From 05ac187f305bb653d569b5c07446ec0f4cd7ff08 Mon Sep 17 00:00:00 2001
From: José Fonseca <jfonseca@vmware.com>
Date: Mon, 1 Feb 2010 21:30:50 +0000
Subject: mesa: Fix null buffer object reference counting.

Always use _mesa_reference_buffer_object, and never call
ctx->Driver.DeleteBuffer() directly to prevent dangling pointers to the
null buffer object.

This fixes crash/assertions in sharedtex_mt and Autodesk Mudbox.
---
 src/mesa/main/shared.c  | 14 ++++++++------
 src/mesa/vbo/vbo_save.c | 11 +++++++++++
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/src/mesa/main/shared.c b/src/mesa/main/shared.c
index 6cf63f6421..a7cf623c47 100644
--- a/src/mesa/main/shared.c
+++ b/src/mesa/main/shared.c
@@ -93,12 +93,14 @@ _mesa_alloc_shared_state(GLcontext *ctx)
    shared->BufferObjects = _mesa_NewHashTable();
 #endif
 
-   /* Allocate the default buffer object and set refcount so high that
-    * it never gets deleted.
-    * XXX with recent/improved refcounting this may not longer be needed.
-    */
+   /* Allocate the default buffer object */
    shared->NullBufferObj = ctx->Driver.NewBufferObject(ctx, 0, 0);
+#ifndef DEBUG
+   /* Set refcount so high that it never gets deleted.
+    * XXX with recent/improved refcounting this should be no longer be needed.
+    */
    shared->NullBufferObj->RefCount = 1000 * 1000 * 1000;
+#endif
 
    /* Create default texture objects */
    for (i = 0; i < NUM_TEXTURE_TARGETS; i++) {
@@ -202,7 +204,7 @@ delete_bufferobj_cb(GLuint id, void *data, void *userData)
       ctx->Driver.UnmapBuffer(ctx, 0, bufObj);
       bufObj->Pointer = NULL;
    }
-   ctx->Driver.DeleteBuffer(ctx, bufObj);
+   _mesa_reference_buffer_object(ctx, &bufObj, NULL);
 }
 
 
@@ -335,7 +337,7 @@ free_shared_state(GLcontext *ctx, struct gl_shared_state *shared)
 #endif
 
 #if FEATURE_ARB_vertex_buffer_object
-   ctx->Driver.DeleteBuffer(ctx, shared->NullBufferObj);
+   _mesa_reference_buffer_object(ctx, &shared->NullBufferObj, NULL);
 #endif
 
 #if FEATURE_ARB_sync
diff --git a/src/mesa/vbo/vbo_save.c b/src/mesa/vbo/vbo_save.c
index 10f705cf84..fd9a130270 100644
--- a/src/mesa/vbo/vbo_save.c
+++ b/src/mesa/vbo/vbo_save.c
@@ -58,8 +58,19 @@ void vbo_save_init( GLcontext *ctx )
 
    {
       struct gl_client_array *arrays = save->arrays;
+      unsigned i;
+
       memcpy(arrays,      vbo->legacy_currval,  16 * sizeof(arrays[0]));
       memcpy(arrays + 16, vbo->generic_currval, 16 * sizeof(arrays[0]));
+
+      for (i = 0; i < 16; ++i) {
+         arrays[i     ].BufferObj = NULL;
+         arrays[i + 16].BufferObj = NULL;
+         _mesa_reference_buffer_object(ctx, &arrays[i     ].BufferObj, 
+                                       vbo->legacy_currval[i].BufferObj);
+         _mesa_reference_buffer_object(ctx, &arrays[i + 16].BufferObj,
+                                       vbo->generic_currval[i].BufferObj);
+      }
    }
 
    ctx->Driver.CurrentSavePrimitive = PRIM_UNKNOWN;
-- 
cgit v1.2.3