Mesa (master): nv50: fix crash in nv50_pre_pipebuffer_map (nv50_screen-> cur_ctx)
Ben Skeggs
darktama at kemper.freedesktop.org
Sun Jan 24 23:49:23 UTC 2010
Module: Mesa
Branch: master
Commit: 0ef781c1ae04451ac4f184187e900f872cad5f94
URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=0ef781c1ae04451ac4f184187e900f872cad5f94
Author: Marcin Slusarz <marcin.slusarz at gmail.com>
Date: Wed Jan 20 23:27:07 2010 +0100
nv50: fix crash in nv50_pre_pipebuffer_map (nv50_screen->cur_ctx)
nv50_pre_pipebuffer_map references screen->cur_ctx which points
to freed memory after the context is destroyed.
This crash is easily triggerable by progs/xdemos/glxcontexts.
---
src/gallium/drivers/nv50/nv50_context.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/src/gallium/drivers/nv50/nv50_context.c b/src/gallium/drivers/nv50/nv50_context.c
index e2198b1..5c705cc 100644
--- a/src/gallium/drivers/nv50/nv50_context.c
+++ b/src/gallium/drivers/nv50/nv50_context.c
@@ -86,6 +86,10 @@ nv50_destroy(struct pipe_context *pipe)
so_ref(NULL, &nv50->state.vtxattr);
draw_destroy(nv50->draw);
+
+ if (nv50->screen->cur_ctx == nv50)
+ nv50->screen->cur_ctx = NULL;
+
FREE(nv50);
}
More information about the mesa-commit
mailing list