glx: Don't refer to the request buffer outside of {L,Unl}ockDisplay

... because that's not a safe thing to do.  The request buffer is shared
storage among all threads, and after UnlockDisplay the 'req' pointer may
point into someone else's request.

NOTE: This is a candidate for the 7.10 branch.

Signed-off-by: Adam Jackson <[email protected]>

1 files changed, 4 insertions, 3 deletions

diff --git a/src/glx/glx_pbuffer.c b/src/glx/glx_pbuffer.c
index ad05d95ccb7..5c76c74a2c1 100644
--- a/src/glx/glx_pbuffer.c
+++ b/src/glx/glx_pbuffer.c
@@ -375,6 +375,7 @@ CreateDrawable(Display *dpy, struct glx_config *config,
    CARD32 *data;
    unsigned int i;
    CARD8 opcode;
+   GLXDrawable xid;
 
    i = 0;
    if (attrib_list) {
@@ -395,7 +396,7 @@ CreateDrawable(Display *dpy, struct glx_config *config,
    req->screen = config->screen;
    req->fbconfig = config->fbconfigID;
    req->window = drawable;
-   req->glxwindow = XAllocID(dpy);
+   req->glxwindow = xid = XAllocID(dpy);
    req->numAttribs = i;
 
    if (attrib_list)
@@ -404,9 +405,9 @@ CreateDrawable(Display *dpy, struct glx_config *config,
    UnlockDisplay(dpy);
    SyncHandle();
 
-   CreateDRIDrawable(dpy, config, drawable, req->glxwindow, attrib_list, i);
+   CreateDRIDrawable(dpy, config, drawable, xid, attrib_list, i);
 
-   return req->glxwindow;
+   return xid;
 }