nv50: fix crash in nv50_pre_pipebuffer_map (nv50_screen->cur_ctx)
nv50_pre_pipebuffer_map references screen->cur_ctx which points to freed memory after the context is destroyed. This crash is easily triggerable by progs/xdemos/glxcontexts.
This commit is contained in:
parent
74989972ba
commit
0ef781c1ae
|
@ -86,6 +86,10 @@ nv50_destroy(struct pipe_context *pipe)
|
||||||
so_ref(NULL, &nv50->state.vtxattr);
|
so_ref(NULL, &nv50->state.vtxattr);
|
||||||
|
|
||||||
draw_destroy(nv50->draw);
|
draw_destroy(nv50->draw);
|
||||||
|
|
||||||
|
if (nv50->screen->cur_ctx == nv50)
|
||||||
|
nv50->screen->cur_ctx = NULL;
|
||||||
|
|
||||||
FREE(nv50);
|
FREE(nv50);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue