From 91b6bf965705e0b87cbe0ed522ca07670f88bcd9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Florian=20M=C3=BCllner?= <fmuellner@gnome.org>
Date: Thu, 3 Mar 2016 16:51:21 +0100
Subject: [PATCH] Include fix for invalid cursor wl_buffer access

---
 ...cess-the-cursor-wl_buffer-when-updat.patch | 70 +++++++++++++++++++
 mutter.spec                                   |  7 +-
 2 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 0001-wayland-Don-t-access-the-cursor-wl_buffer-when-updat.patch

diff --git a/0001-wayland-Don-t-access-the-cursor-wl_buffer-when-updat.patch b/0001-wayland-Don-t-access-the-cursor-wl_buffer-when-updat.patch
new file mode 100644
index 0000000..81bbb63
--- /dev/null
+++ b/0001-wayland-Don-t-access-the-cursor-wl_buffer-when-updat.patch
@@ -0,0 +1,70 @@
+From 96927b34154d7a234eaaf2702027034b6c0395dd Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jonas=20=C3=85dahl?= <jadahl@gmail.com>
+Date: Wed, 2 Mar 2016 14:26:16 +0800
+Subject: [PATCH] wayland: Don't access the cursor wl_buffer when updating the
+ sprite
+
+We may have released the wl_buffer already when doing this, which means
+we should not try to access the wl_buffer content.
+
+Regarding the cursor texture this is not an issue since we can just use
+the texture created in apply_pending_state().
+
+The hw cursor however will only be realized if the surface is already
+using the the buffer (surface->using_buffer == true). This will, at the
+moment, effectively disable hardware cursors for SHM buffers.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=762828
+---
+ src/wayland/meta-wayland-pointer.c | 29 +++++++++++++----------------
+ 1 file changed, 13 insertions(+), 16 deletions(-)
+
+diff --git a/src/wayland/meta-wayland-pointer.c b/src/wayland/meta-wayland-pointer.c
+index 4fb32bb..89dd2cd 100644
+--- a/src/wayland/meta-wayland-pointer.c
++++ b/src/wayland/meta-wayland-pointer.c
+@@ -967,28 +967,25 @@ update_cursor_sprite_texture (MetaWaylandSurface *surface)
+   MetaWaylandSurfaceRoleCursor *cursor_role =
+     META_WAYLAND_SURFACE_ROLE_CURSOR (surface->role);
+   MetaCursorSprite *cursor_sprite = cursor_role->cursor_sprite;
+-  ClutterBackend *clutter_backend = clutter_get_default_backend ();
+-  CoglContext *cogl_context =
+-    clutter_backend_get_cogl_context (clutter_backend);
+-  CoglTexture *texture;
++
++  g_return_if_fail (!surface->buffer || surface->buffer->texture);
+ 
+   if (surface->buffer)
+     {
+-      struct wl_resource *buffer;
+-
+-      buffer = surface->buffer->resource;
+-      texture = cogl_wayland_texture_2d_new_from_buffer (cogl_context,
+-                                                         buffer,
+-                                                         NULL);
+-
+       meta_cursor_sprite_set_texture (cursor_sprite,
+-                                      texture,
++                                      surface->buffer->texture,
+                                       cursor_role->hot_x * surface->scale,
+                                       cursor_role->hot_y * surface->scale);
+-      meta_cursor_renderer_realize_cursor_from_wl_buffer (cursor_renderer,
+-                                                          cursor_sprite,
+-                                                          buffer);
+-      cogl_object_unref (texture);
++
++      if (surface->using_buffer)
++        {
++          struct wl_resource *buffer;
++
++          buffer = surface->buffer->resource;
++          meta_cursor_renderer_realize_cursor_from_wl_buffer (cursor_renderer,
++                                                              cursor_sprite,
++                                                              buffer);
++        }
+     }
+   else
+     {
+-- 
+2.7.1
+
diff --git a/mutter.spec b/mutter.spec
index 79b4b3d..201d618 100644
--- a/mutter.spec
+++ b/mutter.spec
@@ -4,7 +4,7 @@
 
 Name:          mutter
 Version:       3.19.91
-Release:       1%{?dist}
+Release:       2%{?dist}
 Summary:       Window and compositing manager based on Clutter
 
 Group:         User Interface/Desktops
@@ -15,6 +15,7 @@ Source0:       http://download.gnome.org/sources/%{name}/3.19/%{name}-%{version}
 
 # https://bugzilla.redhat.com/show_bug.cgi?id=1200901
 Patch0:        0001-Force-cursor-update-after-applying-configuration.patch
+Patch1:        0001-wayland-Don-t-access-the-cursor-wl_buffer-when-updat.patch
 
 BuildRequires: clutter-devel >= %{clutter_version}
 BuildRequires: pango-devel
@@ -100,6 +101,7 @@ the functionality of the installed %{name} package.
 %prep
 %setup -q
 %patch0 -p1 -b .fix-cursor
+%patch1 -p1 -b .dont-access-cursor-buffer
 
 %build
 autoreconf -f -i
@@ -170,6 +172,9 @@ glib-compile-schemas %{_datadir}/glib-2.0/schemas &> /dev/null || :
 %{_datadir}/mutter/tests
 
 %changelog
+* Thu Mar 03 2016 Florian Müllner <fmuellner@redhat.com> - 3.19.91-2
+- Include fix for invalid cursor wl_buffer access
+
 * Thu Mar 03 2016 Florian Müllner <fmuellner@redhat.com> - 3.19.91-1
 - Update to 3.19.91