In region_unmap(), check if region is mapped before decrementing refcount.

2 files changed, 14 insertions, 8 deletions

diff --git a/src/mesa/pipe/i915simple/i915_regions.c b/src/mesa/pipe/i915simple/i915_regions.c
index cff90ab5dd..577a6adfd8 100644
--- a/src/mesa/pipe/i915simple/i915_regions.c
+++ b/src/mesa/pipe/i915simple/i915_regions.c
@@ -59,10 +59,13 @@ i915_region_unmap(struct pipe_context *pipe, struct pipe_region *region)
 {
    struct i915_context *i915 = i915_context( pipe );
 
-   if (!--region->map_refcount) {
-      i915->pipe.winsys->buffer_unmap( i915->pipe.winsys,
-				       region->buffer );
-      region->map = NULL;
+   if (region->map_refcount > 0) {
+      assert(region->map);
+      if (!--region->map_refcount) {
+         i915->pipe.winsys->buffer_unmap( i915->pipe.winsys,
+                                          region->buffer );
+         region->map = NULL;
+      }
    }
 }
 
diff --git a/src/mesa/pipe/softpipe/sp_region.c b/src/mesa/pipe/softpipe/sp_region.c
index 0f4d2f0575..4317a9ea1b 100644
--- a/src/mesa/pipe/softpipe/sp_region.c
+++ b/src/mesa/pipe/softpipe/sp_region.c
@@ -69,10 +69,13 @@ sp_region_unmap(struct pipe_context *pipe, struct pipe_region *region)
 {
    struct softpipe_context *sp = softpipe_context( pipe );
 
-   if (!--region->map_refcount) {
-      sp->pipe.winsys->buffer_unmap( sp->pipe.winsys,
-				region->buffer );
-      region->map = NULL;
+   if (region->map_refcount > 0) {
+      assert(region->map);
+      if (!--region->map_refcount) {
+         sp->pipe.winsys->buffer_unmap( sp->pipe.winsys,
+                                        region->buffer );
+         region->map = NULL;
+      }
    }
 }