From 6222eb3fcd12147ea2e7ccc20a71a921cebbb0d2 Mon Sep 17 00:00:00 2001
From: Brian Paul <brian.paul@tungstengraphics.com>
Date: Thu, 25 Sep 2008 11:03:46 -0600
Subject: [PATCH] mesa: fix some VBO buffer object issues

The VBO module may use a real VBO or a malloc'd buffer for vertex storage.
Be careful not to accidentally replace the later with the former when drawing.
Check if using a real VBO at destroy time to prevent a double-free.
---
 src/mesa/vbo/vbo_exec_api.c  | 16 ++++++++++++----
 src/mesa/vbo/vbo_exec_draw.c | 18 +++++++++++-------
 2 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/src/mesa/vbo/vbo_exec_api.c b/src/mesa/vbo/vbo_exec_api.c
index 5513ef94491..d48f5230cb9 100644
--- a/src/mesa/vbo/vbo_exec_api.c
+++ b/src/mesa/vbo/vbo_exec_api.c
@@ -699,8 +699,8 @@ void vbo_exec_vtx_init( struct vbo_exec_context *exec )
                                  &exec->vtx.bufferobj,
                                  ctx->Array.NullBufferObj);
 
+   ASSERT(!exec->vtx.buffer_map);
    exec->vtx.buffer_map = ALIGN_MALLOC(VBO_VERT_BUFFER_SIZE * sizeof(GLfloat), 64);
-
    vbo_exec_vtxfmt_init( exec );
 
    /* Hook our functions into the dispatch table.
@@ -725,9 +725,17 @@ void vbo_exec_vtx_init( struct vbo_exec_context *exec )
 
 void vbo_exec_vtx_destroy( struct vbo_exec_context *exec )
 {
-   if (exec->vtx.buffer_map) {
-      ALIGN_FREE(exec->vtx.buffer_map);
-      exec->vtx.buffer_map = NULL;
+   if (exec->vtx.bufferobj->Name) {
+      /* using a real VBO for vertex data */
+      GLcontext *ctx = exec->ctx;
+      _mesa_reference_buffer_object(ctx, &exec->vtx.bufferobj, NULL);
+   }
+   else {
+      /* just using malloc'd space for vertex data */
+      if (exec->vtx.buffer_map) {
+         ALIGN_FREE(exec->vtx.buffer_map);
+         exec->vtx.buffer_map = NULL;
+      }
    }
 }
 
diff --git a/src/mesa/vbo/vbo_exec_draw.c b/src/mesa/vbo/vbo_exec_draw.c
index f497e9a5a55..92356ba9773 100644
--- a/src/mesa/vbo/vbo_exec_draw.c
+++ b/src/mesa/vbo/vbo_exec_draw.c
@@ -242,8 +242,11 @@ void vbo_exec_vtx_flush( struct vbo_exec_context *exec )
 	  */
 	 vbo_exec_bind_arrays( ctx );
 
-	 ctx->Driver.UnmapBuffer(ctx, target, exec->vtx.bufferobj);
-	 exec->vtx.buffer_map = NULL;
+         /* if using a real VBO, unmap it before drawing */
+         if (exec->vtx.bufferobj->Name) {
+            ctx->Driver.UnmapBuffer(ctx, target, exec->vtx.bufferobj);
+            exec->vtx.buffer_map = NULL;
+         }
 
 	 vbo_context(ctx)->draw_prims( ctx, 
 				       exec->vtx.inputs, 
@@ -253,11 +256,12 @@ void vbo_exec_vtx_flush( struct vbo_exec_context *exec )
 				       0,
 				       exec->vtx.vert_count - 1);
 
-	 /* Get new data:
-	  */
-	 ctx->Driver.BufferData(ctx, target, size, NULL, usage, exec->vtx.bufferobj);
-	 exec->vtx.buffer_map
-	    = ctx->Driver.MapBuffer(ctx, target, access, exec->vtx.bufferobj);
+	 /* If using a real VBO, get new storage */
+         if (exec->vtx.bufferobj->Name) {
+            ctx->Driver.BufferData(ctx, target, size, NULL, usage, exec->vtx.bufferobj);
+            exec->vtx.buffer_map = 
+               ctx->Driver.MapBuffer(ctx, target, access, exec->vtx.bufferobj);
+         }
       }
    }
 
-- 
2.30.2