From 0365b587f03411d6a55017e111a991d466decc35 Mon Sep 17 00:00:00 2001
From: emersion <contact@emersion.fr>
Date: Sun, 21 Jan 2018 00:06:35 +0100
Subject: output: add damage tracking via buffer age

---
 backend/headless/output.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

(limited to 'backend/headless')

diff --git a/backend/headless/output.c b/backend/headless/output.c
index 9fc92e88..a9a538ed 100644
--- a/backend/headless/output.c
+++ b/backend/headless/output.c
@@ -48,18 +48,15 @@ static void output_transform(struct wlr_output *wlr_output,
 	output->wlr_output.transform = transform;
 }
 
-static void output_make_current(struct wlr_output *wlr_output) {
+static bool output_make_current(struct wlr_output *wlr_output, int *buffer_age) {
 	struct wlr_headless_output *output =
 		(struct wlr_headless_output *)wlr_output;
-	if (!eglMakeCurrent(output->backend->egl.display,
-		output->egl_surface, output->egl_surface,
-		output->backend->egl.context)) {
-		wlr_log(L_ERROR, "eglMakeCurrent failed: %s", egl_error());
-	}
+	return wlr_egl_make_current(&output->backend->egl, output->egl_surface,
+		buffer_age);
 }
 
-static void output_swap_buffers(struct wlr_output *wlr_output) {
-	// No-op
+static bool output_swap_buffers(struct wlr_output *wlr_output) {
+	return true; // No-op
 }
 
 static void output_destroy(struct wlr_output *wlr_output) {
-- 
cgit v1.2.3


From 8d58ed502b6022e6a5e99bca98f6c45cc6deba0a Mon Sep 17 00:00:00 2001
From: emersion <contact@emersion.fr>
Date: Fri, 26 Jan 2018 22:39:23 +0100
Subject: output: add wlr_output_schedule_frame

---
 backend/drm/drm.c                   |  2 +-
 backend/headless/output.c           |  2 +-
 backend/wayland/output.c            |  8 ++++----
 backend/x11/backend.c               |  4 ++--
 include/rootston/output.h           |  1 -
 include/wlr/interfaces/wlr_output.h |  1 +
 include/wlr/types/wlr_output.h      |  6 ++++++
 rootston/output.c                   | 26 ++++----------------------
 types/wlr_output.c                  | 22 ++++++++++++++++++++++
 9 files changed, 41 insertions(+), 31 deletions(-)

(limited to 'backend/headless')

diff --git a/backend/drm/drm.c b/backend/drm/drm.c
index 5ab51e82..c3ff0d55 100644
--- a/backend/drm/drm.c
+++ b/backend/drm/drm.c
@@ -881,7 +881,7 @@ static void page_flip_handler(int fd, unsigned seq,
 	}
 
 	if (drm->session->active) {
-		wl_signal_emit(&conn->output.events.frame, &conn->output);
+		wlr_output_send_frame(&conn->output);
 	}
 }
 
diff --git a/backend/headless/output.c b/backend/headless/output.c
index a9a538ed..46f9d212 100644
--- a/backend/headless/output.c
+++ b/backend/headless/output.c
@@ -85,7 +85,7 @@ bool wlr_output_is_headless(struct wlr_output *wlr_output) {
 
 static int signal_frame(void *data) {
 	struct wlr_headless_output *output = data;
-	wl_signal_emit(&output->wlr_output.events.frame, &output->wlr_output);
+	wlr_output_send_frame(&output->wlr_output);
 	wl_event_source_timer_update(output->frame_timer, output->frame_delay);
 	return 0;
 }
diff --git a/backend/wayland/output.c b/backend/wayland/output.c
index 5de18d41..4fec1955 100644
--- a/backend/wayland/output.c
+++ b/backend/wayland/output.c
@@ -17,11 +17,11 @@ int os_create_anonymous_file(off_t size);
 
 static struct wl_callback_listener frame_listener;
 
