snapshot: Perform the cow under a mutex

In order to prevent a race between concurrent destroy and use in another
thread, we need to acquire a reference to the snapshot->target under a
mutex. Whilst we hold that reference, it prevents the internal destroy
mechanism from freeing the memory we are using (if we have a pointer to
the original surface) and the client drops their final reference.

Oh boy, talk about opening a can of worms...

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

1 files changed, 8 insertions, 1 deletions

diff --git a/src/cairo-surface-snapshot-inline.h b/src/cairo-surface-snapshot-inline.h
index 5bf344427..7c15b81a7 100644
--- a/src/cairo-surface-snapshot-inline.h
+++ b/src/cairo-surface-snapshot-inline.h
@@ -47,7 +47,14 @@ _cairo_surface_snapshot_is_reused (cairo_surface_t *surface)
 static inline cairo_surface_t *
 _cairo_surface_snapshot_get_target (cairo_surface_t *surface)
 {
-    return ((cairo_surface_snapshot_t *) surface)->target;
+    cairo_surface_snapshot_t *snapshot = (cairo_surface_snapshot_t *) surface;
+    cairo_surface_t *target;
+
+    CAIRO_MUTEX_LOCK (snapshot->mutex);
+    target = cairo_surface_reference (snapshot->target);
+    CAIRO_MUTEX_UNLOCK (snapshot->mutex);
+
+    return target;
 }
 
 static inline cairo_bool_t