snapshot: Perform the cow under a mutex

In order to prevent a race between concurrent destroy and use in another
thread, we need to acquire a reference to the snapshot->target under a
mutex. Whilst we hold that reference, it prevents the internal destroy
mechanism from freeing the memory we are using (if we have a pointer to
the original surface) and the client drops their final reference.

Oh boy, talk about opening a can of worms...

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

1 files changed, 1 insertions, 3 deletions

diff --git a/src/cairo-pattern.c b/src/cairo-pattern.c
index d21200a52..940227d29 100644
--- a/src/cairo-pattern.c
+++ b/src/cairo-pattern.c
@@ -3668,9 +3668,7 @@ _cairo_pattern_get_ink_extents (const cairo_pattern_t         *pattern,
 	    (const cairo_surface_pattern_t *) pattern;
 	cairo_surface_t *surface = surface_pattern->surface;
 
-	if (_cairo_surface_is_snapshot (surface))
-	    surface = _cairo_surface_snapshot_get_target (surface);
-
+	surface = _cairo_surface_get_source (surface, NULL);
 	if (_cairo_surface_is_recording (surface)) {
 	    cairo_matrix_t imatrix;
 	    cairo_box_t box;