The entire assert statement is currently being dropped when NDEBUG is defined
which causes mappings to never be cleaned up on bo destruction. When mappings
are not cleaned up, a new buffer that gets a recycled handle may find an old
mapping in drv_bo_map() which is not valid for the new buffer.
BUG=b:
123764798
TEST=built and ran with cuttlefish locally
Change-Id: Ib7147c3f5ed3a2b84793dfc2b17236ee0d92ac13
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/minigbm/+/
1912760
Tested-by: Jason Macnak <natsu@google.com>
Reviewed-by: Stéphane Marchesin <marcheu@chromium.org>
Reviewed-by: Gurchetan Singh <gurchetansingh@chromium.org>
Commit-Queue: Jason Macnak <natsu@google.com>
void drv_bo_destroy(struct bo *bo)
{
+ int ret;
size_t plane;
uintptr_t total = 0;
struct driver *drv = bo->drv;
pthread_mutex_unlock(&drv->driver_lock);
if (total == 0) {
- assert(drv_mapping_destroy(bo) == 0);
+ ret = drv_mapping_destroy(bo);
+ assert(ret == 0);
bo->drv->backend->bo_destroy(bo);
}