-static void surface_frame_callback(void *data, struct wl_callback *cb, uint32_t time) {
+static void surface_frame_callback(void *data, struct wl_callback *cb,
+		uint32_t time) {
 	struct wlr_wl_backend_output *output = data;
-	struct wlr_output *wlr_output = (struct wlr_output *)output;
-	assert(wlr_output);
-	wl_signal_emit(&wlr_output->events.frame, wlr_output);
+	assert(output);
+	wlr_output_send_frame(&output->wlr_output);
 	wl_callback_destroy(cb);
 	output->frame_callback = NULL;
 }
diff --git a/backend/x11/backend.c b/backend/x11/backend.c
index b9ea7d0f..ae7c13be 100644
--- a/backend/x11/backend.c
+++ b/backend/x11/backend.c
@@ -44,7 +44,7 @@ static bool handle_x11_event(struct wlr_x11_backend *x11, xcb_generic_event_t *e
 
 	switch (event->response_type) {
 	case XCB_EXPOSE: {
-		wl_signal_emit(&output->wlr_output.events.frame, output);
+		wlr_output_send_frame(&output->wlr_output);
 		break;
 	}
 	case XCB_KEY_PRESS:
@@ -174,7 +174,7 @@ static int x11_event(int fd, uint32_t mask, void *data) {
 
 static int signal_frame(void *data) {
 	struct wlr_x11_backend *x11 = data;
-	wl_signal_emit(&x11->output.wlr_output.events.frame, &x11->output);
+	wlr_output_send_frame(&x11->output.wlr_output);
 	wl_event_source_timer_update(x11->frame_timer, 16);
 	return 0;
 }
diff --git a/include/rootston/output.h b/include/rootston/output.h
index 11f53d83..a9f9bc2b 100644
--- a/include/rootston/output.h
+++ b/include/rootston/output.h
@@ -23,7 +23,6 @@ struct roots_output {
 
 	struct timespec last_frame;
 	pixman_region32_t damage; // in ouput-local coordinates
-	bool frame_pending;
 
 	// circular queue for previous damage
 	pixman_region32_t previous_damage[ROOTS_OUTPUT_PREVIOUS_DAMAGE_LEN];
diff --git a/include/wlr/interfaces/wlr_output.h b/include/wlr/interfaces/wlr_output.h
index f2b65066..652be45e 100644
--- a/include/wlr/interfaces/wlr_output.h
+++ b/include/wlr/interfaces/wlr_output.h
@@ -33,5 +33,6 @@ void wlr_output_update_custom_mode(struct wlr_output *output, int32_t width,
 	int32_t height, int32_t refresh);
 void wlr_output_update_enabled(struct wlr_output *output, bool enabled);
 void wlr_output_update_needs_swap(struct wlr_output *output);
+void wlr_output_send_frame(struct wlr_output *output);
 
 #endif
diff --git a/include/wlr/types/wlr_output.h b/include/wlr/types/wlr_output.h
index 4eefbf55..7e9439af 100644
--- a/include/wlr/types/wlr_output.h
+++ b/include/wlr/types/wlr_output.h
@@ -63,6 +63,7 @@ struct wlr_output {
 	bool needs_swap;
 	// damage for cursors and fullscreen surface, in output-local coordinates
 	pixman_region32_t damage;
+	bool frame_pending;
 	float transform_matrix[16];
 
 	struct {
@@ -123,6 +124,11 @@ bool wlr_output_make_current(struct wlr_output *output, int *buffer_age);
  */
 bool wlr_output_swap_buffers(struct wlr_output *output, struct timespec *when,
 	pixman_region32_t *damage);
+/**
+ * Manually schedules a `frame` event. If a `frame` event is already pending,
+ * it is a no-op.
+ */
+void wlr_output_schedule_frame(struct wlr_output *output);
 void wlr_output_set_gamma(struct wlr_output *output,
 	uint32_t size, uint16_t *r, uint16_t *g, uint16_t *b);
 uint32_t wlr_output_get_gamma_size(struct wlr_output *output);
diff --git a/rootston/output.c b/rootston/output.c
index c6341b6a..f928184b 100644
--- a/rootston/output.c
+++ b/rootston/output.c
@@ -338,7 +338,6 @@ static void render_output(struct roots_output *output) {
 	struct roots_server *server = desktop->server;
 
 	if (!wlr_output->enabled) {
-		output->frame_pending = false;
 		return;
 	}
 
@@ -400,7 +399,6 @@ static void render_output(struct roots_output *output) {
 
 	if (!pixman_region32_not_empty(&damage) && !wlr_output->needs_swap) {
 		// Output doesn't need swap and isn't damaged, skip rendering completely
-		output->frame_pending = false;
 		goto damage_finish;
 	}
 
