From 5b9075f5b20cb2830f4b0a35c381167133f6f3b9c1010c87326be4fdfb655fe5 Mon Sep 17 00:00:00 2001 From: OBS User unknown Date: Thu, 12 Apr 2007 16:22:13 +0000 Subject: [PATCH] OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/xorg-x11-server?expand=0&rev=23 --- Mesa-6.5.2-fix_radeon_cliprect.diff | 237 +++++++++++++++ bug-211314_mesa-refcount-memleak-fixes.diff | 316 ++++++++++++++++++++ bug-259290_trapfault.diff | 81 +++++ xorg-server-1.2.99.903.tar.bz2 | 3 - xorg-server-1.2.99.905.tar.bz2 | 3 + xorg-x11-server.changes | 39 +++ xorg-x11-server.spec | 31 +- 7 files changed, 705 insertions(+), 5 deletions(-) create mode 100644 Mesa-6.5.2-fix_radeon_cliprect.diff create mode 100644 bug-211314_mesa-refcount-memleak-fixes.diff create mode 100644 bug-259290_trapfault.diff delete mode 100644 xorg-server-1.2.99.903.tar.bz2 create mode 100644 xorg-server-1.2.99.905.tar.bz2 diff --git a/Mesa-6.5.2-fix_radeon_cliprect.diff b/Mesa-6.5.2-fix_radeon_cliprect.diff new file mode 100644 index 0000000..760b093 --- /dev/null +++ b/Mesa-6.5.2-fix_radeon_cliprect.diff @@ -0,0 +1,237 @@ +unchanged: +--- a/src/mesa/drivers/dri/radeon/radeon_context.c ++++ b/src/mesa/drivers/dri/radeon/radeon_context.c +@@ -594,12 +594,14 @@ radeonMakeCurrent( __DRIcontextPrivate * + driDrawableInitVBlank( driDrawPriv, newCtx->vblank_flags, + &newCtx->vbl_seq ); + } +- +- if ( (newCtx->dri.drawable != driDrawPriv) +- || (newCtx->dri.readable != driReadPriv) ) { ++ ++ newCtx->dri.readable = driReadPriv; ++ ++ if ( (newCtx->dri.drawable != driDrawPriv) || ++ newCtx->lastStamp != driDrawPriv->lastStamp ) { + newCtx->dri.drawable = driDrawPriv; +- newCtx->dri.readable = driReadPriv; + ++ radeonSetCliprects(newCtx); + radeonUpdateWindow( newCtx->glCtx ); + radeonUpdateViewportOffset( newCtx->glCtx ); + } +unchanged: +--- a/src/mesa/drivers/dri/radeon/radeon_lock.c ++++ b/src/mesa/drivers/dri/radeon/radeon_lock.c +@@ -96,7 +96,6 @@ void radeonGetLock( radeonContextPtr rme + radeonSetCliprects( rmesa ); + radeonUpdateViewportOffset( rmesa->glCtx ); + driUpdateFramebufferSize(rmesa->glCtx, drawable); +- rmesa->lastStamp = drawable->lastStamp; + } + + RADEON_STATECHANGE( rmesa, ctx ); +unchanged: +--- a/src/mesa/drivers/dri/radeon/radeon_state.c ++++ b/src/mesa/drivers/dri/radeon/radeon_state.c +@@ -1675,6 +1675,8 @@ void radeonSetCliprects( radeonContextPt + + if (rmesa->state.scissor.enabled) + radeonRecalcScissorRects( rmesa ); ++ ++ rmesa->lastStamp = drawable->lastStamp; + } + + +unchanged: +--- b/src/mesa/drivers/dri/r200/r200_context.c ++++ b/src/mesa/drivers/dri/r200/r200_context.c +@@ -673,11 +673,13 @@ + &newCtx->vbl_seq ); + } + ++ newCtx->dri.readable = driReadPriv; ++ + if ( newCtx->dri.drawable != driDrawPriv || +- newCtx->dri.readable != driReadPriv ) { ++ newCtx->lastStamp != driDrawPriv->lastStamp ) { + newCtx->dri.drawable = driDrawPriv; +- newCtx->dri.readable = driReadPriv; + ++ r200SetCliprects(newCtx); + r200UpdateWindow( newCtx->glCtx ); + r200UpdateViewportOffset( newCtx->glCtx ); + } +unchanged: +--- b/src/mesa/drivers/dri/r200/r200_lock.c ++++ b/src/mesa/drivers/dri/r200/r200_lock.c +@@ -92,13 +92,9 @@ + + if ( rmesa->lastStamp != drawable->lastStamp ) { + r200UpdatePageFlipping( rmesa ); +- if (rmesa->glCtx->DrawBuffer->_ColorDrawBufferMask[0] == BUFFER_BIT_BACK_LEFT) +- r200SetCliprects( rmesa, GL_BACK_LEFT ); +- else +- r200SetCliprects( rmesa, GL_FRONT_LEFT ); ++ r200SetCliprects( rmesa ); + r200UpdateViewportOffset( rmesa->glCtx ); + driUpdateFramebufferSize(rmesa->glCtx, drawable); +- rmesa->lastStamp = drawable->lastStamp; + } + + R200_STATECHANGE( rmesa, ctx ); +unchanged: +--- b/src/mesa/drivers/dri/r200/r200_state.c ++++ b/src/mesa/drivers/dri/r200/r200_state.c +@@ -1691,6 +1691,11 @@ + #define SUBPIXEL_X 0.125 + #define SUBPIXEL_Y 0.125 + ++ ++/** ++ * Called when window size or position changes or viewport or depth range ++ * state is changed. We update the hardware viewport state here. ++ */ + void r200UpdateWindow( GLcontext *ctx ) + { + r200ContextPtr rmesa = R200_CONTEXT(ctx); +@@ -1843,19 +1848,18 @@ + } + + +-void r200SetCliprects( r200ContextPtr rmesa, GLenum mode ) ++/* ++ * Set up the cliprects for either front or back-buffer drawing. ++ */ ++void r200SetCliprects( r200ContextPtr rmesa ) + { + __DRIdrawablePrivate *const drawable = rmesa->dri.drawable; + __DRIdrawablePrivate *const readable = rmesa->dri.readable; + GLframebuffer *const draw_fb = (GLframebuffer*) drawable->driverPrivate; + GLframebuffer *const read_fb = (GLframebuffer*) readable->driverPrivate; + +- switch ( mode ) { +- case GL_FRONT_LEFT: +- rmesa->numClipRects = drawable->numClipRects; +- rmesa->pClipRects = drawable->pClipRects; +- break; +- case GL_BACK_LEFT: ++ if (draw_fb->_ColorDrawBufferMask[0] ++ == BUFFER_BIT_BACK_LEFT) { + /* Can't ignore 2d windows if we are page flipping. + */ + if ( drawable->numBackClipRects == 0 || rmesa->doPageFlip ) { +@@ -1866,11 +1870,12 @@ + rmesa->numClipRects = drawable->numBackClipRects; + rmesa->pClipRects = drawable->pBackClipRects; + } +- break; +- default: +- fprintf(stderr, "bad mode in r200SetCliprects\n"); +- return; + } ++ else { ++ /* front buffer (or none, or multiple buffers) */ ++ rmesa->numClipRects = drawable->numClipRects; ++ rmesa->pClipRects = drawable->pClipRects; ++ } + + if ((draw_fb->Width != drawable->w) || (draw_fb->Height != drawable->h)) { + _mesa_resize_framebuffer(rmesa->glCtx, draw_fb, +@@ -1889,6 +1894,8 @@ + + if (rmesa->state.scissor.enabled) + r200RecalcScissorRects( rmesa ); ++ ++ rmesa->lastStamp = drawable->lastStamp; + } + + +@@ -1908,19 +1915,17 @@ + */ + switch ( ctx->DrawBuffer->_ColorDrawBufferMask[0] ) { + case BUFFER_BIT_FRONT_LEFT: +- FALLBACK( rmesa, R200_FALLBACK_DRAW_BUFFER, GL_FALSE ); +- r200SetCliprects( rmesa, GL_FRONT_LEFT ); +- break; + case BUFFER_BIT_BACK_LEFT: + FALLBACK( rmesa, R200_FALLBACK_DRAW_BUFFER, GL_FALSE ); +- r200SetCliprects( rmesa, GL_BACK_LEFT ); + break; + default: +- /* GL_NONE or GL_FRONT_AND_BACK or stereo left&right, etc */ ++ /* 0 (GL_NONE) buffers or multiple color drawing buffers */ + FALLBACK( rmesa, R200_FALLBACK_DRAW_BUFFER, GL_TRUE ); + return; + } + ++ r200SetCliprects( rmesa ); ++ + /* We'll set the drawing