Mesa (master): nvc0/ir: fix use after free in texture barrier insertion pass

Christoph Bumiller chrisbmr at kemper.freedesktop.org
Sun Sep 1 19:00:05 UTC 2013


Module: Mesa
Branch: master
Commit: 7086636358b611a2bb124253e1fe870107e1cecb
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=7086636358b611a2bb124253e1fe870107e1cecb

Author: Tiziano Bacocco <tizbac2 at gmail.com>
Date:   Tue Jul 30 22:04:49 2013 +0200

nvc0/ir: fix use after free in texture barrier insertion pass

Fixes crash with Amnesia: The Dark Descent.

Cc: "9.2 and 9.1" <mesa-stable at lists.freedesktop.org>

---

 .../drivers/nvc0/codegen/nv50_ir_lowering_nvc0.cpp |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/src/gallium/drivers/nvc0/codegen/nv50_ir_lowering_nvc0.cpp b/src/gallium/drivers/nvc0/codegen/nv50_ir_lowering_nvc0.cpp
index 251e49b..1832e1a 100644
--- a/src/gallium/drivers/nvc0/codegen/nv50_ir_lowering_nvc0.cpp
+++ b/src/gallium/drivers/nvc0/codegen/nv50_ir_lowering_nvc0.cpp
@@ -443,6 +443,7 @@ NVC0LegalizePostRA::insertTextureBarriers(Function *fn)
          if (i->op == OP_TEXBAR) {
             if (i->subOp >= max) {
                delete_Instruction(prog, i);
+               i = NULL;
             } else {
                max = i->subOp;
                if (prev && prev->op == OP_TEXBAR && prev->subOp >= max) {
@@ -454,7 +455,7 @@ NVC0LegalizePostRA::insertTextureBarriers(Function *fn)
          if (isTextureOp(i->op)) {
             max++;
          }
-         if (!i->isNop())
+         if (i && !i->isNop())
             prev = i;
       }
    }




More information about the mesa-commit mailing list