isa/mutter
1
0
Fork 0
mirror of https://github.com/brl/mutter.git synced 2024-11-24 00:50:42 -05:00
Code Issues Packages Projects Releases Wiki Activity

cogl/pipeline: Don't try to access to free'd pointer data

Browse Source 
When free'ing a pipeline we destroy the BigState first and then the fragment and
vertex snippets lists using the big state pointer which is now invalid.
This causes a crash  when G_SLICE=always-malloc is set and using MALLOC_CHECK_.

So, invert the operations by free'ing the snippet lists first, and the big state
afterwards.

https://gitlab.gnome.org/GNOME/mutter/merge_requests/581


(cherry picked from commit 7e0d185120)
This commit is contained in:
Marco Trevisan (Treviño) 2019-05-17 19:35:46 +00:00 committed by Marco Trevisan
parent 15803b9558
commit 18e44bb64c
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cogl/cogl/cogl-pipeline.c
View File

@ -455,9 +455,6 @@ _cogl_pipeline_free (CoglPipeline *pipeline)
_cogl_bitmask_destroy (&uniforms_state->changed_mask); _cogl_bitmask_destroy (&uniforms_state->changed_mask);
} }
if (pipeline->differences & COGL_PIPELINE_STATE_NEEDS_BIG_STATE)
g_slice_free (CoglPipelineBigState, pipeline->big_state);
if (pipeline->differences & COGL_PIPELINE_STATE_LAYERS) if (pipeline->differences & COGL_PIPELINE_STATE_LAYERS)
{ {
g_list_foreach (pipeline->layer_differences, g_list_foreach (pipeline->layer_differences,
@ -471,6 +468,9 @@ _cogl_pipeline_free (CoglPipeline *pipeline)
if (pipeline->differences & COGL_PIPELINE_STATE_FRAGMENT_SNIPPETS) if (pipeline->differences & COGL_PIPELINE_STATE_FRAGMENT_SNIPPETS)
_cogl_pipeline_snippet_list_free (&pipeline->big_state->fragment_snippets); _cogl_pipeline_snippet_list_free (&pipeline->big_state->fragment_snippets);
if (pipeline->differences & COGL_PIPELINE_STATE_NEEDS_BIG_STATE)
g_slice_free (CoglPipelineBigState, pipeline->big_state);
g_list_free (pipeline->deprecated_get_layers_list); g_list_free (pipeline->deprecated_get_layers_list);
recursively_free_layer_caches (pipeline); recursively_free_layer_caches (pipeline);