The render thread freed the overlays as soon as it exited, while the
main thread could still be dispatching display server input callbacks
that iterate them. Free the overlays in lg_shutdown instead, once the
render thread has been joined and the display server has shut down.
The overlays now outlive the renderer, so overlayFreeImage must not
call into it; renderer deinitialization has already destroyed all
textures along with the context.
evdev_stop was never called, and calling it revealed unsafe teardown:
the device list was freed before the thread was joined, a zero epoll
descriptor was mistaken for a valid one, and the device loops walked
past the end of the array through a sentinel that does not exist.
Join the thread in evdev_stop and defer the rest to the new evdev_free.
The display server grab hooks route into evdev until its event thread
is joined, so the device state must stay valid until the display
server has been freed; evdev_free then restores the hooks and releases
the state.
setWindowSize is called from the render, frame and transport threads,
but shellResize issues shell requests and, with the libdecor GTK
plugin, renders the window decorations through pango, none of which is
thread safe. A frame thread exiting after such a call crashed in the
pango fontmap destructor during thread teardown.
Publish the requested size atomically and wake the event loop through
an eventfd registered in the epoll; the poll callback applies the size
on the event-loop thread. Concurrent requests coalesce into the most
recent one.
Report expected and current protocol versions through the transport
interface and expose session-independent recovery operations.
Offer recovery from the version mismatch popup, publish requests through
the reserved IVSHMEM channel, and select the validated SPICE fallback.
Add a protocol-independent recovery channel outside LGMP so clients can
request a usable guest display even when transport versions differ.
Synchronize recovery state with the helper across driver restarts and
restore the configured topology without persisting temporary changes.
Define a fixed, protocol-independent recovery ABI in the final 64 KiB
of IVSHMEM.
Provide crash-safe multi-client requests and coherent producer status.
Exclude the region from LGMP allocation and frame capacity so future
protocol mismatches retain a stable control path.
Make CSRWLock own the native lock and provide scoped guards for shared,
exclusive, early-unlock, and non-blocking use.
Replace direct SRW lock management throughout the IDD, input driver,
and helper while preserving the existing lock scopes.
Register SPICE connection and component options in the SPICE transport.
Move generic input and clipboard settings out of the SPICE namespace,
while retaining migration aliases for existing configurations.
Keep PureSpice and usbredir build requirements private to the transport,
and remove obsolete SPICE configuration state from the client core.
Track primary and fallback video with source-specific generations, and
publish a source only after its first frame or software surface is
ready.
Route SPICE surfaces and cursors through the generic render queue. Keep
the current image across handoffs, and switch input only after the new
source has been presented.
Move fallback activation to its worker so display callbacks cannot
block or deadlock the render path.