@@ -470,7 +468,6 @@ renderer_end:
 	wlr_renderer_scissor(output->desktop->server->renderer, NULL);
 	wlr_renderer_end(server->renderer);
 	wlr_output_swap_buffers(wlr_output, &now, &damage);
-	output->frame_pending = true;
 	// same as decrementing, but works on unsigned integers
 	output->previous_damage_idx += ROOTS_OUTPUT_PREVIOUS_DAMAGE_LEN - 1;
 	output->previous_damage_idx %= ROOTS_OUTPUT_PREVIOUS_DAMAGE_LEN;
@@ -488,21 +485,6 @@ static void output_handle_frame(struct wl_listener *listener, void *data) {
 	render_output(output);
 }
 
-static void handle_idle_render(void *data) {
-	struct roots_output *output = data;
-	render_output(output);
-}
-
-static void schedule_render(struct roots_output *output) {
-	if (!output->frame_pending) {
-		// TODO: ask the backend to send a frame event when appropriate instead
-		struct wl_event_loop *ev =
-			wl_display_get_event_loop(output->desktop->server->wl_display);
-		wl_event_loop_add_idle(ev, handle_idle_render, output);
-		output->frame_pending = true;
-	}
-}
-
 static void output_damage_whole(struct roots_output *output) {
 	int width, height;
 	output_get_transformed_size(output->wlr_output, &width, &height);
@@ -510,7 +492,7 @@ static void output_damage_whole(struct roots_output *output) {
 	pixman_region32_union_rect(&output->damage, &output->damage, 0, 0,
 		width, height);
 
-	schedule_render(output);
+	wlr_output_schedule_frame(output->wlr_output);
 }
 
 static bool view_accept_damage(struct roots_output *output,
@@ -553,7 +535,7 @@ static void damage_whole_surface(struct wlr_surface *surface,
 	pixman_region32_union_rect(&output->damage, &output->damage,
 		box.x, box.y, box.width, box.height);
 
-	schedule_render(output);
+	wlr_output_schedule_frame(output->wlr_output);
 }
 
 static void damage_whole_decoration(struct roots_view *view,
@@ -608,7 +590,7 @@ static void damage_from_surface(struct wlr_surface *surface,
 	pixman_region32_union(&output->damage, &output->damage, &damage);
 	pixman_region32_fini(&damage);
 
-	schedule_render(output);
+	wlr_output_schedule_frame(output->wlr_output);
 }
 
 void output_damage_from_view(struct roots_output *output,
@@ -630,7 +612,7 @@ static void output_handle_needs_swap(struct wl_listener *listener, void *data) {
 		wl_container_of(listener, output, needs_swap);
 	pixman_region32_union(&output->damage, &output->damage,
 		&output->wlr_output->damage);
-	schedule_render(output);
+	wlr_output_schedule_frame(output->wlr_output);
 }
 
 static void set_mode(struct wlr_output *output,
diff --git a/types/wlr_output.c b/types/wlr_output.c
index f23f1749..5676b0a8 100644
--- a/types/wlr_output.c
+++ b/types/wlr_output.c
@@ -499,6 +499,7 @@ bool wlr_output_swap_buffers(struct wlr_output *output, struct timespec *when,
 		return false;
 	}
 
+	output->frame_pending = true;
 	output->needs_swap = false;
 	pixman_region32_clear(&output->damage);
 
@@ -509,6 +510,27 @@ bool wlr_output_swap_buffers(struct wlr_output *output, struct timespec *when,
 	return true;
 }
 
+void wlr_output_send_frame(struct wlr_output *output) {
+	output->frame_pending = false;
+	wl_signal_emit(&output->events.frame, output);
+}
+
+static void schedule_frame_handle_idle_timer(void *data) {
+	struct wlr_output *output = data;
+	wlr_output_send_frame(output);
+}
+
+void wlr_output_schedule_frame(struct wlr_output *output) {
+	if (output->frame_pending) {
+		return;
+	}
+
+	// TODO: ask the backend to send a frame event when appropriate instead
+	struct wl_event_loop *ev = wl_display_get_event_loop(output->display);
+	wl_event_loop_add_idle(ev, schedule_frame_handle_idle_timer, output);
+	output->frame_pending = true;
+}
+
 void wlr_output_set_gamma(struct wlr_output *output,
 	uint32_t size, uint16_t *r, uint16_t *g, uint16_t *b) {
 	if (output->impl->set_gamma) {
-- 
cgit v1.2.3


From babdd6ccf757f18ef15b50d9f16c55031a7c1944 Mon Sep 17 00:00:00 2001
From: emersion <contact@emersion.fr>
Date: Tue, 30 Jan 2018 19:45:57 +0100
Subject: backend: fix use-after-free when destroying backends

The backend destroy signal is emitted before the output_remove
signal is. When the destroy signal is emitted listeners remove
their output_remove listener, so the output_remove signal is never
received and listeners have an invalid output pointer.

