From: Brian Paul <brianp@vmware.com>
Date: Fri, 10 Aug 2012 15:12:50 +0000 (-0600)
Subject: st/mesa: fix glCopyTexSubImage crash
X-Git-Tag: accepted/2.0alpha-wayland/20121114.171706~679
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=9b04abe36812a34ba447e5b1f8d8e44a10510820;p=profile%2Fivi%2Fmesa.git

st/mesa: fix glCopyTexSubImage crash

Fixes a WebGL crash.  The dest texture image is at level 2 and is of
size 1x1 texel.  The st texture image is a stand-alone resource, not
a pointer into a complete mipmap.  So the resource has one level and
trying to write to level 2 blows up.

Fixes http://bugs.freedesktop.org/show_bug.cgi?id=53314
and http://bugs.freedesktop.org/show_bug.cgi?id=53319

Note: This is a candidate for the 8.0 branch.

Reviewed-by: Jose Fonseca <jfonseca@vmware.com>
---

diff --git a/src/mesa/state_tracker/st_cb_texture.c b/src/mesa/state_tracker/st_cb_texture.c
index a7f57b9..92ce3fa 100644
--- a/src/mesa/state_tracker/st_cb_texture.c
+++ b/src/mesa/state_tracker/st_cb_texture.c
@@ -1004,14 +1004,22 @@ st_CopyTexSubImage(struct gl_context *ctx, GLuint dims,
        !do_flip) {
       /* use surface_copy() / blit */
       struct pipe_box src_box;
+      unsigned dstLevel;
+
       u_box_2d_zslice(srcX, srcY, strb->surface->u.tex.first_layer,
                       width, height, &src_box);
 
+      /* If stImage->pt is an independent image (not a pointer into a full
+       * mipmap) stImage->pt.last_level will be zero and we need to use that
+       * as the dest level.
+       */
+      dstLevel = MIN2(stImage->base.Level, stImage->pt->last_level);
+
       /* for resource_copy_region(), y=0=top, always */
       pipe->resource_copy_region(pipe,
                                  /* dest */
                                  stImage->pt,
-                                 stImage->base.Level,
+                                 dstLevel,
                                  destX, destY, destZ + stImage->base.Face,
                                  /* src */
                                  strb->texture,