mesa: Avoid ABA problem on buffer object bind.

Make sure we do not run into the classic ABA problem on buffer object bind,
reusing this name and may be never rebind since we get an new name
that was just deleted and never rebound in between.
The explicit rebinding to the debault object in the current context
prevents the above in the current context, but another context
sharing the same objects might suffer from this problem.

Minor var renaming and comments edited by Brian.

Signed-off-by: Mathias Fröhlich <Mathias.Froehlich@web.de>
Signed-off-by: Brian Paul <brianp@vmware.com>

diff --git a/src/mesa/main/bufferobj.c b/src/mesa/main/bufferobj.c
index 431eafd387920d23ba491bd7b17a98d6ee724fe9..4c77397d9dc83c63a09e52b75a84a75e9eb692ca 100644 (file)
--- a/src/mesa/main/bufferobj.c
+++ b/src/mesa/main/bufferobj.c
@@ -571,7 +571,7 @@ bind_buffer_object(struct gl_context *ctx, GLenum target, GLuint buffer)
 
    /* Get pointer to old buffer object (to be unbound) */
    oldBufObj = *bindTarget;
-   if (oldBufObj && oldBufObj->Name == buffer)
+   if (oldBufObj && oldBufObj->Name == buffer && !oldBufObj->DeletePending)
       return;   /* rebinding the same buffer object- no change */
 
    /*
@@ -773,6 +773,17 @@ _mesa_DeleteBuffersARB(GLsizei n, const GLuint *ids)
 
          /* The ID is immediately freed for re-use */
          _mesa_HashRemove(ctx->Shared->BufferObjects, ids[i]);
+         /* Make sure we do not run into the classic ABA problem on bind.
+          * We don't want to allow re-binding a buffer object that's been
+          * "deleted" by glDeleteBuffers().
+          *
+          * The explicit rebinding to the default object in the current context
+          * prevents the above in the current context, but another context
+          * sharing the same objects might suffer from this problem.
+          * The alternative would be to do the hash lookup in any case on bind
+          * which would introduce more runtime overhead than this.
+          */
+         bufObj->DeletePending = GL_TRUE;
          _mesa_reference_buffer_object(ctx, &bufObj, NULL);
       }
    }

diff --git a/src/mesa/main/mtypes.h b/src/mesa/main/mtypes.h
index d02bc16764340b5d0df92d292bd6652b54f61764..719dff3af2e81bde670b183493b4bf1d4941797f 100644 (file)
--- a/src/mesa/main/mtypes.h
+++ b/src/mesa/main/mtypes.h
@@ -1530,6 +1530,7 @@ struct gl_buffer_object
    GLintptr Offset;     /**< Mapped offset */
    GLsizeiptr Length;   /**< Mapped length */
    /*@}*/
+   GLboolean DeletePending;   /**< true if buffer object is removed from the hash */
    GLboolean Written;   /**< Ever written to? (for debugging) */
    GLboolean Purgeable; /**< Is the buffer purgeable under memory pressure? */
 };