From 533320e4d1367f8acb81dab6e1a15bbc3ebb2385 Mon Sep 17 00:00:00 2001 From: Ian Romanick Date: Tue, 10 Nov 2015 18:46:12 -0800 Subject: [PATCH] meta/blit: Save and restore the sampler using gl_sampler_object instead of GL API object handle Some meta operations can be called recursively. Future changes (the "Don't pollute the ... namespace" changes) will cause objects with invalid names to be used. If a nested meta operation tries to restore an object named 0xDEADBEEF, it will fail. v2: Add a comment explaining why samp_obj_save is set to NULL in _mesa_meta_fb_tex_blit_begin. This came out of review feedback from Jason. Signed-off-by: Ian Romanick Reviewed-by: Jason Ekstrand --- src/mesa/drivers/common/meta.h | 3 ++- src/mesa/drivers/common/meta_blit.c | 17 +++++++++++++---- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/src/mesa/drivers/common/meta.h b/src/mesa/drivers/common/meta.h index 268824cfcb0..856dcdbad7c 100644 --- a/src/mesa/drivers/common/meta.h +++ b/src/mesa/drivers/common/meta.h @@ -310,7 +310,8 @@ struct fb_tex_blit_state { GLint baseLevelSave, maxLevelSave; struct gl_sampler_object *samp_obj; - GLuint samplerSave, stencilSamplingSave; + struct gl_sampler_object *samp_obj_save; + GLuint stencilSamplingSave; GLuint tempTex; }; diff --git a/src/mesa/drivers/common/meta_blit.c b/src/mesa/drivers/common/meta_blit.c index 6c03f5dd778..07bd7e5016a 100644 --- a/src/mesa/drivers/common/meta_blit.c +++ b/src/mesa/drivers/common/meta_blit.c @@ -810,9 +810,17 @@ void _mesa_meta_fb_tex_blit_begin(const struct gl_context *ctx, struct fb_tex_blit_state *blit) { - blit->samplerSave = - ctx->Texture.Unit[ctx->Texture.CurrentUnit].Sampler ? - ctx->Texture.Unit[ctx->Texture.CurrentUnit].Sampler->Name : 0; + /* None of the existing callers preinitialize fb_tex_blit_state to zeros, + * and both use stack variables. If samp_obj_save is not NULL, + * _mesa_reference_sampler_object will try to dereference it. Leaving + * random garbage in samp_obj_save can only lead to crashes. + * + * Since the state isn't persistent across calls, we won't catch ref + * counting problems. + */ + blit->samp_obj_save = NULL; + _mesa_reference_sampler_object(ctx, &blit->samp_obj_save, + ctx->Texture.Unit[ctx->Texture.CurrentUnit].Sampler); blit->tempTex = 0; } @@ -838,7 +846,8 @@ _mesa_meta_fb_tex_blit_end(struct gl_context *ctx, GLenum target, } } - _mesa_BindSampler(ctx->Texture.CurrentUnit, blit->samplerSave); + _mesa_bind_sampler(ctx, ctx->Texture.CurrentUnit, blit->samp_obj_save); + _mesa_reference_sampler_object(ctx, &blit->samp_obj_save, NULL); _mesa_DeleteSamplers(1, &blit->samp_obj->Name); blit->samp_obj = NULL; -- 2.30.2