mesa: improved gl_buffer_object reference counting

Use new _mesa_reference_buffer_object() function wherever possible.
Fixes buffer object/display list crash reported in ParaView.

5 files changed, 172 insertions, 160 deletions

diff --git a/src/mesa/main/arrayobj.c b/src/mesa/main/arrayobj.c
index f08f99d8e17..0bc582602e8 100644
--- a/src/mesa/main/arrayobj.c
+++ b/src/mesa/main/arrayobj.c
@@ -1,8 +1,8 @@
 /*
  * Mesa 3-D graphics library
- * Version:  6.5
+ * Version:  7.2
  *
- * Copyright (C) 1999-2004  Brian Paul   All Rights Reserved.
+ * Copyright (C) 1999-2008  Brian Paul   All Rights Reserved.
  * (C) Copyright IBM Corporation 2006
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
@@ -210,6 +210,15 @@ _mesa_remove_array_object( GLcontext *ctx, struct gl_array_object *obj )
 }
 
 
+static void
+unbind_buffer_object( GLcontext *ctx, struct gl_buffer_object *bufObj )
+{
+   if (bufObj != ctx->Array.NullBufferObj) {
+      _mesa_reference_buffer_object(ctx, &bufObj, NULL);
+   }
+}
+
+
 /**********************************************************************/
 /* API Functions                                                      */
 /**********************************************************************/
@@ -311,18 +320,18 @@ _mesa_DeleteVertexArraysAPPLE(GLsizei n, const GLuint *ids)
 	 /* Unbind any buffer objects that might be bound to arrays in
 	  * this array object.
 	  */
-	 _mesa_unbind_buffer_object( ctx, obj->Vertex.BufferObj );
-	 _mesa_unbind_buffer_object( ctx, obj->Normal.BufferObj );
-	 _mesa_unbind_buffer_object( ctx, obj->Color.BufferObj );
-	 _mesa_unbind_buffer_object( ctx, obj->SecondaryColor.BufferObj );
-	 _mesa_unbind_buffer_object( ctx, obj->FogCoord.BufferObj );
-	 _mesa_unbind_buffer_object( ctx, obj->Index.BufferObj );
+	 unbind_buffer_object( ctx, obj->Vertex.BufferObj );
+	 unbind_buffer_object( ctx, obj->Normal.BufferObj );
+	 unbind_buffer_object( ctx, obj->Color.BufferObj );
+	 unbind_buffer_object( ctx, obj->SecondaryColor.BufferObj );
+	 unbind_buffer_object( ctx, obj->FogCoord.BufferObj );
+	 unbind_buffer_object( ctx, obj->Index.BufferObj );
 	 for (i = 0; i < MAX_TEXTURE_UNITS; i++) {
-	    _mesa_unbind_buffer_object( ctx, obj->TexCoord[i].BufferObj );
+	    unbind_buffer_object( ctx, obj->TexCoord[i].BufferObj );
 	 }
-	 _mesa_unbind_buffer_object( ctx, obj->EdgeFlag.BufferObj );
+	 unbind_buffer_object( ctx, obj->EdgeFlag.BufferObj );
 	 for (i = 0; i < VERT_ATTRIB_MAX; i++) {
-	    _mesa_unbind_buffer_object( ctx, obj->VertexAttrib[i].BufferObj );
+	    unbind_buffer_object( ctx, obj->VertexAttrib[i].BufferObj );
 	 }
 #endif
 
diff --git a/src/mesa/main/attrib.c b/src/mesa/main/attrib.c
index c3c1f927fd2..94475b981dd 100644
--- a/src/mesa/main/attrib.c
+++ b/src/mesa/main/attrib.c
@@ -1,8 +1,8 @@
 /*
  * Mesa 3-D graphics library
- * Version:  7.1
+ * Version:  7.2
  *
- * Copyright (C) 1999-2007  Brian Paul   All Rights Reserved.
+ * Copyright (C) 1999-2008  Brian Paul   All Rights Reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the "Software"),
@@ -1274,6 +1274,29 @@ adjust_buffer_object_ref_counts(struct gl_array_attrib *array, GLint step)
 }
 
