i965: Unmap the correct pointer after discontiguous upload

Fixes piglit/fbo-depth-sample-compare:

==14722== Invalid free() / delete / delete[]
==14722==    at 0x4C240FD: free (vg_replace_malloc.c:366)
==14722==    by 0x84FBBFD: intel_upload_unmap (intel_buffer_objects.c:695)
==14722==    by 0x85205BC: brw_prepare_vertices (brw_draw_upload.c:457)
==14722==    by 0x852F975: brw_validate_state (brw_state_upload.c:394)
==14722==    by 0x851FA24: brw_draw_prims (brw_draw.c:365)
==14722==    by 0x85F2221: vbo_exec_vtx_flush (vbo_exec_draw.c:389)
==14722==    by 0x85EF443: vbo_exec_FlushVertices_internal (vbo_exec_api.c:543)
==14722==    by 0x85EF49B: vbo_exec_FlushVertices (vbo_exec_api.c:973)
==14722==    by 0x86D6A16: _mesa_set_enable (enable.c:351)
==14722==    by 0x42CAD1: render_to_fbo (in /home/ickle/git/piglit/bin/fbo-depth-sample-compare)
==14722==    by 0x42CEE3: piglit_display (in /home/ickle/git/piglit/bin/fbo-depth-sample-compare)
==14722==    by 0x42F508: display (in /home/ickle/git/piglit/bin/fbo-depth-sample-compare)
==14722==  Address 0xc606310 is 0 bytes after a block of size 18,720 alloc'd
==14722==    at 0x4C244E8: malloc (vg_replace_malloc.c:236)
==14722==    by 0x85202AB: copy_array_to_vbo_array (brw_draw_upload.c:256)
==14722==    by 0x85205BC: brw_prepare_vertices (brw_draw_upload.c:457)
==14722==    by 0x852F975: brw_validate_state (brw_state_upload.c:394)
==14722==    by 0x851FA24: brw_draw_prims (brw_draw.c:365)
==14722==    by 0x85F2221: vbo_exec_vtx_flush (vbo_exec_draw.c:389)
==14722==    by 0x85EF443: vbo_exec_FlushVertices_internal (vbo_exec_api.c:543)
==14722==    by 0x85EF49B: vbo_exec_FlushVertices (vbo_exec_api.c:973)
==14722==    by 0x86D6A16: _mesa_set_enable (enable.c:351)
==14722==    by 0x42CAD1: render_to_fbo (in /home/ickle/git/piglit/bin/fbo-depth-sample-compare)
==14722==    by 0x42CEE3: piglit_display (in /home/ickle/git/piglit/bin/fbo-depth-sample-compare)
==14722==    by 0x42F508: display (in /home/ickle/git/piglit/bin/fbo-depth-sample-compare)

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=34604
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

diff --git a/src/mesa/drivers/dri/i965/brw_draw_upload.c b/src/mesa/drivers/dri/i965/brw_draw_upload.c
index 140fb4e62505c8aff6585da60a59d87a30c1e6ae..4efb3cd66ace02fec7a4cc3b43ab600fba3bb6e5 100644 (file)
--- a/src/mesa/drivers/dri/i965/brw_draw_upload.c
+++ b/src/mesa/drivers/dri/i965/brw_draw_upload.c
@@ -253,7 +253,8 @@ copy_array_to_vbo_array( struct brw_context *brw,
                        &buffer->bo, &buffer->offset);
    } else {
       const unsigned char *src = element->glarray->Ptr;
-      char *dst = intel_upload_map(&brw->intel, size, dst_stride);
+      char *map = intel_upload_map(&brw->intel, size, dst_stride);
+      char *dst = map;
       int i;
 
       for (i = 0; i < element->count; i++) {
@@ -261,7 +262,7 @@ copy_array_to_vbo_array( struct brw_context *brw,
         src += element->glarray->StrideB;
         dst += dst_stride;
       }
-      intel_upload_unmap(&brw->intel, dst, size, dst_stride,
+      intel_upload_unmap(&brw->intel, map, size, dst_stride,
                         &buffer->bo, &buffer->offset);
    }
 }