From 9b04abe36812a34ba447e5b1f8d8e44a10510820 Mon Sep 17 00:00:00 2001 From: Brian Paul Date: Fri, 10 Aug 2012 09:12:50 -0600 Subject: [PATCH] st/mesa: fix glCopyTexSubImage crash Fixes a WebGL crash. The dest texture image is at level 2 and is of size 1x1 texel. The st texture image is a stand-alone resource, not a pointer into a complete mipmap. So the resource has one level and trying to write to level 2 blows up. Fixes http://bugs.freedesktop.org/show_bug.cgi?id=53314 and http://bugs.freedesktop.org/show_bug.cgi?id=53319 Note: This is a candidate for the 8.0 branch. Reviewed-by: Jose Fonseca --- src/mesa/state_tracker/st_cb_texture.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/mesa/state_tracker/st_cb_texture.c b/src/mesa/state_tracker/st_cb_texture.c index a7f57b96f27..92ce3fa2073 100644 --- a/src/mesa/state_tracker/st_cb_texture.c +++ b/src/mesa/state_tracker/st_cb_texture.c @@ -1004,14 +1004,22 @@ st_CopyTexSubImage(struct gl_context *ctx, GLuint dims, !do_flip) { /* use surface_copy() / blit */ struct pipe_box src_box; + unsigned dstLevel; + u_box_2d_zslice(srcX, srcY, strb->surface->u.tex.first_layer, width, height, &src_box); + /* If stImage->pt is an independent image (not a pointer into a full + * mipmap) stImage->pt.last_level will be zero and we need to use that + * as the dest level. + */ + dstLevel = MIN2(stImage->base.Level, stImage->pt->last_level); + /* for resource_copy_region(), y=0=top, always */ pipe->resource_copy_region(pipe, /* dest */ stImage->pt, - stImage->base.Level, + dstLevel, destX, destY, destZ + stImage->base.Face, /* src */ strb->texture, -- 2.30.2