Module: Mesa Branch: master Commit: a0a0a909f21acfcddaab603079ba98266e8daf0e URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=a0a0a909f21acfcddaab603079ba98266e8daf0e
Author: Kenneth Graunke <[email protected]> Date: Wed Jan 4 15:45:49 2012 -0800 i965: Fix infinite loop regression in intel_miptree_all_slices_resolve. Commit 0ed11e333147e280208d9d0b3ff3f39970547643 fixed a "use after free" bug by getting the next pointer before deleting the current node. Unfortunately, it also made "next" never get updated if i->need != need. Fixes infinite loops in piglit tests fbo-depth-array and fbo-depthtex. Signed-off-by: Kenneth Graunke <[email protected]> Reviewed-by: Eric Anholt <[email protected]> Reviewed-by: Ian Romanick <[email protected]> --- src/mesa/drivers/dri/intel/intel_mipmap_tree.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/src/mesa/drivers/dri/intel/intel_mipmap_tree.c b/src/mesa/drivers/dri/intel/intel_mipmap_tree.c index 7787c1a..4e1a502 100644 --- a/src/mesa/drivers/dri/intel/intel_mipmap_tree.c +++ b/src/mesa/drivers/dri/intel/intel_mipmap_tree.c @@ -643,10 +643,10 @@ intel_miptree_all_slices_resolve(struct intel_context *intel, struct intel_resolve_map *i, *next; for (i = mt->hiz_map.next; i; i = next) { + next = i->next; if (i->need != need) continue; func(intel, mt, i->level, i->layer); - next = i->next; intel_resolve_map_remove(i); did_resolve = true; } _______________________________________________ mesa-commit mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/mesa-commit