 
+/**
+ * Copy gl_pixelstore_attrib from src to dst, updating buffer
+ * object refcounts.
+ */
+static void
+copy_pixelstore(GLcontext *ctx,
+                struct gl_pixelstore_attrib *dst,
+                const struct gl_pixelstore_attrib *src)
+{
+   dst->Alignment = src->Alignment;
+   dst->RowLength = src->RowLength;
+   dst->SkipPixels = src->SkipPixels;
+   dst->SkipRows = src->SkipRows;
+   dst->ImageHeight = src->ImageHeight;
+   dst->SkipImages = src->SkipImages;
+   dst->SwapBytes = src->SwapBytes;
+   dst->LsbFirst = src->LsbFirst;
+   dst->ClientStorage = src->ClientStorage;
+   dst->Invert = src->Invert;
+   _mesa_reference_buffer_object(ctx, &dst->BufferObj, src->BufferObj);
+}
+
+
 #define GL_CLIENT_PACK_BIT (1<<20)
 #define GL_CLIENT_UNPACK_BIT (1<<21)
 
@@ -1292,31 +1315,29 @@ _mesa_PushClientAttrib(GLbitfield mask)
       return;
    }
 
-   /* Build linked list of attribute nodes which save all attribute */
-   /* groups specified by the mask. */
+   /* Build linked list of attribute nodes which save all attribute
+    * groups specified by the mask.
+    */
    head = NULL;
 
    if (mask & GL_CLIENT_PIXEL_STORE_BIT) {
       struct gl_pixelstore_attrib *attr;
-#if FEATURE_EXT_pixel_buffer_object
-      ctx->Pack.BufferObj->RefCount++;
-      ctx->Unpack.BufferObj->RefCount++;
-#endif
       /* packing attribs */
-      attr = MALLOC_STRUCT( gl_pixelstore_attrib );
-      MEMCPY( attr, &ctx->Pack, sizeof(struct gl_pixelstore_attrib) );
+      attr = CALLOC_STRUCT( gl_pixelstore_attrib );
+      copy_pixelstore(ctx, attr, &ctx->Pack);
       newnode = new_attrib_node( GL_CLIENT_PACK_BIT );
       newnode->data = attr;
       newnode->next = head;
       head = newnode;
       /* unpacking attribs */
       attr = MALLOC_STRUCT( gl_pixelstore_attrib );
-      MEMCPY( attr, &ctx->Unpack, sizeof(struct gl_pixelstore_attrib) );
+      copy_pixelstore(ctx, attr, &ctx->Unpack);
       newnode = new_attrib_node( GL_CLIENT_UNPACK_BIT );
       newnode->data = attr;
       newnode->next = head;
       head = newnode;
    }
+
    if (mask & GL_CLIENT_VERTEX_ARRAY_BIT) {
       struct gl_array_attrib *attr;
       struct gl_array_object *obj;
@@ -1353,7 +1374,7 @@ _mesa_PushClientAttrib(GLbitfield mask)
 void GLAPIENTRY
 _mesa_PopClientAttrib(void)
 {
-   struct gl_attrib_node *attr, *next;
+   struct gl_attrib_node *node, *next;
 
    GET_CURRENT_CONTEXT(ctx);
    ASSERT_OUTSIDE_BEGIN_END_AND_FLUSH(ctx);
@@ -1364,37 +1385,31 @@ _mesa_PopClientAttrib(void)
    }
 
    ctx->ClientAttribStackDepth--;
-   attr = ctx->ClientAttribStack[ctx->ClientAttribStackDepth];
+   node = ctx->ClientAttribStack[ctx->ClientAttribStackDepth];
 