engine's offset/pitch parameters later + * when we update other state. + */ +unchanged: +--- a/src/mesa/drivers/dri/r200/r200_state.h ++++ b/src/mesa/drivers/dri/r200/r200_state.h +@@ -44,7 +44,7 @@ extern void r200InitTnlFuncs( GLcontext + + extern void r200UpdateMaterial( GLcontext *ctx ); + +-extern void r200SetCliprects( r200ContextPtr rmesa, GLenum mode ); ++extern void r200SetCliprects( r200ContextPtr rmesa ); + extern void r200RecalcScissorRects( r200ContextPtr rmesa ); + extern void r200UpdateViewportOffset( GLcontext *ctx ); + extern void r200UpdateWindow( GLcontext *ctx ); +only in patch2: +unchanged: +--- b/src/mesa/drivers/dri/r300/radeon_context.c ++++ b/src/mesa/drivers/dri/r300/radeon_context.c +@@ -51,6 +51,7 @@ + #include "radeon_macros.h" + #include "radeon_reg.h" + ++#include "radeon_state.h" + #include "r300_state.h" + + #include "utils.h" +@@ -272,11 +273,13 @@ + &radeon->vbl_seq); + } + ++ radeon->dri.readable = driReadPriv; ++ + if (radeon->dri.drawable != driDrawPriv || +- radeon->dri.readable != driReadPriv) { ++ radeon->lastStamp != driDrawPriv->lastStamp) { + radeon->dri.drawable = driDrawPriv; +- radeon->dri.readable = driReadPriv; + ++ radeonSetCliprects(radeon); + r300UpdateWindow(radeon->glCtx); + r300UpdateViewportOffset(radeon->glCtx); + } +only in patch2: +unchanged: +--- a/src/mesa/drivers/dri/r300/radeon_lock.c ++++ b/src/mesa/drivers/dri/r300/radeon_lock.c +@@ -90,7 +90,6 @@ static void r300RegainedLock(radeonConte + #else + radeonUpdateScissor(radeon->glCtx); + #endif +- radeon->lastStamp = drawable->lastStamp; + } + + if (sarea->ctx_owner != radeon->dri.hwContext) { +only in patch2: +unchanged: +--- a/src/mesa/drivers/dri/r300/radeon_state.c ++++ b/src/mesa/drivers/dri/r300/radeon_state.c +@@ -185,6 +185,8 @@ void radeonSetCliprects(radeonContextPtr + + if (radeon->state.scissor.enabled) + radeonRecalcScissorRects(radeon); ++ ++ radeon->lastStamp = drawable->lastStamp; + } + + diff --git a/bug-211314_mesa-refcount-memleak-fixes.diff b/bug-211314_mesa-refcount-memleak-fixes.diff new file mode 100644 index 0000000..1c73430 --- /dev/null +++ b/bug-211314_mesa-refcount-memleak-fixes.diff @@ -0,0 +1,316 @@ +commit 42aaa548a1020be5d40b3dce9448d8004b1ef947 +Author: Brian +Date: Sun Mar 25 10:39:36 2007 -0600 + + Fix some renderbuffer reference counting issues. Also fixes a mem leak. + +diff --git a/src/mesa/drivers/x11/xm_buffer.c b/src/mesa/drivers/x11/xm_buffer.c +index c1fa233..bb8fe31 100644 +--- a/src/mesa/drivers/x11/xm_buffer.c ++++ b/src/mesa/drivers/x11/xm_buffer.c +@@ -422,18 +422,6 @@ xmesa_delete_framebuffer(struct gl_frame + XMesaDestroyImage( b->rowimage ); + } + +- /* Note that XMesaBuffer renderbuffers normally have a refcount of 2 +- * (creation + binding) so we need to explicitly delete/unbind them here. +- */ +- if (b->frontxrb) { +- _mesa_unreference_renderbuffer((struct gl_renderbuffer **) &b->frontxrb); +- ASSERT(b->frontxrb == NULL); +- } +- if (b->backxrb) { +- _mesa_unreference_renderbuffer((struct gl_renderbuffer **) &b->backxrb); +- ASSERT(b->backxrb == NULL); +- } +- + _mesa_free_framebuffer_data(fb); + _mesa_free(fb); + } +diff --git a/src/mesa/main/fbobject.c b/src/mesa/main/fbobject.c +index f7e870b..fefa14e 100644 +--- a/src/mesa/main/fbobject.c ++++ b/src/mesa/main/fbobject.c +@@ -559,7 +559,7 @@ _mesa_IsRenderbufferEXT(GLuint renderbuf + void GLAPIENTRY + _mesa_BindRenderbufferEXT(GLenum target, GLuint renderbuffer) + { +- struct gl_renderbuffer *newRb, *oldRb; ++ struct gl_renderbuffer *newRb; + GET_CURRENT_CONTEXT(ctx); + + ASSERT_OUTSIDE_BEGIN_END(ctx); +@@ -593,21 +593,16 @@ _mesa_BindRenderbufferEXT(GLenum target, + } + ASSERT(newRb->AllocStorage); + _mesa_HashInsert(ctx->Shared->RenderBuffers, renderbuffer, newRb); ++ newRb->RefCount = 1; /* referenced by hash table */ + } +- newRb->RefCount++; + } + else { + newRb = NULL; + } + +- oldRb = ctx->CurrentRenderbuffer; +- if (oldRb) { +- _mesa_unreference_renderbuffer(&oldRb); +- } +- + ASSERT(newRb != &DummyRenderbuffer); + +- ctx->CurrentRenderbuffer = newRb; ++ _mesa_reference_renderbuffer(&ctx->CurrentRenderbuffer, newRb); + } + + +@@ -632,14 +627,15 @@ _mesa_DeleteRenderbuffersEXT(GLsizei n, + _mesa_BindRenderbufferEXT(GL_RENDERBUFFER_EXT, 0); + } + +- /* remove from hash table immediately, to free the ID */ ++ /* Remove from hash table immediately, to free the ID. ++ * But the object will not be freed until it's no longer ++ * referenced anywhere else. ++ */ + _mesa_HashRemove(ctx->Shared->RenderBuffers, renderbuffers[i]); + + if (rb != &DummyRenderbuffer) { +- /* But the object will not be freed until it's no longer +- * bound in any context. +- */ +- _mesa_unreference_renderbuffer(&rb); ++ /* no longer referenced by hash table */ ++ _mesa_reference_renderbuffer(&rb, NULL); + } + } + } +diff --git a/src/mesa/main/framebuffer.c b/src/mesa/main/framebuffer.c +index cd4f594..1fd31a5 100644 +--- a/src/mesa/main/framebuffer.c ++++ b/src/mesa/main/framebuffer.c +@@ -70,42 +70,6 @@ compute_depth_max(struct gl_framebuffer + + + /** +- * Set the framebuffer's _DepthBuffer field, taking care of +- * reference counts, etc. +- */ +-static void +-set_depth_renderbuffer(struct gl_framebuffer *fb, +- struct gl_renderbuffer *rb) +-{ +- if (fb->_DepthBuffer) { +- _mesa_unreference_renderbuffer(&fb->_DepthBuffer); +- } +- fb->_DepthBuffer = rb; +- if (rb) { +- rb->RefCount++; +- } +-} +- +- +-/** +- * Set the framebuffer's _StencilBuffer field, taking care of +- * reference counts, etc. +- */ +-static void +-set_stencil_renderbuffer(struct gl_framebuffer *fb, +- struct gl_renderbuffer *rb) +-{ +- if (fb->_StencilBuffer) { +- _mesa_unreference_renderbuffer(&fb->_StencilBuffer); +- } +- fb->_StencilBuffer = rb; +- if (rb) { +- rb->RefCount++; +- } +-} +- +- +-/** + * Create and initialize a gl_framebuffer object. + * This is intended for creating _window_system_ framebuffers, not generic + * framebuffer objects ala GL_EXT_framebuffer_object. +@@ -223,7 +187,7 @@ _mesa_free_framebuffer_data(struct gl_fr + for (i = 0; i < BUFFER_COUNT; i++) { + struct gl_renderbuffer_attachment *att = &fb->Attachment[i]; + if (att->Renderbuffer) { +- _mesa_unreference_renderbuffer(&att->Renderbuffer); ++ _mesa_reference_renderbuffer(&att->Renderbuffer, NULL); + } + if (att->Texture) { + /* render to texture */ +@@ -239,9 +203,9 @@ _mesa_free_framebuffer_data(struct gl_fr + att->Texture = NULL; + } + +- /* unbind depth/stencil to decr ref counts */ +- set_depth_renderbuffer(fb, NULL); +- set_stencil_renderbuffer(fb, NULL); ++ /* unbind _Depth/_StencilBuffer to decr ref counts */ ++ _mesa_reference_renderbuffer(&fb->_DepthBuffer, NULL); ++ _mesa_reference_renderbuffer(&fb->_StencilBuffer, NULL); + } + + +@@ -569,13 +533,13 @@ _mesa_update_depth_buffer(GLcontext *ctx + /* need to update wrapper */ + struct gl_renderbuffer *wrapper + = _mesa_new_z24_renderbuffer_wrapper(ctx, depthRb); +- set_depth_renderbuffer(fb, wrapper); ++ _mesa_reference_renderbuffer(&fb->_DepthBuffer, wrapper); + ASSERT(fb->_DepthBuffer->Wrapped == depthRb); + } + } + else { + /* depthRb may be null */ +- set_depth_renderbuffer(fb, depthRb); ++ _mesa_reference_renderbuffer(&fb->_DepthBuffer, depthRb); + } + } + +@@ -610,13 +574,13 @@ _mesa_update_stencil_buffer(GLcontext *c + /* need to update wrapper */ + struct gl_renderbuffer *wrapper + = _mesa_new_s8_renderbuffer_wrapper(ctx, stencilRb); +- set_stencil_renderbuffer(fb, wrapper); ++ _mesa_reference_renderbuffer(&fb->_StencilBuffer, wrapper); + ASSERT(fb->_StencilBuffer->Wrapped == stencilRb); + } + } + else { + /* stencilRb may be null */ +- set_stencil_renderbuffer(fb, stencilRb); ++ _mesa_reference_renderbuffer(&fb->_StencilBuffer, stencilRb); + } + } + +diff --git a/src/mesa/main/rbadaptors.c b/src/mesa/main/rbadaptors.c +index 60f4948..c1ac060 100644 +--- a/src/mesa/main/rbadaptors.c ++++ b/src/mesa/main/rbadaptors.c +@@ -45,7 +45,7 @@ Delete_wrapper(struct gl_renderbuffer *r + /* Decrement reference count on the buffer we're wrapping and delete + * it if refcount hits zero. + */ +- _mesa_unreference_renderbuffer(&rb->Wrapped); ++ _mesa_reference_renderbuffer(&rb->Wrapped, NULL); + + /* delete myself */ + _mesa_delete_renderbuffer(rb); +diff --git a/src/mesa/main/renderbuffer.c b/src/mesa/main/renderbuffer.c +index ded0063..49706b5 100644 +--- a/src/mesa/main/renderbuffer.c ++++ b/src/mesa/main/renderbuffer.c +@@ -1473,7 +1473,7 @@ _mesa_init_renderbuffer(struct gl_render + + rb->ClassID = 0; + rb->Name = name; +- rb->RefCount = 1; ++ rb->RefCount = 0; + rb->Delete = _mesa_delete_renderbuffer; + + /* The rest of these should be set later by the caller of this function or +@@ -2105,9 +2105,7 @@ _mesa_add_renderbuffer(struct gl_framebu + + fb->Attachment[bufferName].Type = GL_RENDERBUFFER_EXT; + fb->Attachment[bufferName].Complete = GL_TRUE; +- fb->Attachment[bufferName].Renderbuffer = rb; +- +- rb->RefCount++; ++ _mesa_reference_renderbuffer(&fb->Attachment[bufferName].Renderbuffer, rb); + } + + +@@ -2125,38 +2123,55 @@ _mesa_remove_renderbuffer(struct gl_fram + if (!rb) + return; + +- _mesa_unreference_renderbuffer(&rb); ++ _mesa_reference_renderbuffer(&rb, NULL); + + fb->Attachment[bufferName].Renderbuffer = NULL; + } + + + /** +- * Decrement a renderbuffer object's reference count and delete it when +- * the refcount hits zero. +- * Note: