This fixes a crash in the case where the last cursor was a client surface
cursor but then transitioned into a server managed xcursor that isn't
available. Because the logic would return early before, we would continue
to reference a texture pointer belonging to a client surface but would
otherwise disassociate with it (we wouldn't clear the cursor if the surface
is destroyed) resulting an an eventual UAF.
Let's just make the cursor invisible if we don't know what to show. It's
compositor policy if they want to show a default.
Co-authored-by: Scott Moreau <oreaus@gmail.com>
Fixes: #3686
If the underlying surface is destroyed, but the client has not yet
destroyed the server decoration object, and then tries to call
request_mode() on it, the compositor will crash, because the
wlr_server_decoration struct has been freed, and the wl_resource's
user_data member has been NULLed out.
Yes, this is certainly an error for the client to do that, but I
shouldn't be able to write a buggy (or malicious) Wayland app that can
take down the entire compositor.
wlr_renderer_read_pixels does not need to be called inside a render
pass; rather, it only needs to have the correct buffer bound to
the renderer. This commit optimizes the implementation of
frame_shm_copy(...) by only binding the source buffer instead of
starting a no-op render pass with it.
These states would be set if output_init is invoked with a enabled state.
This would make frame_pending == true which means wlroots will ignore
any further frame events and the compositor will appear dead.
Up until now, frame/present events were only triggered when the
user submitted a buffer. Change the wlr_output API so that these
events are triggered when any commit is applied on an enabled
output.
Closes: https://gitlab.freedesktop.org/wlroots/wlroots/-/issues/3708
It's still not possible to commit while a page flip is pending in DRM,
but we don't need to enforce that here and allowing it through the
common interface can be useful for other backends.
This decouples commits from frame scheduling, which is going to make the
new frame schedulers easier to implement.
When setting a custom mode current_mode will not be reset. That means
that next time the compositor tries to reset back from the custom mode,
it will compare against the stale current_mode and unset
WLR_OUTPUT_STATE_MODE erroneously.
We can just use a regular assignment instead. This is more
type-safe since there is no need to provide the struct size.
The remaining memcpy() calls perform array copies or copies from
void pointers (which may be unaligned).
When a wlr_output add to wlr_output_layout, wlr_cursor will create
wlr_buffer of xcursor for the wlr_output, this behavior depends
wlr_renderer of wlr_output, using assert to ensure renderer is
initialized before wlr_output_layout_add and wlr_cursor_set_buffer/
wlr_cursor_set_xcursor.
Opaque region is a optimization hint, (bugs outstanding) it will not
change the output contents, therefore damage does not need to be submitted.
However, we still need to update the visibility state of the other
nodes in the tree. To do this call scene_update_region() by ourselves
but not `scene_node_update()` which will damage the outputs.
We need to intersect the opaque region with the node size or else we'll
get damage tracking effects with compositors attempting to use
wlr_scene_buffer_set_opaque_region() along with resizing the buffer
at the same time in a certain order.
Consider this: I have a new buffer that I want to commit to my scene buffer
that is smaller than the old one. However, I still have the old opaque
region that is the size of the old larger buffer, so that means that
for the small moment between when we reconfigure the opaque region for the
new buffer the opaque region will be oversized. Scene logic will then
try to apply occluding optimizations outside of the node boundaries
causing damage artifacts.
Add the missing lock_surface_destroy which was removed in dc7686c114
("session-lock: don't remove inert role resource"). Otherwise we never
remove the surface from our internal state, leading to us killing the
locking daemon with a protocol error that is totally our fault.
needs_frame is for backends to trigger frames for reasons that
compositors couldn't see coming. schedule_frame is freaky and I want to
remove it. These protocols aren't backends but in this case they're
close enough, so switch to needs_frame.
CC #3664
Without a round in this case the damage region is translated to truncated coordinates, potentially
misplacing it relative to the actual position of that region in the output buffer.
The backend is not able to tell whether a surface is being
presented via direct scan-out or not. The backend will set
ZERO_COPY if the buffer submitted via the output commit was
presented in a zero-copy fashion, but will no know whether the
buffer comes from the compositor or the client.
Using "present" is confusing here: the event is emitted when the
buffer is being sampled to be displayed on an output, not when it's
being presented on-screen.
Rename to match the presentation-time terminology.
Now that role objects are stored as resources, we can distinguish
the inert object case from it being destroyed by the client:
- When the resource is destroyed by the client, role_resource == NULL
- When the resource is made inert, role_resource != NULL but its
user_data is NULL
This function takes a pointer to memory with a hardcoded format
and many parameters to describe the pixel buffer.
wlr_output_cursor_set_buffer() can be used instead.
Stop using wlr_output_cursor_set_image() because it's getting
dropped. Instead, use wlr_output_cursor_set_buffer().
This mirrors what wlr_output_cursor_set_image() is doing
under-the-hood.
A saner replacement for wlr_cursor_set_image():
- Takes a wlr_buffer instead of numerous parameters and a hardcoded
format.
- The scale is not used to filter outputs.
- A ref to the buffer is kept to apply it to new outputs.
By adding a sent_feedback bool into the list entry that we can mutate
we no longer need to maintain this `sent_direct_scanout_feedback` variable.
sent_feedback will also be useful for output layers.
This changes the semantics of wlr_output_state. Instead of having
fields with uninitialized memory when missing from the committed
bitflag, all fields are always initialized (and maybe NULL/empty),
just like we do in wlr_surface_state. This reduces the chances of
footguns when reading a field, and removes the need to check for
the committed bitfield everywhere.
A new wlr_output_state_init() function takes care of initializing
the Pixman region.
This increases type safety, makes it more obvious that role_data
must represent the role object, and will allow for automatic
cleanup when the resource is destroyed.
This commit allows to make a role as not represented by an object,
which fixes calling role commit handlers for roles like cursor
surfaces.
Fixes: 099b9de752
Alexander Orzechowski
Simon Zeni
vaxerski
Brian J. Tarricone
Manuel Stoeckl
Leo Li
Kirill Primak
Simon Ser
Rose Hudson
Leonardo Hernández Hernández
JiDe Zhang
Rouven Czerwinski
Ronan Pigott
Alexander Orzechowski