XCB: Make sure SHM memory isn't reused too early

This commit delays the return of a SHM area to the free pool. When
_cairo_xcb_shm_info_destroy is called, it now adds the cairo_xcb_shm_info_t to a
list of pending memory areas and sends a GetInputFocus request to the server.

This cairo_xcb_shm_info_t is only really freed when the GetInputFocus request
completes. To avoid unnecessarily waiting for the X server, we check via
xcb_poll_for_reply for the reply which returns immediately if the reply isn't
received yet.

This commits fixes a race where the shared memory area is reused before the X
server finished reading data from it. This does NOT fix races where cairo draws
something new to the same cairo_xcb_shm_info_t while the X server still reads
from it. However, there doesn't seem to exist any code currently where the shm
info isn't immediately destroyed after it was used.

This commit fixes the following tests for xcb-render-0.0 if SHM is enabled:

joins mask mask-transformed-image push-group push-group-color radial-gradient
radil-gradient-mask radial-gradient-mask-source radial-gradient-one-stop
radial-gradient-source smask smask-mask smask-paint

This also fixes mesh-pattern-transformed for all the xcb boilerplate "backends".

Signed-off-by: Uli Schlachter <psychon@znc.in>

1 files changed, 11 insertions, 0 deletions

diff --git a/src/cairo-xcb-connection.c b/src/cairo-xcb-connection.c
index 74b9f21a6..73f70b1b3 100644
--- a/src/cairo-xcb-connection.c
+++ b/src/cairo-xcb-connection.c
@@ -479,6 +479,10 @@ _device_flush (void *device)
     if (unlikely (status))
 	return status;
 
+#if CAIRO_HAS_XCB_SHM_FUNCTIONS
+    _cairo_xcb_connection_shm_mem_pools_flush (connection);
+#endif
+
     CAIRO_MUTEX_LOCK (connection->screens_mutex);
     cairo_list_foreach_entry (screen, cairo_xcb_screen_t,
 			      &connection->screens, link)
@@ -540,6 +544,12 @@ _device_finish (void *device)
 	_cairo_xcb_screen_finish (screen);
     }
 
+#if CAIRO_HAS_XCB_SHM_FUNCTIONS
+    /* _cairo_xcb_screen_finish finishes surfaces. If any of those surfaces had
+     * a fallback image, we might have done a SHM PutImage. */
+    _cairo_xcb_connection_shm_mem_pools_flush (connection);
+#endif
+
     if (was_cached)
 	cairo_device_destroy (device);
 }
@@ -643,6 +653,7 @@ _cairo_xcb_connection_get (xcb_connection_t *xcb_connection)
 			  sizeof (cairo_xcb_xid_t));
 
     cairo_list_init (&connection->shm_pools);
+    cairo_list_init (&connection->shm_pending);
     _cairo_freepool_init (&connection->shm_info_freelist,
 			  sizeof (cairo_xcb_shm_info_t));