From 1b89d62eb5ab7aee8df05740cc88fe1481060344 Mon Sep 17 00:00:00 2001
From: John Cupitt <jcupitt@gmail.com>
Date: Fri, 5 Jan 2018 16:27:44 +0000
Subject: [PATCH] fix a race associated with sink_screen

sink_screen was not keeping a ref to its input, so in rare conditions
it could try to make a region on a dead image
---
 ChangeLog                    |  3 +++
 configure.ac                 |  6 +++---
 libvips/iofuncs/init.c       |  1 +
 libvips/iofuncs/sinkscreen.c | 22 ++++++++++++++++++++--
 4 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 7bbc5586..9752d897 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+5/1/18 started 8.6.2
+- vips_sink_screen() keeps a ref to the input image ... stops a rare race
+
 10/12/17 started 8.6.1
 - fix mmap window new/free cycling 
 - fix some compiler warnings
diff --git a/configure.ac b/configure.ac
index c851d1f6..e04893ae 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@
 
 # also update the version number in the m4 macros below
 
-AC_INIT([vips], [8.6.1], [vipsip@jiscmail.ac.uk])
+AC_INIT([vips], [8.6.2], [vipsip@jiscmail.ac.uk])
 # required for gobject-introspection
 AC_PREREQ(2.62)
 
@@ -18,7 +18,7 @@ AC_CONFIG_MACRO_DIR([m4])
 # user-visible library versioning
 m4_define([vips_major_version], [8])
 m4_define([vips_minor_version], [6])
-m4_define([vips_micro_version], [1])
+m4_define([vips_micro_version], [2])
 m4_define([vips_version],
           [vips_major_version.vips_minor_version.vips_micro_version])
 
@@ -38,7 +38,7 @@ VIPS_VERSION_STRING=$VIPS_VERSION-`date -u -r ChangeLog`
 #   binary interface changes not backwards compatible?: reset age to 0
 
 LIBRARY_CURRENT=50
-LIBRARY_REVISION=1
+LIBRARY_REVISION=2
 LIBRARY_AGE=8
 
 # patched into include/vips/version.h
diff --git a/libvips/iofuncs/init.c b/libvips/iofuncs/init.c
index 2e7584f5..4916cd51 100644
--- a/libvips/iofuncs/init.c
+++ b/libvips/iofuncs/init.c
@@ -516,6 +516,7 @@ vips_leak( void )
 
 	fprintf( stderr, "%s", vips_buf_all( &buf ) );
 
+	vips__print_renders();
 
 #ifdef DEBUG
 	vips_buffer_dump_all();
diff --git a/libvips/iofuncs/sinkscreen.c b/libvips/iofuncs/sinkscreen.c
index 909cc022..f003feab 100644
--- a/libvips/iofuncs/sinkscreen.c
+++ b/libvips/iofuncs/sinkscreen.c
@@ -234,6 +234,8 @@ render_free( Render *render )
 	VIPS_FREEF( g_slist_free, render->dirty );
 	VIPS_FREEF( g_hash_table_destroy, render->tiles );
 
+	VIPS_UNREF( render->in ); 
+
 	vips_free( render );
 
 #ifdef VIPS_DEBUG_AMBER
@@ -608,6 +610,10 @@ render_new( VipsImage *in, VipsImage *out, VipsImage *mask,
 	if( !(render = VIPS_NEW( NULL, Render )) )
 		return( NULL );
 
+	/* render must hold a ref to in. This is dropped in render_free().
+	 */
+	g_object_ref( in );
+
 	render->ref_count = 1;
 	render->ref_count_lock = vips_g_mutex_new();
 
@@ -1126,7 +1132,19 @@ void
 vips__print_renders( void )
 {
 #ifdef VIPS_DEBUG_AMBER
-	printf( "%d active renders\n", render_num_renders );
+	if( render_num_renders > 0 )
+		printf( "%d active renders\n", render_num_renders );
 #endif /*VIPS_DEBUG_AMBER*/
-	printf( "%d dirty renders\n", g_slist_length( render_dirty_all ) );
+
+	if( render_dirty_lock ) { 
+		int n_dirty;
+
+		g_mutex_lock( render_dirty_lock );
+
+		n_dirty = g_slist_length( render_dirty_all );
+		if( n_dirty > 0 ) 
+			printf( "%d dirty renders\n", n_dirty );
+
+		g_mutex_unlock( render_dirty_lock );
+	}
 }