The correct way to solve this would be to remove the output_remove
signal completely and use the wlr_output.events.destroy signal
instead. This isn't yet possible because wl_signal_emit is unsafe
and listeners cannot be removed in listeners.
---
 backend/backend.c          | 1 -
 backend/drm/backend.c      | 2 ++
 backend/headless/backend.c | 2 ++
 backend/headless/output.c  | 2 --
 backend/libinput/backend.c | 8 +++++---
 backend/multi/backend.c    | 5 +++++
 backend/wayland/backend.c  | 8 +++++---
 backend/wayland/output.c   | 9 +++++----
 backend/x11/backend.c      | 2 ++
 types/wlr_output.c         | 1 +
 10 files changed, 27 insertions(+), 13 deletions(-)

(limited to 'backend/headless')

diff --git a/backend/backend.c b/backend/backend.c
index a71cf6b8..98b94c5c 100644
--- a/backend/backend.c
+++ b/backend/backend.c
@@ -37,7 +37,6 @@ void wlr_backend_destroy(struct wlr_backend *backend) {
 		return;
 	}
 
-	wl_signal_emit(&backend->events.destroy, backend);
 	if (backend->impl && backend->impl->destroy) {
 		backend->impl->destroy(backend);
 	} else {
diff --git a/backend/drm/backend.c b/backend/drm/backend.c
index de69dad5..dc6757a5 100644
--- a/backend/drm/backend.c
+++ b/backend/drm/backend.c
@@ -34,6 +34,8 @@ static void wlr_drm_backend_destroy(struct wlr_backend *backend) {
 		wlr_output_destroy(&conn->output);
 	}
 
+	wl_signal_emit(&backend->events.destroy, backend);
+
 	wl_list_remove(&drm->display_destroy.link);
 	wl_list_remove(&drm->session_signal.link);
 	wl_list_remove(&drm->drm_invalidated.link);
diff --git a/backend/headless/backend.c b/backend/headless/backend.c
index 61409d41..0bf5ec28 100644
--- a/backend/headless/backend.c
+++ b/backend/headless/backend.c
@@ -51,6 +51,8 @@ static void backend_destroy(struct wlr_backend *wlr_backend) {
 		wlr_input_device_destroy(&input_device->wlr_input_device);
 	}
 
+	wl_signal_emit(&wlr_backend->events.destroy, backend);
+
 	wlr_egl_finish(&backend->egl);
 	free(backend);
 }
diff --git a/backend/headless/output.c b/backend/headless/output.c
index 46f9d212..aac7cc20 100644
--- a/backend/headless/output.c
+++ b/backend/headless/output.c
@@ -62,8 +62,6 @@ static bool output_swap_buffers(struct wlr_output *wlr_output) {
 static void output_destroy(struct wlr_output *wlr_output) {
 	struct wlr_headless_output *output =
 		(struct wlr_headless_output *)wlr_output;
-	wl_signal_emit(&output->backend->backend.events.output_remove,
-		&output->wlr_output);
 
 	wl_list_remove(&output->link);
 
diff --git a/backend/libinput/backend.c b/backend/libinput/backend.c
index c9352051..86477947 100644
--- a/backend/libinput/backend.c
+++ b/backend/libinput/backend.c
@@ -95,12 +95,12 @@ static bool wlr_libinput_backend_start(struct wlr_backend *_backend) {
 	return true;
 }
 
-static void wlr_libinput_backend_destroy(struct wlr_backend *_backend) {
-	if (!_backend) {
+static void wlr_libinput_backend_destroy(struct wlr_backend *wlr_backend) {
+	if (!wlr_backend) {
 		return;
 	}
 	struct wlr_libinput_backend *backend =
-		(struct wlr_libinput_backend *)_backend;
+		(struct wlr_libinput_backend *)wlr_backend;
 
 	for (size_t i = 0; i < backend->wlr_device_lists.length; i++) {
 		struct wl_list *wlr_devices = backend->wlr_device_lists.items[i];
@@ -112,6 +112,8 @@ static void wlr_libinput_backend_destroy(struct wlr_backend *_backend) {
 		free(wlr_devices);
 	}
 
