[Bug 28630] [r300g] tiling / texture transfer crash in World of Warcraft

https://bugs.freedesktop.org/show_bug.cgi?id=28630

--- Comment #7 from Chris Rankin rankincj@googlemail.com 2010-06-29 13:37:28 PDT --- (In reply to comment #4)

I believe the "data" pointer is not valid.

That data pointer looks like it *used* to belong to a r300_context object that has since been destroyed. Basically, r300_create_context() stores a reference to the newly-created r300_context object inside the radeon_libdrm_winsys struct:

rws->set_flush_cb(r300->rws, r300_flush_cb, r300);

Warcraft then destroys the context again, but this reference inside the winsys lingers somehow. And then Azeroth explodes when radeon_drm_bufmgr_set_tiling() tries to flush the buffer data.