summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKenneth Graunke <[email protected]>2012-01-04 15:45:49 -0800
committerKenneth Graunke <[email protected]>2012-01-04 15:51:51 -0800
commita0a0a909f21acfcddaab603079ba98266e8daf0e (patch)
treeecef91dbc1d103e554ee4256f75baf9b558cd34b
parentfbbbc8c04e2462a0ae272d81e61eee5f85f08aa6 (diff)
i965: Fix infinite loop regression in intel_miptree_all_slices_resolve.
Commit 0ed11e333147e280208d9d0b3ff3f39970547643 fixed a "use after free" bug by getting the next pointer before deleting the current node. Unfortunately, it also made "next" never get updated if i->need != need. Fixes infinite loops in piglit tests fbo-depth-array and fbo-depthtex. Signed-off-by: Kenneth Graunke <[email protected]> Reviewed-by: Eric Anholt <[email protected]> Reviewed-by: Ian Romanick <[email protected]>
-rw-r--r--src/mesa/drivers/dri/intel/intel_mipmap_tree.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/src/mesa/drivers/dri/intel/intel_mipmap_tree.c b/src/mesa/drivers/dri/intel/intel_mipmap_tree.c
index 7787c1a87af..4e1a502a51b 100644
--- a/src/mesa/drivers/dri/intel/intel_mipmap_tree.c
+++ b/src/mesa/drivers/dri/intel/intel_mipmap_tree.c
@@ -643,10 +643,10 @@ intel_miptree_all_slices_resolve(struct intel_context *intel,
struct intel_resolve_map *i, *next;
for (i = mt->hiz_map.next; i; i = next) {
+ next = i->next;
if (i->need != need)
continue;
func(intel, mt, i->level, i->layer);
- next = i->next;
intel_resolve_map_remove(i);
did_resolve = true;
}