commit b7a7ee4f1a377d69ec3d0913328a7ae8103c5d4c
author Craig Stout <cstout@google.com> Thu May 24 12:51:41 2018 -0700
committer Craig Stout <cstout@google.com> Thu May 24 12:51:47 2018 -0700
tree f9e229d25586e65e13b03b61db2237d423ef1504
parent d163f463556d99ad8e1e6405af087b9364894d81

Fix double free.

When exporting a temporarily imported semaphore, the temporary
state is released but the type is not updated to reflect that;
so on destroy the state is released again.

https://bugs.freedesktop.org/show_bug.cgi?id=106643

Change-Id: Ia26688f4aed9fe61154cfc80ed96f361719cfe3a

src/intel/vulkan/anv_magma.cc

diff --git a/src/intel/vulkan/anv_magma.cc b/src/intel/vulkan/anv_magma.cc
index cb595be..f2553ec 100644
--- a/src/intel/vulkan/anv_magma.cc
+++ b/src/intel/vulkan/anv_magma.cc
@@ -386,8 +386,7 @@
     *    temporarily imported payload, the semaphore’s prior permanent payload
     *    will be restored.
     */
-   if (impl == &semaphore->temporary)
-      anv_semaphore_impl_cleanup(device, impl);
+   anv_semaphore_reset_temporary(device, semaphore);
 
    *pFuchsiaHandle = handle;
    return VK_SUCCESS;

src/intel/vulkan/anv_queue.c

diff --git a/src/intel/vulkan/anv_queue.c b/src/intel/vulkan/anv_queue.c
index fc71803..66852b2 100644
--- a/src/intel/vulkan/anv_queue.c
+++ b/src/intel/vulkan/anv_queue.c
@@ -1154,8 +1154,7 @@
     *    temporarily imported payload, the semaphore’s prior permanent payload
     *    will be restored.
     */
-   if (impl == &semaphore->temporary)
-      anv_semaphore_impl_cleanup(device, impl);
+   anv_semaphore_reset_temporary(device, semaphore);
 
    return VK_SUCCESS;
 }