-   while (attr) {
-      switch (attr->kind) {
+   while (node) {
+      switch (node->kind) {
          case GL_CLIENT_PACK_BIT:
-#if FEATURE_EXT_pixel_buffer_object
-            ctx->Pack.BufferObj->RefCount--;
-            if (ctx->Pack.BufferObj->RefCount <= 0) {
-               _mesa_remove_buffer_object( ctx, ctx->Pack.BufferObj );
-               (*ctx->Driver.DeleteBuffer)( ctx, ctx->Pack.BufferObj );
+            {
+               struct gl_pixelstore_attrib *store =
+                  (struct gl_pixelstore_attrib *) node->data;
+               copy_pixelstore(ctx, &ctx->Pack, store);
+               _mesa_reference_buffer_object(ctx, &store->BufferObj, NULL);
             }
-#endif
-            MEMCPY( &ctx->Pack, attr->data,
-                    sizeof(struct gl_pixelstore_attrib) );
 	    ctx->NewState |= _NEW_PACKUNPACK;
             break;
          case GL_CLIENT_UNPACK_BIT:
-#if FEATURE_EXT_pixel_buffer_object
-            ctx->Unpack.BufferObj->RefCount--;
-            if (ctx->Unpack.BufferObj->RefCount <= 0) {
-               _mesa_remove_buffer_object( ctx, ctx->Unpack.BufferObj );
-               (*ctx->Driver.DeleteBuffer)( ctx, ctx->Unpack.BufferObj );
+            {
+               struct gl_pixelstore_attrib *store =
+                  (struct gl_pixelstore_attrib *) node->data;
+               copy_pixelstore(ctx, &ctx->Unpack, store);
+               _mesa_reference_buffer_object(ctx, &store->BufferObj, NULL);
             }
-#endif
-            MEMCPY( &ctx->Unpack, attr->data,
-                    sizeof(struct gl_pixelstore_attrib) );
 	    ctx->NewState |= _NEW_PACKUNPACK;
             break;
          case GL_CLIENT_VERTEX_ARRAY_BIT: {
 	    struct gl_array_attrib * data =
-	      (struct gl_array_attrib *) attr->data;
+	      (struct gl_array_attrib *) node->data;
 
             adjust_buffer_object_ref_counts(&ctx->Array, -1);
 	 
@@ -1431,10 +1446,10 @@ _mesa_PopClientAttrib(void)
             break;
       }
 
-      next = attr->next;
-      FREE( attr->data );
-      FREE( attr );
-      attr = next;
+      next = node->next;
+      FREE( node->data );
+      FREE( node );
+      node = next;
    }
 }
 
diff --git a/src/mesa/main/bufferobj.c b/src/mesa/main/bufferobj.c
index eb418610a72..1b58f5e96af 100644
--- a/src/mesa/main/bufferobj.c
+++ b/src/mesa/main/bufferobj.c
@@ -1,6 +1,6 @@
 /*
  * Mesa 3-D graphics library
- * Version:  7.1
+ * Version:  7.2
  *
  * Copyright (C) 1999-2008  Brian Paul   All Rights Reserved.
  *
@@ -166,22 +166,75 @@ _mesa_delete_buffer_object( GLcontext *ctx, struct gl_buffer_object *bufObj )
 
    if (bufObj->Data)
       _mesa_free(bufObj->Data);
+
+   /* assign strange values here to help w/ debugging */
+   bufObj->RefCount = -1000;
+   bufObj->Name = ~0;
+
    _mesa_free(bufObj);
 }
 
 
+
+/**
+ * Set ptr to bufObj w/ reference counting.
+ */
 void
-_mesa_unbind_buffer_object( GLcontext *ctx, struct gl_buffer_object *bufObj )
+_mesa_reference_buffer_object(GLcontext *ctx,
+                              struct gl_buffer_object **ptr,
+                              struct gl_buffer_object *bufObj)
 {
-   if (bufObj != ctx->Array.NullBufferObj) {
-      bufObj->RefCount--;
-      if (bufObj->RefCount <= 0) {
+   if (*ptr == bufObj)
+      return;
+
+   if (*ptr) {
+      /* Unreference the old texture */
+      GLboolean deleteFlag = GL_FALSE;
+      struct gl_buffer_object *oldObj = *ptr;
+
+      /*_glthread_LOCK_MUTEX(oldObj->Mutex);*/
+      ASSERT(oldObj->RefCount > 0);
+      oldObj->RefCount--;
+#if 0
+      printf("BufferObj %p %d DECR to %d\n",
+             (void *) oldObj, oldObj->Name, oldObj->RefCount);
+#endif
+      deleteFlag = (oldObj->RefCount == 0);
+      /*_glthread_UNLOCK_MUTEX(oldObj->Mutex);*/
+
+      if (deleteFlag) {
+
+         /* some sanity checking: don't delete a buffer still in use */
 	 ASSERT(ctx->Array.ArrayBufferObj != bufObj);
 	 ASSERT(ctx->Array.ElementArrayBufferObj != bufObj);
 	 ASSERT(ctx->Array.ArrayObj->Vertex.BufferObj != bufObj);
 	 ASSERT(ctx->Driver.DeleteBuffer);
-	 ctx->Driver.DeleteBuffer(ctx, bufObj);
+
+         ctx->Driver.DeleteBuffer(ctx, oldObj);
       }
+
+      *ptr = NULL;
+   }
+   ASSERT(!*ptr);
+
+   if (bufObj) {
+      /* reference new texture */
+      /*_glthread_LOCK_MUTEX(tex->Mutex);*/
+      if (bufObj->RefCount == 0) {
+         /* this buffer's being deleted (look just above) */
+         /* Not sure this can every really happen.  Warn if it does. */
+         _mesa_problem(NULL, "referencing deleted buffer object");
+         *ptr = NULL;
+      }
+      else {
+         bufObj->RefCount++;
+#if 0
+         printf("BufferObj %p %d INCR to %d\n",
+                (void *) bufObj, bufObj->Name, bufObj->RefCount);
+#endif
+         *ptr = bufObj;
+      }
+      /*_glthread_UNLOCK_MUTEX(tex->Mutex);*/
    }
 }
 
