.c | 15 +++++++++++----
 hw/xfree86/dri2/dri2.h |  7 ++++---
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/hw/xfree86/dri2/dri2.c b/hw/xfree86/dri2/dri2.c
index fc1d25603..ee857ebdb 100644
--- a/hw/xfree86/dri2/dri2.c
+++ b/hw/xfree86/dri2/dri2.c
@@ -394,7 +394,7 @@ DRI2SwapBuffers(DrawablePtr pDraw)
 	return BadValue;
 
     if (DRI2FlipCheck(pDraw) &&
-	(*ds->SwapBuffers)(pDraw, pDestBuffer, pSrcBuffer))
+	(*ds->SwapBuffers)(pDraw, pDestBuffer, pSrcBuffer, pPriv))
     {
 	pPriv->swapPending = TRUE;
 	return Success;
@@ -430,15 +430,18 @@ DRI2WaitSwap(ClientPtr client, DrawablePtr pDrawable)
 }
 
 void
-DRI2SwapComplete(DrawablePtr pDrawable)
+DRI2SwapComplete(void *data)
 {
-    DRI2DrawablePtr pPriv = DRI2GetDrawable(pDrawable);
+    DRI2DrawablePtr pPriv = data;
 
     if (pPriv->blockedClient)
 	AttendClient(pPriv->blockedClient);
 
     pPriv->swapPending = FALSE;
     pPriv->blockedClient = NULL;
+
+    if (pPriv->refCount == 0)
+	xfree(pPriv);
 }
 
 void
@@ -466,7 +469,11 @@ DRI2DestroyDrawable(DrawablePtr pDraw)
 	xfree(pPriv->buffers);
     }
 
-    xfree(pPriv);
+    /* If the window is destroyed while we have a swap pending, don't
+     * actually free the priv yet.  We'll need it in the DRI2SwapComplete()
+     * callback and we'll free it there once we're done. */
+    if (!pPriv->swapPending)
+	xfree(pPriv);
 
     if (pDraw->type == DRAWABLE_WINDOW)
     {
diff --git a/hw/xfree86/dri2/dri2.h b/hw/xfree86/dri2/dri2.h
index 8cf23085e..42bdb0978 100644
--- a/hw/xfree86/dri2/dri2.h
+++ b/hw/xfree86/dri2/dri2.h
@@ -60,7 +60,8 @@ typedef void		(*DRI2CopyRegionProcPtr)(DrawablePtr pDraw,
 						 DRI2BufferPtr pSrcBuffer);
 typedef Bool		(*DRI2SwapBuffersProcPtr)(DrawablePtr pDraw,
 						  DRI2BufferPtr pFrontBuffer,
-						  DRI2BufferPtr pBackBuffer);
+						  DRI2BufferPtr pBackBuffer,
+						  void *data);
 
 typedef void		(*DRI2WaitProcPtr)(WindowPtr pWin,
 					   unsigned int sequence);
@@ -140,8 +141,8 @@ extern _X_EXPORT DRI2BufferPtr *DRI2GetBuffersWithFormat(DrawablePtr pDraw,
 	int *width, int *height, unsigned int *attachments, int count,
 	int *out_count);
 
-extern _X_EXPORT int DRI2SwapBuffers(DrawablePtr pDraw);
+extern _X_EXPORT int DRI2SwapBuffers(DrawablePtr pDrawable);
 extern _X_EXPORT Bool DRI2WaitSwap(ClientPtr client, DrawablePtr pDrawable);
-extern _X_EXPORT void DRI2SwapComplete(DrawablePtr pDrawable);
+extern _X_EXPORT void DRI2SwapComplete(void *data);
 
 #endif