nv50: fix crash in nv50_pre_pipebuffer_map (nv50_screen->cur_ctx)

nv50_pre_pipebuffer_map references screen->cur_ctx which points
to freed memory after the context is destroyed.
This crash is easily triggerable by progs/xdemos/glxcontexts.

diff --git a/src/gallium/drivers/nv50/nv50_context.c b/src/gallium/drivers/nv50/nv50_context.c
index e2198b189dad34d575d48b02a0b9dc5c4df95688..5c705ccc8f180c09fbf8c703e05ed508fda16727 100644 (file)
--- a/src/gallium/drivers/nv50/nv50_context.c
+++ b/src/gallium/drivers/nv50/nv50_context.c
@@ -86,6 +86,10 @@ nv50_destroy(struct pipe_context *pipe)
                so_ref(NULL, &nv50->state.vtxattr);
 
        draw_destroy(nv50->draw);
+
+       if (nv50->screen->cur_ctx == nv50)
+               nv50->screen->cur_ctx = NULL;
+
        FREE(nv50);
 }