Mesa (staging/21.3): i965: Avoid NULL drawbuffer in brw_flush_front

[GitLab Mirror]

Module: Mesa
Branch: staging/21.3
Commit: eaf282c15abebe590428bee71846bf296df6d112
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=eaf282c15abebe590428bee71846bf296df6d112

Author: Kenneth Graunke <kenneth at whitecape.org>
Date:   Wed Feb  2 02:30:34 2022 -0800

i965: Avoid NULL drawbuffer in brw_flush_front

Commit 17e62a3c23f68df802bcbfdab947dff4226fa281 made _mesa_make_current
begin calling ctx->Driver.Flush() in more cases, including when called
during context destruction, after _mesa_free_context_data has set
ctx->DrawBuffer to NULL.  i965's flush hook wasn't prepared for this,
and assumed that ctx->DrawBuffer was non-NULL.  This led to a crash
with the following backtrace:

 #0 0x00007ffff5bf97b5 in _mesa_is_winsys_fbo (fb=0x0)
    at ../../src/mesa/main/fbobject.h:52
 #1 0x00007ffff5bfa359 in brw_flush_front (ctx=0x5555555a4110)
    at ../../src/mesa/drivers/dri/i965/brw_context.c:242
 #2 0x00007ffff5bfa587 in brw_glFlush (ctx=0x5555555a4110,
    gallium_flush_flags=0) at ../../src/mesa/drivers/dri/i965/brw_context.c:301
 #3 0x00007ffff5d46b2b in _mesa_make_current (newCtx=0x0, drawBuffer=0x0,
    readBuffer=0x0) at ../../src/mesa/main/context.c:1616
 #4 0x00007ffff5d46484 in _mesa_free_context_data (ctx=0x5555555a4110,
    destroy_debug_output=true) at ../../src/mesa/main/context.c:1309
 #5 0x00007ffff5bfcb59 in brw_destroy_context (driContextPriv=0x555555590260)
    at ../../src/mesa/drivers/dri/i965/brw_context.c:1301

There is really no point in worrying about front buffer flushing during
the context's destruction when we've already discarded the drawbuffer,
so just add a NULL check in brw_flush_front and skip that work.

Fixes: 17e62a3c23f ("mesa: (correctly) flush more in _mesa_make_current")
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/5957
Reviewed-by: Adam Jackson <ajax at redhat.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/14828>

---

 src/mesa/drivers/dri/i965/brw_context.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/mesa/drivers/dri/i965/brw_context.c b/src/mesa/drivers/dri/i965/brw_context.c
index 24c60af711c..55a1c8fd7f3 100644
--- a/src/mesa/drivers/dri/i965/brw_context.c
+++ b/src/mesa/drivers/dri/i965/brw_context.c
@@ -239,7 +239,8 @@ brw_flush_front(struct gl_context *ctx)
    __DRIdrawable *driDrawable = driContext->driDrawablePriv;
    __DRIscreen *const dri_screen = brw->screen->driScrnPriv;
 
-   if (brw->front_buffer_dirty && _mesa_is_winsys_fbo(ctx->DrawBuffer)) {
+   if (brw->front_buffer_dirty && ctx->DrawBuffer &&
+       _mesa_is_winsys_fbo(ctx->DrawBuffer)) {
       if (flushFront(dri_screen) && driDrawable &&
           driDrawable->loaderPrivate) {