[Chromium-dev] Bug in tilesortspu_context?

[<ma...@co...>]

Hi all,

At the end of tilesortspu_context.c, the existing code in
tilesortspu_DestroyContext looks like this:

/* Destroy the tilesort state context */
crFree(contextInfo->server);
crStateDestroyContext(contextInfo->State);
crHashtableDelete(tilesort_spu.contextTable, ctx, crFree);

/* The default buffer */
crPackSetBuffer( thread0->packer, &(thread->geometry_buffer) );

crDLMFreeContext(contextInfo->dlmContext);

-------

The problem is that, apparently, crHashtableDelete is deleting the data
pointed to by contextInfo. (contextInfo is retrieved from the hashtable
earlier in the function.)

So, a version that seems to work better for me (i.e. no crash on context
deletion) is:

/* Destroy the tilesort state context */
crFree(contextInfo->server);
crStateDestroyContext(contextInfo->State);

/* The default buffer */
crPackSetBuffer( thread0->packer, &(thread->geometry_buffer) );

crDLMFreeContext(contextInfo->dlmContext);

crHashtableDelete(tilesort_spu.contextTable, ctx, crFree);

----

Jon