st/mesa: fix sampler_view destruction bug when texture is shared

Since texture's can be shared by many contexts, the texture's sampler
view's context pointer might be invalid by time we delete the texture.

Prevent crashes/etc by setting the sampler view's context to be the
calling context before deleting it.  This should be safe as long as
all contexts which share the texture are using the same gallium driver.
That's a reasonable assumption since pipe_texture objects aren't
compatible between different drivers anyway.

diff --git a/src/mesa/state_tracker/st_cb_texture.c b/src/mesa/state_tracker/st_cb_texture.c
index d7a774aa409940d05d01a7ad513a10cbcfde849d..bda17cdc92f7a34a840b47e2dc871bd1ec816a5f 100644 (file)
--- a/src/mesa/state_tracker/st_cb_texture.c
+++ b/src/mesa/state_tracker/st_cb_texture.c
@@ -124,9 +124,17 @@ st_DeleteTextureObject(GLcontext *ctx,
    struct st_texture_object *stObj = st_texture_object(texObj);
    if (stObj->pt)
       pipe_texture_reference(&stObj->pt, NULL);
-   if (stObj->sampler_view)
+   if (stObj->sampler_view) {
+      if (stObj->sampler_view->context != ctx->st->pipe) {
+         /* Take "ownership" of this texture sampler view by setting
+          * its context pointer to this context.  This avoids potential
+          * crashes when the texture object is shared among contexts
+          * and the original/owner context has already been destroyed.
+          */
+         stObj->sampler_view->context == ctx->st->pipe;
+      }
       pipe_sampler_view_reference(&stObj->sampler_view, NULL);
-
+   }
    _mesa_delete_texture_object(ctx, texObj);
 }