Use _mesa_exec_free for fp->func.

src/mesa/tnl/t_vertex.c

@@ -494,14 +494,14 @@ void _tnl_free_vertices( GLcontext *ctx )
    for (fp = vtx->fastpath ; fp ; fp = tmp) {
       tmp = fp->next;
       FREE(fp->attr);
-      /* XXX Can we be sure that fp->func points to memory that was
-       * allocated with _mesa_exec_malloc()?  I think it's possible that
-       * the pointer can point to an ordinary C function.
-       * Just disable this for the time being.  See bug 5131.
+
+      /* KW: At the moment, fp->func is constrained to be allocated by
+       * _mesa_exec_alloc(), as the hardwired fastpaths in
+       * t_vertex_generic.c are handled specially.  It would be nice
+       * to unify them, but this probably won't change until this
+       * module gets another overhaul.
        */
-#if 0
       _mesa_exec_free((void *) fp->func);
-#endif
       FREE(fp);
    }