intel: Fix use of freed buffer if glBitmap is called after a swap.

Regions looked up from the framebuffer are invalid after
intel_prepare_render().

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=30266
Tested-by: Thomas Jones <thomas.jones@utoronto.ca>

diff --git a/src/mesa/drivers/dri/intel/intel_pixel_bitmap.c b/src/mesa/drivers/dri/intel/intel_pixel_bitmap.c
index 64c7acce1e976504fa5f4c6857cac6378e2b561b..86d0ef2d748a2968b283170749411c5292afd790 100644 (file)
--- a/src/mesa/drivers/dri/intel/intel_pixel_bitmap.c
+++ b/src/mesa/drivers/dri/intel/intel_pixel_bitmap.c
@@ -175,7 +175,7 @@ do_blit_bitmap( struct gl_context *ctx,
                const GLubyte *bitmap )
 {
    struct intel_context *intel = intel_context(ctx);
-   struct intel_region *dst = intel_drawbuf_region(intel);
+   struct intel_region *dst;
    struct gl_framebuffer *fb = ctx->DrawBuffer;
    GLfloat tmpColor[4];
    GLubyte ubcolor[4];
@@ -198,6 +198,9 @@ do_blit_bitmap( struct gl_context *ctx,
       return GL_FALSE;
    }
 
+   intel_prepare_render(intel);
+   dst = intel_drawbuf_region(intel);
+
    if (!dst)
        return GL_FALSE;
 
@@ -226,8 +229,6 @@ do_blit_bitmap( struct gl_context *ctx,
    if (!intel_check_blit_fragment_ops(ctx, tmpColor[3] == 1.0F))
       return GL_FALSE;
 
-   intel_prepare_render(intel);
-
    /* Clip to buffer bounds and scissor. */
    if (!_mesa_clip_to_region(fb->_Xmin, fb->_Ymin,
                             fb->_Xmax, fb->_Ymax,