st/mesa: fix sampler_view destruction bug when texture is shared

Since texture's can be shared by many contexts, the texture's sampler
view's context pointer might be invalid by time we delete the texture.

Prevent crashes/etc by setting the sampler view's context to be the
calling context before deleting it.  This should be safe as long as
all contexts which share the texture are using the same gallium driver.
That's a reasonable assumption since pipe_texture objects aren't
compatible between different drivers anyway.

1 files changed, 10 insertions, 2 deletions

diff --git a/src/mesa/state_tracker/st_cb_texture.c b/src/mesa/state_tracker/st_cb_texture.c
index d7a774aa40..bda17cdc92 100644
--- a/src/mesa/state_tracker/st_cb_texture.c
+++ b/src/mesa/state_tracker/st_cb_texture.c
@@ -124,9 +124,17 @@ st_DeleteTextureObject(GLcontext *ctx,
    struct st_texture_object *stObj = st_texture_object(texObj);
    if (stObj->pt)
       pipe_texture_reference(&stObj->pt, NULL);
-   if (stObj->sampler_view)
+   if (stObj->sampler_view) {
+      if (stObj->sampler_view->context != ctx->st->pipe) {
+         /* Take "ownership" of this texture sampler view by setting
+          * its context pointer to this context.  This avoids potential
+          * crashes when the texture object is shared among contexts
+          * and the original/owner context has already been destroyed.
+          */
+         stObj->sampler_view->context == ctx->st->pipe;
+      }
       pipe_sampler_view_reference(&stObj->sampler_view, NULL);
-
+   }
    _mesa_delete_texture_object(ctx, texObj);
 }