compositor: set surface->plane from destroyed plane to NULL
In drm backend, the cursor_surface->plane point to
drm_output->cursor_plane.when this output is removed,
drm_output->cursor_plane is destroyed, butcursor_surface->plane
still point to destroyed plane. So once mouse move to this
cursor_surface and system will repaint this cursor_surface,
segment fault will generate in weston_surface_damage_below() function.
V2:
-set surface->plane to NULL whose plane point to unplugged output,
then change weston_surface_damage_below() to do nothing if
surface->plane is NULL (Kristian)
-set surface->plane to NULL in weston_surface_unmap(),
so that all surfaces that have a non-NULL plane pointer wil be
on compositor->surface_list (Kristian).
bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=69777
Signed-off-by: Xiong Zhang <xiong.y.zhang@intel.com>
diff --git a/src/compositor-drm.c b/src/compositor-drm.c
index e32e4a8..461fce7 100644
--- a/src/compositor-drm.c
+++ b/src/compositor-drm.c
@@ -2012,8 +2012,8 @@
output->base.gamma_size = output->original_crtc->gamma_size;
output->base.set_gamma = drm_output_set_gamma;
- weston_plane_init(&output->cursor_plane, 0, 0);
- weston_plane_init(&output->fb_plane, 0, 0);
+ weston_plane_init(&output->cursor_plane, &ec->base, 0, 0);
+ weston_plane_init(&output->fb_plane, &ec->base, 0, 0);
weston_compositor_stack_plane(&ec->base, &output->cursor_plane, NULL);
weston_compositor_stack_plane(&ec->base, &output->fb_plane,
@@ -2088,7 +2088,7 @@
memcpy(sprite->formats, plane->formats,
plane->count_formats * sizeof(plane->formats[0]));
drmModeFreePlane(plane);
- weston_plane_init(&sprite->plane, 0, 0);
+ weston_plane_init(&sprite->plane, &ec->base, 0, 0);
weston_compositor_stack_plane(&ec->base, &sprite->plane,
&ec->base.primary_plane);