we pass the address of a pointer. ++ * Set *ptr to point to rb. If *ptr points to another renderbuffer, ++ * dereference that buffer first. The new renderbuffer's refcount will ++ * be incremented. The old renderbuffer's refcount will be decremented. + */ + void +-_mesa_unreference_renderbuffer(struct gl_renderbuffer **rb) ++_mesa_reference_renderbuffer(struct gl_renderbuffer **ptr, ++ struct gl_renderbuffer *rb) + { +- assert(rb); +- if (*rb) { ++ assert(ptr); ++ if (*ptr == rb) { ++ /* no change */ ++ return; ++ } ++ ++ if (*ptr) { ++ /* Unreference the old renderbuffer */ + GLboolean deleteFlag = GL_FALSE; ++ struct gl_renderbuffer *oldRb = *ptr; + +- _glthread_LOCK_MUTEX((*rb)->Mutex); +- ASSERT((*rb)->RefCount > 0); +- (*rb)->RefCount--; +- deleteFlag = ((*rb)->RefCount == 0); +- _glthread_UNLOCK_MUTEX((*rb)->Mutex); ++ _glthread_LOCK_MUTEX(oldRb->Mutex); ++ ASSERT(oldRb->RefCount > 0); ++ oldRb->RefCount--; ++ /*printf("RB DECR %p to %d\n", (void*) oldRb, oldRb->RefCount);*/ ++ deleteFlag = (oldRb->RefCount == 0); ++ _glthread_UNLOCK_MUTEX(oldRb->Mutex); + + if (deleteFlag) +- (*rb)->Delete(*rb); ++ oldRb->Delete(oldRb); + +- *rb = NULL; ++ *ptr = NULL; + } +-} +- ++ assert(!*ptr); + ++ if (rb) { ++ /* reference new renderbuffer */ ++ _glthread_LOCK_MUTEX(rb->Mutex); ++ rb->RefCount++; ++ /*printf("RB REF %p to %d\n", (void*)rb, rb->RefCount);*/ ++ _glthread_UNLOCK_MUTEX(rb->Mutex); ++ *ptr = rb; ++ } ++} + + + /** +@@ -2180,4 +2195,3 @@ _mesa_new_depthstencil_renderbuffer(GLco + + return dsrb; + } +- +diff --git a/src/mesa/main/renderbuffer.h b/src/mesa/main/renderbuffer.h +index e5f1147..c9bf888 100644 +--- a/src/mesa/main/renderbuffer.h ++++ b/src/mesa/main/renderbuffer.h +@@ -102,7 +102,8 @@ extern void + _mesa_remove_renderbuffer(struct gl_framebuffer *fb, GLuint bufferName); + + extern void +-_mesa_unreference_renderbuffer(struct gl_renderbuffer **rb); ++_mesa_reference_renderbuffer(struct gl_renderbuffer **ptr, ++ struct gl_renderbuffer *rb); + + extern struct gl_renderbuffer * + _mesa_new_depthstencil_renderbuffer(GLcontext *ctx, GLuint name); diff --git a/bug-259290_trapfault.diff b/bug-259290_trapfault.diff new file mode 100644 index 0000000..60836db --- /dev/null +++ b/bug-259290_trapfault.diff @@ -0,0 +1,81 @@ +# On branch refs/heads/server-1.3-branch +# Updated but not checked in: +# (will commit) +# +# modified: fb/fbtrap.c +# modified: render/renderedge.c +# +# Changed but not updated: +# (use git-update-index to mark for commit) +# +# modified: randr/randr.c +# modified: randr/randrstr.h +# modified: randr/rrxinerama.c +# +# Untracked files: +# (use "git add" to add to commit) +# +# GL/apple/Makefile.am +# GL/glx/glxbyteorder.h +# GL/mesa/vbo/ +# MakeOut +# dix/patch +# hw/xfree86/xf1bpp/maskbits.c +# hw/xfree86/xf1bpp/mfbbitblt.c +# hw/xfree86/xf1bpp/mfbbres.c +# hw/xfree86/xf1bpp/mfbbresd.c +# hw/xfree86/xf1bpp/mfbbstore.c +# hw/xfree86/xf1bpp/mfbclip.c +# hw/xfree86/xf1bpp/mfbcmap.c +# hw/xfree86/xf1bpp/mfbfillarc.c +# hw/xfree86/xf1bpp/mfbfillrct.c +# hw/xfree86/xf1bpp/mfbfillsp.c +# hw/xfree86/xf1bpp/mfbfont.c +# hw/xfree86/xf1bpp/mfbgc.c +# hw/xfree86/xf1bpp/mfbgetsp.c +# hw/xfree86/xf1bpp/mfbhrzvert.c +# hw/xfree86/xf1bpp/mfbimage.c +# hw/xfree86/xf1bpp/mfbline.c +# hw/xfree86/xf1bpp/mfbmisc.c +# hw/xfree86/xf1bpp/mfbpixmap.c +# hw/xfree86/xf1bpp/mfbpntwin.c +# hw/xfree86/xf1bpp/mfbpolypnt.c +# hw/xfree86/xf1bpp/mfbpushpxl.c +# hw/xfree86/xf1bpp/mfbscrclse.c +# hw/xfree86/xf1bpp/mfbscrinit.c +# hw/xfree86/xf1bpp/mfbsetsp.c +# hw/xfree86/xf1bpp/mfbwindow.c +# hw/xfree86/xf1bpp/mfbzerarc.c +# hw/xfree86/xorg.conf.example +# hw/xfree86/xorg.conf.example.pre +# hw/xwin/winprefslex.c +# hw/xwin/winprefsyacc.c +# hw/xwin/winprefsyacc.h +# xorg-server-1.2.99.902.tar.bz2 +# xorg-server-1.2.99.902.tar.gz +diff --git a/fb/fbtrap.c b/fb/fbtrap.c +index 8639695..52fcfed 100644 +--- a/fb/fbtrap.c ++++ b/fb/fbtrap.c +@@ -115,6 +115,9 @@ fbRasterizeTrapezoid (PicturePtr pPicture, + RenderEdge l, r; + xFixed t, b; + ++ if (!xTrapezoidValid (trap)) ++ return; ++ + fbGetDrawable (pPicture->pDrawable, buf, stride, bpp, pxoff, pyoff); + + width = pPicture->pDrawable->width; +diff --git a/render/renderedge.c b/render/renderedge.c +index 199ec22..c2ffabe 100644 +--- a/render/renderedge.c ++++ b/render/renderedge.c +@@ -143,6 +143,7 @@ RenderEdgeInit (RenderEdge *e, + dx = x_bot - x_top; + dy = y_bot - y_top; + e->dy = dy; ++ e->dx = 0; + if (dy) + { + if (dx >= 0) diff --git a/xorg-server-1.2.99.903.tar.bz2 b/xorg-server-1.2.99.903.tar.bz2 deleted file mode 100644 index a73f281..0000000 --- a/xorg-server-1.2.99.903.tar.bz2 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:0fe2986a8c6659bb2b7ff9b458000be053e14667db9ee3c288db0502c6e00770 -size 5968830 diff --git a/xorg-server-1.2.99.905.tar.bz2 b/xorg-server-1.2.99.905.tar.bz2 new file mode 100644 index 0000000..3f3355e --- /dev/null +++ b/xorg-server-1.2.99.905.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:db980ce2d2e9d0ad43c888a509f601c8c1d2a802ad5aff9f69ad3acdea6e1453 +size 5969487 diff --git a/xorg-x11-server.changes b/xorg-x11-server.changes index 70ddb84..fc309bf 100644 --- a/xorg-x11-server.changes +++ b/xorg-x11-server.changes @@ -1,3 +1,42 @@ +------------------------------------------------------------------- +Tue Apr 10 15:33:59 CEST 2007 - sndirsch@suse.de + +- Mesa-6.5.2-fix_radeon_cliprect.diff: + * fixes X.Org Bug #9876 + +------------------------------------------------------------------- +Fri Apr 6 13:21:07 CEST 2007 - sndirsch@suse.de + +- bug-259290_trapfault.diff: + * fixes crash caused by bug in XRender code (Bug #259290) + +------------------------------------------------------------------- +Fri Apr 6 12:08:17 CEST 2007 - sndirsch@suse.de + +- xserver 1.2.99.905 release: + * CVE-2007-1003: XC-MISC Extension ProcXCMiscGetXIDList() Memory + Corruption + * X.Org Bug #10296: Fix timer rescheduling +- obsoletes bug-243978_xcmisc.diff + +------------------------------------------------------------------- +Fri Apr 6 12:07:33 CEST 2007 - sndirsch@suse.de + +- xserver 1.2.99.904 release: + * Don't erase current crtc for outputs on CloseScreen + +------------------------------------------------------------------- +Thu