@@ -204,33 +257,6 @@ _mesa_initialize_buffer_object( struct gl_buffer_object *obj,
 
 
 /**
- * Add the given buffer object to the buffer object pool.
- */
-void
-_mesa_save_buffer_object( GLcontext *ctx, struct gl_buffer_object *obj )
-{
-   if (obj->Name > 0) {
-      /* insert into hash table */
-      _mesa_HashInsert(ctx->Shared->BufferObjects, obj->Name, obj);
-   }
-}
-
-
-/**
- * Remove the given buffer object from the buffer object pool.
- * Do not deallocate the buffer object though.
- */
-void
-_mesa_remove_buffer_object( GLcontext *ctx, struct gl_buffer_object *bufObj )
-{
-   if (bufObj->Name > 0) {
-      /* remove from hash table */
-      _mesa_HashRemove(ctx->Shared->BufferObjects, bufObj->Name);
-   }
-}
-
-
-/**
  * Allocate space for and store data in a buffer object.  Any data that was
  * previously stored in the buffer object is lost.  If \c data is \c NULL,
  * memory will be allocated, but no copy will occur.
@@ -400,6 +426,7 @@ _mesa_init_buffer_objects( GLcontext *ctx )
 {
    /* Allocate the default buffer object and set refcount so high that
     * it never gets deleted.
+    * XXX with recent/improved refcounting this may not longer be needed.
     */
    ctx->Array.NullBufferObj = _mesa_new_buffer_object(ctx, 0, 0);
    if (ctx->Array.NullBufferObj)
@@ -462,28 +489,16 @@ bind_buffer_object(GLcontext *ctx, GLenum target, GLuint buffer)
             _mesa_error(ctx, GL_OUT_OF_MEMORY, "glBindBufferARB");
             return;
          }
-         _mesa_save_buffer_object(ctx, newBufObj);
+         _mesa_HashInsert(ctx->Shared->BufferObjects, buffer, newBufObj);
       }
    }
    
-   /* Make new binding */
-   *bindTarget = newBufObj;
-   newBufObj->RefCount++;
+   /* bind new buffer */
+   _mesa_reference_buffer_object(ctx, bindTarget, newBufObj);
 
    /* Pass BindBuffer call to device driver */
    if (ctx->Driver.BindBuffer && newBufObj)
       ctx->Driver.BindBuffer( ctx, target, newBufObj );
-
-   /* decr ref count on old buffer obj, delete if needed */
-   if (oldBufObj) {
-      oldBufObj->RefCount--;
-      assert(oldBufObj->RefCount >= 0);
-      if (oldBufObj->RefCount == 0) {
-         assert(oldBufObj->Name != 0);
-         ASSERT(ctx->Driver.DeleteBuffer);
-         ctx->Driver.DeleteBuffer( ctx, oldBufObj );
-      }
-   }
 }
 
 
@@ -716,6 +731,23 @@ _mesa_lookup_bufferobj(GLcontext *ctx, GLuint buffer)
 }
 
 
+/**
+ * If *ptr points to obj, set ptr = the Null/default buffer object.
+ * This is a helper for buffer object deletion.
+ * The GL spec says that deleting a buffer object causes it to get
+ * unbound from all arrays in the current context.
+ */
+static void
+unbind(GLcontext *ctx,
+       struct gl_buffer_object **ptr,
+       struct gl_buffer_object *obj)
+{
+   if (*ptr == obj) {
+      _mesa_reference_buffer_object(ctx, ptr, ctx->Array.NullBufferObj);
+   }
+}
+
+
 
