Hi,
I can confirm the bug and this patch fixes it.
Basicaly it crashed in cogl_onscreen_add_frame_callback because
macro COGL_TAILQ_REMOVE in cogl_onscreen_remove_frame_callback
incorrectly removed an element from queue and corrupted the queue and
tail pointer.
--- a/cogl/cogl-queue.h 2011-08-12 15:45:58.000000000 +0200
+++ b/cogl/cogl-queue.h 2013-03-29 01:06:20.049909221 +0100
@@ -614,14 +614,18 @@
COGL_QMD_SAVELINK(oldprev, (elm)->field.tqe_prev); \
COGL_QMD_TAILQ_CHECK_NEXT(elm, field); \
COGL_QMD_TAILQ_CHECK_PREV(elm, field); \
- if ((COGL_TAILQ_NEXT((elm), field)) != NULL) \
+ (*(elm)->field.tqe_prev)->field.tqe_next = \
+ COGL_TAILQ_NEXT((elm), field); \
+ if ((COGL_TAILQ_NEXT((elm), field)) != NULL) { \
COGL_TAILQ_NEXT((elm), field)->field.tqe_prev = \
(elm)->field.tqe_prev; \
- else { \
+ if (COGL_TAILQ_NEXT((elm), field)->field.tqe_next == NULL) \
+ (head)->tqh_last = \
+ &(*(elm)->field.tqe_prev)->field.tqe_next; \
+ } else { \
(head)->tqh_last = (elm)->field.tqe_prev; \
COGL_QMD_TRACE_HEAD(head); \
} \
- *(elm)->field.tqe_prev = COGL_TAILQ_NEXT((elm), field); \
COGL_TRASHIT(*oldnext); \
COGL_TRASHIT(*oldprev); \
COGL_QMD_TRACE_ELEM(&(elm)->field); \
--nX
--
To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
