It's the ctx->ReadBuffer that gets read from, not the ctx->DrawBuffer.
So, if you happened to have a ctx->ReadBuffer that was the winsys buffer,
and it had previously been intel_prepare_render()ed but not invalidated
since then, and you called glReadBuffer() to switch to front buffer
instead of back buffer reading on the winsys fbo while your drawbuffer was
a user FBO, you'd never get the front buffer's miptree fetched, and
segfault.
---
src/mesa/drivers/dri/i915/intel_buffers.c | 2 +-
src/mesa/drivers/dri/i965/intel_buffers.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/mesa/drivers/dri/i915/intel_buffers.c
b/src/mesa/drivers/dri/i915/intel_buffers.c
index cf4ba4b..51eaea4 100644
--- a/src/mesa/drivers/dri/i915/intel_buffers.c
+++ b/src/mesa/drivers/dri/i915/intel_buffers.c
@@ -78,7 +78,7 @@ intelDrawBuffer(struct gl_context * ctx, GLenum mode)
static void
intelReadBuffer(struct gl_context * ctx, GLenum mode)
{
- if (ctx->DrawBuffer && _mesa_is_winsys_fbo(ctx->DrawBuffer)) {
+ if (ctx->ReadBuffer && _mesa_is_winsys_fbo(ctx->ReadBuffer)) {
struct intel_context *const intel = intel_context(ctx);
const bool was_front_buffer_reading =
intel->is_front_buffer_reading;
diff --git a/src/mesa/drivers/dri/i965/intel_buffers.c
b/src/mesa/drivers/dri/i965/intel_buffers.c
index 9e3b585..1ece875 100644
--- a/src/mesa/drivers/dri/i965/intel_buffers.c
+++ b/src/mesa/drivers/dri/i965/intel_buffers.c
@@ -76,7 +76,7 @@ intelDrawBuffer(struct gl_context * ctx, GLenum mode)
static void
intelReadBuffer(struct gl_context * ctx, GLenum mode)
{
- if (ctx->DrawBuffer && _mesa_is_winsys_fbo(ctx->DrawBuffer)) {
+ if (ctx->ReadBuffer && _mesa_is_winsys_fbo(ctx->ReadBuffer)) {
struct brw_context *const brw = brw_context(ctx);
const bool was_front_buffer_reading = brw->is_front_buffer_reading;
--
1.9.rc1
_______________________________________________
mesa-dev mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/mesa-dev
