llvmpipe: Fix pointer dereference after free.

diff --git a/src/gallium/drivers/llvmpipe/lp_state_fs.c b/src/gallium/drivers/llvmpipe/lp_state_fs.c
index 48c7754e41acbc0070a39bf5d893f96c4af331f3..c3ecd77830b4d1d73c8011843fb568d2d74e223c 100644 (file)
--- a/src/gallium/drivers/llvmpipe/lp_state_fs.c
+++ b/src/gallium/drivers/llvmpipe/lp_state_fs.c
@@ -1079,8 +1079,9 @@ llvmpipe_delete_fs_state(struct pipe_context *pipe, void *fs)
 
    li = first_elem(&shader->variants);
    while(!at_end(&shader->variants, li)) {
+      struct lp_fs_variant_list_item *next = next_elem(li);
       remove_shader_variant(llvmpipe, li->base);
-      li = next_elem(li);
+      li = next;
    }
 
    assert(shader->variants_cached == 0);