mesa: reference shared state in glPushAttrib(GL_TEXTURE_BIT)

This fixes a dangling texture object pointer bug hit via wglShareLists().
When we push the GL_TEXTURE_BIT state we may push references to the default
texture objects which are owned by the gl_shared_state object.  We don't
want to accidentally delete that shared state while the attribute stack
references shared objects.  So keep a reference to it.

NOTE: This is a candidate for the 8.0 branch.

Reviewed-by: José Fonseca <[email protected]>
(cherry picked from commit a1471e4877515e2ce4fcc129c4ce26f5c306b193)

1 files changed, 13 insertions, 0 deletions

diff --git a/src/mesa/main/attrib.c b/src/mesa/main/attrib.c
index 01e79455c2a..1068dd8f74b 100644
--- a/src/mesa/main/attrib.c
+++ b/src/mesa/main/attrib.c
@@ -47,6 +47,7 @@
 #include "multisample.h"
 #include "points.h"
 #include "polygon.h"
+#include "shared.h"
 #include "scissor.h"
 #include "stencil.h"
 #include "texenv.h"
@@ -165,6 +166,13 @@ struct texture_state
     * deleted while saved in the attribute stack).
     */
    struct gl_texture_object *SavedTexRef[MAX_TEXTURE_UNITS][NUM_TEXTURE_TARGETS];
+
+   /* We need to keep a reference to the shared state.  That's where the
+    * default texture objects are kept.  We don't want that state to be
+    * freed while the attribute stack contains pointers to any default
+    * texture objects.
+    */
+   struct gl_shared_state *SharedRef;
 };
 
 
@@ -437,6 +445,8 @@ _mesa_PushAttrib(GLbitfield mask)
          }
       }
 
+      _mesa_reference_shared_state(ctx, &texstate->SharedRef, ctx->Shared);
+
       _mesa_unlock_context_textures(ctx);
 
       save_attrib_data(&head, GL_TEXTURE_BIT, texstate);
@@ -806,6 +816,8 @@ pop_texture_group(struct gl_context *ctx, struct texture_state *texstate)
 
    _mesa_ActiveTextureARB(GL_TEXTURE0_ARB + texstate->Texture.CurrentUnit);
 
+   _mesa_reference_shared_state(ctx, &texstate->SharedRef, NULL);
+
    _mesa_unlock_context_textures(ctx);
 }
 
@@ -1605,6 +1617,7 @@ _mesa_free_attrib_data(struct gl_context *ctx)
                   _mesa_reference_texobj(&texstate->SavedTexRef[u][tgt], NULL);
                }
             }
+            _mesa_reference_shared_state(ctx, &texstate->SharedRef, NULL);
          }
          else {
             /* any other chunks of state that requires special handling? */