Module: Mesa Branch: master Commit: 533320e4d1367f8acb81dab6e1a15bbc3ebb2385 URL: http://cgit.freedesktop.org/mesa/mesa/commit/?id=533320e4d1367f8acb81dab6e1a15bbc3ebb2385
Author: Ian Romanick <[email protected]> Date: Tue Nov 10 18:46:12 2015 -0800 meta/blit: Save and restore the sampler using gl_sampler_object instead of GL API object handle Some meta operations can be called recursively. Future changes (the "Don't pollute the ... namespace" changes) will cause objects with invalid names to be used. If a nested meta operation tries to restore an object named 0xDEADBEEF, it will fail. v2: Add a comment explaining why samp_obj_save is set to NULL in _mesa_meta_fb_tex_blit_begin. This came out of review feedback from Jason. Signed-off-by: Ian Romanick <[email protected]> Reviewed-by: Jason Ekstrand <[email protected]> --- src/mesa/drivers/common/meta.h | 3 ++- src/mesa/drivers/common/meta_blit.c | 17 +++++++++++++---- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/src/mesa/drivers/common/meta.h b/src/mesa/drivers/common/meta.h index 268824c..856dcdb 100644 --- a/src/mesa/drivers/common/meta.h +++ b/src/mesa/drivers/common/meta.h @@ -310,7 +310,8 @@ struct fb_tex_blit_state { GLint baseLevelSave, maxLevelSave; struct gl_sampler_object *samp_obj; - GLuint samplerSave, stencilSamplingSave; + struct gl_sampler_object *samp_obj_save; + GLuint stencilSamplingSave; GLuint tempTex; }; diff --git a/src/mesa/drivers/common/meta_blit.c b/src/mesa/drivers/common/meta_blit.c index 6c03f5d..07bd7e5 100644 --- a/src/mesa/drivers/common/meta_blit.c +++ b/src/mesa/drivers/common/meta_blit.c @@ -810,9 +810,17 @@ void _mesa_meta_fb_tex_blit_begin(const struct gl_context *ctx, struct fb_tex_blit_state *blit) { - blit->samplerSave = - ctx->Texture.Unit[ctx->Texture.CurrentUnit].Sampler ? - ctx->Texture.Unit[ctx->Texture.CurrentUnit].Sampler->Name : 0; + /* None of the existing callers preinitialize fb_tex_blit_state to zeros, + * and both use stack variables. If samp_obj_save is not NULL, + * _mesa_reference_sampler_object will try to dereference it. Leaving + * random garbage in samp_obj_save can only lead to crashes. + * + * Since the state isn't persistent across calls, we won't catch ref + * counting problems. + */ + blit->samp_obj_save = NULL; + _mesa_reference_sampler_object(ctx, &blit->samp_obj_save, + ctx->Texture.Unit[ctx->Texture.CurrentUnit].Sampler); blit->tempTex = 0; } @@ -838,7 +846,8 @@ _mesa_meta_fb_tex_blit_end(struct gl_context *ctx, GLenum target, } } - _mesa_BindSampler(ctx->Texture.CurrentUnit, blit->samplerSave); + _mesa_bind_sampler(ctx, ctx->Texture.CurrentUnit, blit->samp_obj_save); + _mesa_reference_sampler_object(ctx, &blit->samp_obj_save, NULL); _mesa_DeleteSamplers(1, &blit->samp_obj->Name); blit->samp_obj = NULL; _______________________________________________ mesa-commit mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/mesa-commit
