Hide Forgot
Description of problem: When spice client connects/reconnects to the server, the red_worker might reach a scenario where it tries to remove from the "current tree" an item that has already been removed and released. Specifically: 1. client is not connected 2. surface's x current tree contains drawable d1 3. client gets connected 4. drawable d2 is being processed. It has the same surface and region as d1. 5. red_current_add_equal is called (i) red_pipe_add_drawable(d2) is called ==> since the client wasn’t connected before, red_handle_drawable_surfaces_client_synced performs red_current_flush on surface x. (ii) remove_drawable(d2) is called while d2 is no longer in "current" and has already been released. (iii) ASSERT(item->next != NULL && item->prev != NULL) occurs in the call to ring_remove in current_remove_drawable How reproducible: I encountered the crash while preforming tests on S3/4 support (the patches are not yet committed). The guest was Windows xp. 1) I logged in 2) I started playing a movie with VLC, and then I performed standby. 3) While returning from stand by, I disconnected the client and reconnected it. Then the crash occurred. However, this bug is not related to S3 and exists since offscreen surfaces were introduced (RHEL 6.1)
Created attachment 504884 [details] proposed solution
Created attachment 512413 [details] solution v2 This version is more efficient since it removes the other_drawable from the tree before red_handle_drawable_surfaces_client_synced is called. In this manner, other_drawable won't be unnecessarily rendered if update_area is called.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1634.html