Module: Mesa Branch: master Commit: 0ef781c1ae04451ac4f184187e900f872cad5f94 URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=0ef781c1ae04451ac4f184187e900f872cad5f94
Author: Marcin Slusarz <[email protected]> Date: Wed Jan 20 23:27:07 2010 +0100 nv50: fix crash in nv50_pre_pipebuffer_map (nv50_screen->cur_ctx) nv50_pre_pipebuffer_map references screen->cur_ctx which points to freed memory after the context is destroyed. This crash is easily triggerable by progs/xdemos/glxcontexts. --- src/gallium/drivers/nv50/nv50_context.c | 4 ++++ 1 files changed, 4 insertions(+), 0 deletions(-) diff --git a/src/gallium/drivers/nv50/nv50_context.c b/src/gallium/drivers/nv50/nv50_context.c index e2198b1..5c705cc 100644 --- a/src/gallium/drivers/nv50/nv50_context.c +++ b/src/gallium/drivers/nv50/nv50_context.c @@ -86,6 +86,10 @@ nv50_destroy(struct pipe_context *pipe) so_ref(NULL, &nv50->state.vtxattr); draw_destroy(nv50->draw); + + if (nv50->screen->cur_ctx == nv50) + nv50->screen->cur_ctx = NULL; + FREE(nv50); } _______________________________________________ mesa-commit mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/mesa-commit
