intel-driver: Call intel_driver_terminate after i965_destroy_heap

Otherwise this leads to use-after-free of the bufmgr.

Signed-off-by: Stéphane Marchesin <marcheu@chromium.org>
(cherry picked from commit 5a449f5d2608adaf29c4c052aa28687d9e80a37a)

diff --git a/src/i965_drv_video.c b/src/i965_drv_video.c
index dbf4e44..8c913a5 100755 (executable)
--- a/src/i965_drv_video.c
+++ b/src/i965_drv_video.c
@@ -3372,9 +3372,6 @@ i965_Terminate(VADriverContextP ctx)
     if (i965_post_processing_terminate(ctx) == False)
         return VA_STATUS_ERROR_UNKNOWN;
 
-    if (intel_driver_terminate(ctx) == False)
-        return VA_STATUS_ERROR_UNKNOWN;
-
     i965_destroy_heap(&i965->buffer_heap, i965_destroy_buffer);
     i965_destroy_heap(&i965->image_heap, i965_destroy_image);
     i965_destroy_heap(&i965->subpic_heap, i965_destroy_subpic);
@@ -3382,6 +3379,9 @@ i965_Terminate(VADriverContextP ctx)
     i965_destroy_heap(&i965->context_heap, i965_destroy_context);
     i965_destroy_heap(&i965->config_heap, i965_destroy_config);
 
+    if (intel_driver_terminate(ctx) == False)
+        return VA_STATUS_ERROR_UNKNOWN;
+
     free(ctx->pDriverData);
     ctx->pDriverData = NULL;