summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMarcin Slusarz <marcin.slusarz@gmail.com>2010-01-20 23:27:07 +0100
committerBen Skeggs <bskeggs@redhat.com>2010-01-25 09:44:34 +1000
commit0ef781c1ae04451ac4f184187e900f872cad5f94 (patch)
treeccbb806716e2fdaf5d986f7a8be61ff33061be40
parent74989972ba4fd629905799ed2181f8f6f4e53c2b (diff)
nv50: fix crash in nv50_pre_pipebuffer_map (nv50_screen->cur_ctx)
nv50_pre_pipebuffer_map references screen->cur_ctx which points to freed memory after the context is destroyed. This crash is easily triggerable by progs/xdemos/glxcontexts.
-rw-r--r--src/gallium/drivers/nv50/nv50_context.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/src/gallium/drivers/nv50/nv50_context.c b/src/gallium/drivers/nv50/nv50_context.c
index e2198b189d..5c705ccc8f 100644
--- a/src/gallium/drivers/nv50/nv50_context.c
+++ b/src/gallium/drivers/nv50/nv50_context.c
@@ -86,6 +86,10 @@ nv50_destroy(struct pipe_context *pipe)
so_ref(NULL, &nv50->state.vtxattr);
draw_destroy(nv50->draw);
+
+ if (nv50->screen->cur_ctx == nv50)
+ nv50->screen->cur_ctx = NULL;
+
FREE(nv50);
}