glx: Fix indirect multi-texture GL_DOUBLE coordinate arrays.

There is no draw arrays protocol support for multi-texture coordinate
arrays, so it is implemented by sending batches of immediate mode
commands from emit_element_none in indirect_vertex_array.c.  This sends
the target texture unit (which has been previously setup in the
array_state header field), followed by the texture coordinates.  But for
GL_DOUBLE coordinates the texture unit must be sent *after* the texture
coordinates. This is documented in the glx protocol description, and can
also be seen in the indirect.c immediate mode commands generated from
gl_API.xml. Sending the target texture unit in the wrong place can crash
the remote X server.

To fix this required some more extensive changes to
indirect_vertex_array.c and indirect_vertex_array_priv.h, in order to
remove the texture unit value out of the array_state "header" field, and
send it separately.

Reviewed-by: Matt Turner <[email protected]>
Reviewed-by: Ian Romanick <[email protected]>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=61907

1 files changed, 3 insertions, 9 deletions

diff --git a/src/glx/indirect_vertex_array_priv.h b/src/glx/indirect_vertex_array_priv.h
index 56dac37c783..488dacb99d1 100644
--- a/src/glx/indirect_vertex_array_priv.h
+++ b/src/glx/indirect_vertex_array_priv.h
@@ -87,16 +87,10 @@ struct array_state
 
     /**
      * Pre-calculated GLX protocol command header.
+     * This contains two 16-bit words: the command length and the command
+     * opcode.
      */
-   uint32_t header[2];
-
-    /**
-     * Size of the header data.  For simple data, like glColorPointerfv,
-     * this is 4.  For complex data that requires either a count (e.g.,
-     * glWeightfvARB), an index (e.g., glVertexAttrib1fvARB), or a
-     * selector enum (e.g., glMultiTexCoord2fv) this is 8.
-     */
-   unsigned header_size;
+   uint16_t header[2];
 
     /**
      * Set to \c GL_TRUE if this array is enabled.  Otherwise, it is set