 /**********************************************************************/
 /* API Functions                                                      */
@@ -759,54 +791,18 @@ _mesa_DeleteBuffersARB(GLsizei n, const GLuint *ids)
 
          ASSERT(bufObj->Name == ids[i]);
 
-         if (ctx->Array.ArrayObj->Vertex.BufferObj == bufObj) {
-            bufObj->RefCount--;
-            ctx->Array.ArrayObj->Vertex.BufferObj = ctx->Array.NullBufferObj;
-            ctx->Array.NullBufferObj->RefCount++;
-         }
-         if (ctx->Array.ArrayObj->Normal.BufferObj == bufObj) {
-            bufObj->RefCount--;
-            ctx->Array.ArrayObj->Normal.BufferObj = ctx->Array.NullBufferObj;
-            ctx->Array.NullBufferObj->RefCount++;
-         }
-         if (ctx->Array.ArrayObj->Color.BufferObj == bufObj) {
-            bufObj->RefCount--;
-            ctx->Array.ArrayObj->Color.BufferObj = ctx->Array.NullBufferObj;
-            ctx->Array.NullBufferObj->RefCount++;
-         }
-         if (ctx->Array.ArrayObj->SecondaryColor.BufferObj == bufObj) {
-            bufObj->RefCount--;
-            ctx->Array.ArrayObj->SecondaryColor.BufferObj = ctx->Array.NullBufferObj;
-            ctx->Array.NullBufferObj->RefCount++;
-         }
-         if (ctx->Array.ArrayObj->FogCoord.BufferObj == bufObj) {
-            bufObj->RefCount--;
-            ctx->Array.ArrayObj->FogCoord.BufferObj = ctx->Array.NullBufferObj;
-            ctx->Array.NullBufferObj->RefCount++;
-         }
-         if (ctx->Array.ArrayObj->Index.BufferObj == bufObj) {
-            bufObj->RefCount--;
-            ctx->Array.ArrayObj->Index.BufferObj = ctx->Array.NullBufferObj;
-            ctx->Array.NullBufferObj->RefCount++;
-         }
-         if (ctx->Array.ArrayObj->EdgeFlag.BufferObj == bufObj) {
-            bufObj->RefCount--;
-            ctx->Array.ArrayObj->EdgeFlag.BufferObj = ctx->Array.NullBufferObj;
-            ctx->Array.NullBufferObj->RefCount++;
-         }
+         unbind(ctx, &ctx->Array.ArrayObj->Vertex.BufferObj, bufObj);
+         unbind(ctx, &ctx->Array.ArrayObj->Normal.BufferObj, bufObj);
+         unbind(ctx, &ctx->Array.ArrayObj->Color.BufferObj, bufObj);
+         unbind(ctx, &ctx->Array.ArrayObj->SecondaryColor.BufferObj, bufObj);
+         unbind(ctx, &ctx->Array.ArrayObj->FogCoord.BufferObj, bufObj);
+         unbind(ctx, &ctx->Array.ArrayObj->Index.BufferObj, bufObj);
+         unbind(ctx, &ctx->Array.ArrayObj->EdgeFlag.BufferObj, bufObj);
          for (j = 0; j < MAX_TEXTURE_UNITS; j++) {
-            if (ctx->Array.ArrayObj->TexCoord[j].BufferObj == bufObj) {
-               bufObj->RefCount--;
-               ctx->Array.ArrayObj->TexCoord[j].BufferObj = ctx->Array.NullBufferObj;
-               ctx->Array.NullBufferObj->RefCount++;
-            }
+            unbind(ctx, &ctx->Array.ArrayObj->TexCoord[j].BufferObj, bufObj);
          }
          for (j = 0; j < VERT_ATTRIB_MAX; j++) {
-            if (ctx->Array.ArrayObj->VertexAttrib[j].BufferObj == bufObj) {
-               bufObj->RefCount--;
-               ctx->Array.ArrayObj->VertexAttrib[j].BufferObj = ctx->Array.NullBufferObj;
-               ctx->Array.NullBufferObj->RefCount++;
-            }
+            unbind(ctx, &ctx->Array.ArrayObj->VertexAttrib[j].BufferObj, bufObj);
          }
 
          if (ctx->Array.ArrayBufferObj == bufObj) {
@@ -824,8 +820,8 @@ _mesa_DeleteBuffersARB(GLsizei n, const GLuint *ids)
          }
 