+	wl_signal_emit(&wlr_backend->events.destroy, wlr_backend);
+
 	wl_list_remove(&backend->display_destroy.link);
 	wl_list_remove(&backend->session_signal.link);
 
diff --git a/backend/multi/backend.c b/backend/multi/backend.c
index 1e574475..78f5c63b 100644
--- a/backend/multi/backend.c
+++ b/backend/multi/backend.c
@@ -42,11 +42,16 @@ static void subbackend_state_destroy(struct subbackend_state *sub) {
 
 static void multi_backend_destroy(struct wlr_backend *wlr_backend) {
 	struct wlr_multi_backend *backend = (struct wlr_multi_backend *)wlr_backend;
+
 	wl_list_remove(&backend->display_destroy.link);
+
 	struct subbackend_state *sub, *next;
 	wl_list_for_each_safe(sub, next, &backend->backends, link) {
 		wlr_backend_destroy(sub->backend);
 	}
+
+	// Destroy this backend only after removing all sub-backends
+	wl_signal_emit(&wlr_backend->events.destroy, backend);
 	free(backend);
 }
 
diff --git a/backend/wayland/backend.c b/backend/wayland/backend.c
index eca79350..458c9dd0 100644
--- a/backend/wayland/backend.c
+++ b/backend/wayland/backend.c
@@ -64,9 +64,9 @@ static bool wlr_wl_backend_start(struct wlr_backend *_backend) {
 	return true;
 }
 
-static void wlr_wl_backend_destroy(struct wlr_backend *_backend) {
-	struct wlr_wl_backend *backend = (struct wlr_wl_backend *)_backend;
-	if (!_backend) {
+static void wlr_wl_backend_destroy(struct wlr_backend *wlr_backend) {
+	struct wlr_wl_backend *backend = (struct wlr_wl_backend *)wlr_backend;
+	if (backend == NULL) {
 		return;
 	}
 
@@ -80,6 +80,8 @@ static void wlr_wl_backend_destroy(struct wlr_backend *_backend) {
 		wlr_input_device_destroy(input_device);
 	}
 
+	wl_signal_emit(&wlr_backend->events.destroy, wlr_backend);
+
 	wl_list_remove(&backend->local_display_destroy.link);
 
 	free(backend->seat_name);
diff --git a/backend/wayland/output.c b/backend/wayland/output.c
index 4a8fb0bf..a9140ff7 100644
--- a/backend/wayland/output.c
+++ b/backend/wayland/output.c
@@ -161,11 +161,12 @@ static bool wlr_wl_output_set_cursor(struct wlr_output *_output,
 	return true;
 }
 
-static void wlr_wl_output_destroy(struct wlr_output *_output) {
+static void wlr_wl_output_destroy(struct wlr_output *wlr_output) {
 	struct wlr_wl_backend_output *output =
-		(struct wlr_wl_backend_output *)_output;
-	wl_signal_emit(&output->backend->backend.events.output_remove,
-		&output->wlr_output);
+		(struct wlr_wl_backend_output *)wlr_output;
+	if (output == NULL) {
+		return;
+	}
 
 	wl_list_remove(&output->link);
 
diff --git a/backend/x11/backend.c b/backend/x11/backend.c
index 3bad8d61..44e29be1 100644
--- a/backend/x11/backend.c
+++ b/backend/x11/backend.c
@@ -259,6 +259,8 @@ static void wlr_x11_backend_destroy(struct wlr_backend *backend) {
 		xkb_state_unref(x11->keyboard_dev.keyboard->xkb_state);
 	}
 
+	wl_signal_emit(&backend->events.destroy, backend);
+
 	wl_list_remove(&x11->display_destroy.link);
 
 	wl_event_source_remove(x11->frame_timer);
diff --git a/types/wlr_output.c b/types/wlr_output.c
index 54f4baf8..1878dbb3 100644
--- a/types/wlr_output.c
+++ b/types/wlr_output.c
@@ -286,6 +286,7 @@ void wlr_output_destroy(struct wlr_output *output) {
 	wlr_output_destroy_global(output);
 	wlr_output_set_fullscreen_surface(output, NULL);
 
+	wl_signal_emit(&output->backend->events.output_remove, output);
 	wl_signal_emit(&output->events.destroy, output);
 
 	struct wlr_output_mode *mode, *tmp_mode;
-- 
cgit v1.2.3