iris: fix a crash in disable_rb_aux_buffer

I have been running into crashes in this function when using blender.
Some of the entries in ice->state.framebuffer.base.cbufs[0] can
apparently have the texture field be null, which was causing a segfault
in this loop.

In my case, nr_cbufs was 3, and the first two cbufs entries had a null
texture and format set to PIPE_FORMAT_NONE. The last entry had format of
PIPE_FORMAT_R16G16_FLOAT and a non-null texture.

Adding this null check before attempting to dereference the texture
fixes the crash for me and allows blender to work normally.

Fixes: ca96f8517c ("iris: remove uses of pipe_surface as a pointer")
Reviewed-by: Tapani Pälli <tapani.palli@intel.com>
(cherry picked from commit e16c8cc579)

Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/40752>
This commit is contained in:
Adam Simpkins 2026-03-28 12:59:32 -07:00 committed by Eric Engestrom
parent c74811897f
commit 99129b13ce
2 changed files with 3 additions and 2 deletions

View file

@ -904,7 +904,7 @@
"description": "iris: fix a crash in disable_rb_aux_buffer",
"nominated": true,
"nomination_type": 2,
"resolution": 0,
"resolution": 1,
"main_sha": null,
"because_sha": "ca96f8517cc996915778c6d63d753f4cce63c555",
"notes": null

View file

@ -61,7 +61,8 @@ disable_rb_aux_buffer(struct iris_context *ice,
struct pipe_surface *surf = &cso_fb->base.cbufs[i];
struct iris_resource *rb_res = (void *) surf->texture;
if (rb_res->bo == tex_res->bo &&
if (rb_res != NULL &&
rb_res->bo == tex_res->bo &&
surf->level >= min_level &&
surf->level < min_level + num_levels) {
found = draw_aux_buffer_disabled[i] = true;