Bug#615197: xserver-xorg-video-intel: Screen corruptions to due insufficient clipping

[Thomas Richter <thor@math.tu-berlin.de>]

Hi Cyril,

> Thomas Richter<thor@math.tu-berlin.de>  (26/02/2011):
> > Apparently, clipping the line drawing or rectangle drawing operation
> > to the visible part of the xpdf main window does not work correctly
> > and renders also into the requester window on top of it instead of
> > clipping to the visible part only.
> >
> > This bug does not go away by disabling the "Tiling" option, or the
> > "Dri2" extension, or the "AIGLX" option of the X server. The old
> > i810 intel driver, however, handled this correctly in the "lenny"
> > distribution.
> >
> > This bug may be a duplicate of 592855,596085,614296,554427,558396.
> >
> > Note that the kernel is already a 2.6.35.11, not the native Debian
> > kernel. However, the bug also appears on with native Debian kernel as
> > well.
>
> (FWIW, since you're talking about the kernel, there's 2.6.37 in sid
> and 2.6.38rc* in experimental)
>
> If that's only an issue on the X intel driver side, you may want to
> check what happens with src:libdrm and src:xserver-xorg-video-intel
> rebuilt on squeeze. We plan to provide with backports, as described
> here:
>    http://pkg-xorg.alioth.debian.org/reference/squeeze-backports.html

I finally found the bug. It persists in 2.15.0. A patch for the bug is 
included.

The bug is in uxa/uxa-accel.c, in the function uxa_fill_spans(). The 
problem is that the clipping performed in lines 180ff does not include a 
check for y2 of the clipped region. The fixed code reads as follows:

pbox = REGION_RECTS(pClip);
while (nbox--) {
	if (pbox->y1 > fullY1)
		break;
	if (pbox->y1 <= fullY1 && pbox->y2 > fullY1 /*<--bug here */ ) {
		partX1 = pbox->x1;
		if (partX1 < fullX1)
			partX1 = fullX1;

		partX2 = pbox->x2;
		if (partX2 > fullX2)
			partX2 = fullX2;

		if (partX2 > partX1) {
			uxa_screen->info->composite(dst_pixmap,
					    0, 0, 0, 0,
					    partX1 + off_x,
					    fullY1 + off_y,
					    partX2 - partX1, 1);
		}
	}
	pbox++;
}

The bug is the missing check of "fullY1" against the lower bottom of the 
clipping rectangle, pbox->y2.

Greetings,
	Thomas