dri/common: clear the loaderPrivate pointer in driDestroyDrawable
The GLX specification says about glXDestroyPixmap:
"The storage for the GLX pixmap will be freed when it is not current
to any client."
We're not really following this language to the letter: some of the storage
is freed immediately (in particular, the dri3_drawable, which contains both
GLXDRIdrawable and loader_dri3_drawable). So we NULL out the pointers to
that freed storage; the previous patches added the corresponding NULL-pointer
checks.
This fixes memory corruption in piglit
./bin/glx-visuals-depth/stencil -pixmap -auto
Cc: 17.0 <mesa-stable@lists.freedesktop.org>
Reviewed-by: Marek Olšák <marek.olsak@amd.com>
Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
(cherry picked from commit 7be0e602ed82d25b9f0db77748618c663d9cbfe7)
diff --git a/src/mesa/drivers/dri/common/dri_util.c b/src/mesa/drivers/dri/common/dri_util.c
index 209a42a..fc12b3b 100644
--- a/src/mesa/drivers/dri/common/dri_util.c
+++ b/src/mesa/drivers/dri/common/dri_util.c
@@ -645,6 +645,8 @@
{
__DRIdrawable *pdraw;
+ assert(data != NULL);
+
pdraw = malloc(sizeof *pdraw);
if (!pdraw)
return NULL;
@@ -674,6 +676,16 @@
static void
driDestroyDrawable(__DRIdrawable *pdp)
{
+ /*
+ * The loader's data structures are going away, even if pdp itself stays
+ * around for the time being because it is currently bound. This happens
+ * when a currently bound GLX pixmap is destroyed.
+ *
+ * Clear out the pointer back into the loader's data structures to avoid
+ * accessing an outdated pointer.
+ */
+ pdp->loaderPrivate = NULL;
+
dri_put_drawable(pdp);
}
