mesa: fix some VBO buffer object issues

The VBO module may use a real VBO or a malloc'd buffer for vertex storage.
Be careful not to accidentally replace the later with the former when drawing.
Check if using a real VBO at destroy time to prevent a double-free.

diff --git a/src/mesa/vbo/vbo_exec_api.c b/src/mesa/vbo/vbo_exec_api.c
index 5513ef94491437ca79d48a3bad3fe753ec8ed251..d48f5230cb9340233bfefcd77e03b0a07647bb14 100644 (file)
--- a/src/mesa/vbo/vbo_exec_api.c
+++ b/src/mesa/vbo/vbo_exec_api.c
@@ -699,8 +699,8 @@ void vbo_exec_vtx_init( struct vbo_exec_context *exec )
                                  &exec->vtx.bufferobj,
                                  ctx->Array.NullBufferObj);
 
+   ASSERT(!exec->vtx.buffer_map);
    exec->vtx.buffer_map = ALIGN_MALLOC(VBO_VERT_BUFFER_SIZE * sizeof(GLfloat), 64);
-
    vbo_exec_vtxfmt_init( exec );
 
    /* Hook our functions into the dispatch table.
@@ -725,9 +725,17 @@ void vbo_exec_vtx_init( struct vbo_exec_context *exec )
 
 void vbo_exec_vtx_destroy( struct vbo_exec_context *exec )
 {
-   if (exec->vtx.buffer_map) {
-      ALIGN_FREE(exec->vtx.buffer_map);
-      exec->vtx.buffer_map = NULL;
+   if (exec->vtx.bufferobj->Name) {
+      /* using a real VBO for vertex data */
+      GLcontext *ctx = exec->ctx;
+      _mesa_reference_buffer_object(ctx, &exec->vtx.bufferobj, NULL);
+   }
+   else {
+      /* just using malloc'd space for vertex data */
+      if (exec->vtx.buffer_map) {
+         ALIGN_FREE(exec->vtx.buffer_map);
+         exec->vtx.buffer_map = NULL;
+      }
    }
 }
 

diff --git a/src/mesa/vbo/vbo_exec_draw.c b/src/mesa/vbo/vbo_exec_draw.c
index f497e9a5a55f454f1da2b8326a5be6e362c89bf4..92356ba9773c5eb99359b383814f6a5fe83ef3b8 100644 (file)
--- a/src/mesa/vbo/vbo_exec_draw.c
+++ b/src/mesa/vbo/vbo_exec_draw.c
@@ -242,8 +242,11 @@ void vbo_exec_vtx_flush( struct vbo_exec_context *exec )
          */
         vbo_exec_bind_arrays( ctx );
 
-        ctx->Driver.UnmapBuffer(ctx, target, exec->vtx.bufferobj);
-        exec->vtx.buffer_map = NULL;
+         /* if using a real VBO, unmap it before drawing */
+         if (exec->vtx.bufferobj->Name) {
+            ctx->Driver.UnmapBuffer(ctx, target, exec->vtx.bufferobj);
+            exec->vtx.buffer_map = NULL;
+         }
 
         vbo_context(ctx)->draw_prims( ctx, 
                                       exec->vtx.inputs, 
@@ -253,11 +256,12 @@ void vbo_exec_vtx_flush( struct vbo_exec_context *exec )
                                       0,
                                       exec->vtx.vert_count - 1);
 
-        /* Get new data:
-         */
-        ctx->Driver.BufferData(ctx, target, size, NULL, usage, exec->vtx.bufferobj);
-        exec->vtx.buffer_map
-           = ctx->Driver.MapBuffer(ctx, target, access, exec->vtx.bufferobj);
+        /* If using a real VBO, get new storage */
+         if (exec->vtx.bufferobj->Name) {
+            ctx->Driver.BufferData(ctx, target, size, NULL, usage, exec->vtx.bufferobj);
+            exec->vtx.buffer_map = 
+               ctx->Driver.MapBuffer(ctx, target, access, exec->vtx.bufferobj);
+         }
       }
    }