Apr 5 00:37:51 CEST 2007 - sndirsch@suse.de + +- bug-243978_xcmisc.diff: + * mem corruption in ProcXCMiscGetXIDList (CVE-2007-1003, Bug #243978) + +------------------------------------------------------------------- +Wed Apr 4 22:07:02 CEST 2007 - sndirsch@suse.de + +- bug-211314_mesa-refcount-memleak-fixes.diff: + * Fix for memleaks and refount bugs (Bug #211314) + ------------------------------------------------------------------- Fri Mar 30 12:16:47 CEST 2007 - sndirsch@suse.de diff --git a/xorg-x11-server.spec b/xorg-x11-server.spec index 6cbb49e..7b65255 100644 --- a/xorg-x11-server.spec +++ b/xorg-x11-server.spec @@ -11,7 +11,7 @@ # norootforbuild Name: xorg-x11-server -%define dirsuffix 1.2.99.903 +%define dirsuffix 1.2.99.905 %define fglrx_driver_hack 1 %define vnc 0 BuildRequires: Mesa-devel fontconfig-devel freetype2-devel ghostscript-library glitz-devel libdrm-devel pkgconfig xorg-x11 xorg-x11-devel xorg-x11-libICE-devel xorg-x11-libSM-devel xorg-x11-libX11-devel xorg-x11-libXau-devel xorg-x11-libXdmcp-devel xorg-x11-libXext-devel xorg-x11-libXfixes-devel xorg-x11-libXmu-devel xorg-x11-libXp-devel xorg-x11-libXpm-devel xorg-x11-libXprintUtil-devel xorg-x11-libXrender-devel xorg-x11-libXt-devel xorg-x11-libXv-devel xorg-x11-libfontenc-devel xorg-x11-libxkbfile-devel xorg-x11-proto-devel xorg-x11-xtrans-devel @@ -21,7 +21,7 @@ BuildRequires: libjpeg-devel URL: http://xorg.freedesktop.org/ %define EXPERIMENTAL 0 Version: 7.2 -Release: 66 +Release: 69 License: X11/MIT BuildRoot: %{_tmppath}/%{name}-%{version}-build Group: System/X11/Servers/XF86_4 @@ -94,6 +94,9 @@ Patch56: bug-211314-patch-8.diff Patch57: bug-211314-patch-9.diff Patch58: bug-211314-patch-10.diff Patch59: bug-211314-patch-11.diff +Patch60: bug-211314_mesa-refcount-memleak-fixes.diff +Patch61: bug-259290_trapfault.diff +Patch62: Mesa-6.5.2-fix_radeon_cliprect.diff Patch334: p_pci-domain.diff Patch357: p_pci-ce-x.diff @@ -200,7 +203,10 @@ pushd ../Mesa %patch57 -p1 %patch58 -p1 %patch59 -p1 +%patch60 -p1 +%patch62 -p1 popd +%patch61 -p1 %build autoreconf -fi @@ -531,6 +537,27 @@ exit 0 %endif %changelog +* Tue Apr 10 2007 - sndirsch@suse.de +- Mesa-6.5.2-fix_radeon_cliprect.diff: + * fixes X.Org Bug #9876 +* Fri Apr 06 2007 - sndirsch@suse.de +- bug-259290_trapfault.diff: + * fixes crash caused by bug in XRender code (Bug #259290) +* Fri Apr 06 2007 - sndirsch@suse.de +- xserver 1.2.99.905 release: + * CVE-2007-1003: XC-MISC Extension ProcXCMiscGetXIDList() Memory + Corruption + * X.Org Bug #10296: Fix timer rescheduling +- obsoletes bug-243978_xcmisc.diff +* Fri Apr 06 2007 - sndirsch@suse.de +- xserver 1.2.99.904 release: + * Don't erase current crtc for outputs on CloseScreen +* Thu Apr 05 2007 - sndirsch@suse.de +- bug-243978_xcmisc.diff: + * mem corruption in ProcXCMiscGetXIDList (CVE-2007-1003, Bug #243978) +* Wed Apr 04 2007 - sndirsch@suse.de +- bug-211314_mesa-refcount-memleak-fixes.diff: + * Fix for memleaks and refount bugs (Bug #211314) * Fri Mar 30 2007 - sndirsch@suse.de - p_default-module-path.diff: * only return /usr/%%lib/xorg/modules in "-showDefaultModulePath"