          /* The ID is immediately freed for re-use */
-         _mesa_remove_buffer_object(ctx, bufObj);
-         _mesa_unbind_buffer_object(ctx, bufObj);
+         _mesa_HashRemove(ctx->Shared->BufferObjects, bufObj->Name);
+         _mesa_reference_buffer_object(ctx, &bufObj, NULL);
       }
    }
 
@@ -874,7 +870,7 @@ _mesa_GenBuffersARB(GLsizei n, GLuint *buffer)
          _mesa_error(ctx, GL_OUT_OF_MEMORY, "glGenBuffersARB");
          return;
       }
-      _mesa_save_buffer_object(ctx, bufObj);
+      _mesa_HashInsert(ctx->Shared->BufferObjects, first + i, bufObj);
       buffer[i] = first + i;
    }
 
diff --git a/src/mesa/main/bufferobj.h b/src/mesa/main/bufferobj.h
index 8baa59d6171..163fe241aab 100644
--- a/src/mesa/main/bufferobj.h
+++ b/src/mesa/main/bufferobj.h
@@ -1,6 +1,6 @@
 /*
  * Mesa 3-D graphics library
- * Version:  7.1
+ * Version:  7.2
  *
  * Copyright (C) 1999-2008  Brian Paul   All Rights Reserved.
  *
@@ -55,10 +55,9 @@ _mesa_initialize_buffer_object( struct gl_buffer_object *obj,
 				GLuint name, GLenum target );
 
 extern void
-_mesa_save_buffer_object( GLcontext *ctx, struct gl_buffer_object *obj );
-
-extern void
-_mesa_remove_buffer_object( GLcontext *ctx, struct gl_buffer_object *bufObj );
+_mesa_reference_buffer_object(GLcontext *ctx,
+                              struct gl_buffer_object **ptr,
+                              struct gl_buffer_object *bufObj);
 
 extern void
 _mesa_buffer_data( GLcontext *ctx, GLenum target, GLsizeiptrARB size,
@@ -118,8 +117,6 @@ _mesa_unmap_readpix_pbo(GLcontext *ctx,
                         const struct gl_pixelstore_attrib *pack);
 
 
-extern void
-_mesa_unbind_buffer_object( GLcontext *ctx, struct gl_buffer_object *bufObj );
 
 /*
  * API functions
diff --git a/src/mesa/main/varray.c b/src/mesa/main/varray.c
index 22a55ac7076..67dd093f2a6 100644
--- a/src/mesa/main/varray.c
+++ b/src/mesa/main/varray.c
@@ -1,8 +1,8 @@
 /*
  * Mesa 3-D graphics library
- * Version:  6.5.1
+ * Version:  7.2
  *
- * Copyright (C) 1999-2006  Brian Paul   All Rights Reserved.
+ * Copyright (C) 1999-2008  Brian Paul   All Rights Reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the "Software"),
@@ -62,14 +62,9 @@ update_array(GLcontext *ctx, struct gl_client_array *array,
    array->Normalized = normalized;
    array->Ptr = (const GLubyte *) ptr;
 #if FEATURE_ARB_vertex_buffer_object
-   array->BufferObj->RefCount--;
-   if (array->BufferObj->RefCount <= 0) {
-      ASSERT(array->BufferObj->Name);
-      _mesa_remove_buffer_object( ctx, array->BufferObj );
-      (*ctx->Driver.DeleteBuffer)( ctx, array->BufferObj );
-   }
-   array->BufferObj = ctx->Array.ArrayBufferObj;
-   array->BufferObj->RefCount++;
+   _mesa_reference_buffer_object(ctx, &array->BufferObj,
+                                 ctx->Array.ArrayBufferObj);
+
    /* Compute the index of the last array element that's inside the buffer.
     * Later in glDrawArrays we'll check if start + count > _MaxElement to
     * be sure we won't go out of bounds.