intel: Deassociated drawables from private context struct in intelUnbindContext

The generic DRI infrastructure makes sure that __DRIcontextRec::driDrawablePriv
and __DRIcontextRec::driReadablePriv are set to NULL after unbinding a
context.  However, the intel_context structure keeps cached copies of
these pointers.  If these cached pointers are not NULLed and the
drawable is actually destroyed after unbinding the context (typically
by way of glXDestroyWindow), freed memory will be dereferenced in
intelDestroyContext.

This should fix bug #23418.

1 files changed, 8 insertions, 0 deletions

diff --git a/src/mesa/drivers/dri/intel/intel_context.c b/src/mesa/drivers/dri/intel/intel_context.c
index aecb317eb8..7fa70e428d 100644
--- a/src/mesa/drivers/dri/intel/intel_context.c
+++ b/src/mesa/drivers/dri/intel/intel_context.c
@@ -840,6 +840,14 @@ intelDestroyContext(__DRIcontextPrivate * driContextPriv)
 GLboolean
 intelUnbindContext(__DRIcontextPrivate * driContextPriv)
 {
+   struct intel_context *intel =
+      (struct intel_context *) driContextPriv->driverPrivate;
+
+   /* Deassociate the context with the drawables.
+    */
+   intel->driDrawable = NULL;
+   intel->driReadDrawable = NULL;
+
    return GL_TRUE;
 }