mesa: Fix null buffer object reference counting.

Always use _mesa_reference_buffer_object, and never call
ctx->Driver.DeleteBuffer() directly to prevent dangling pointers to the
null buffer object.

This fixes crash/assertions in sharedtex_mt and Autodesk Mudbox.

1 files changed, 11 insertions, 0 deletions

diff --git a/src/mesa/vbo/vbo_save.c b/src/mesa/vbo/vbo_save.c
index 10f705cf844..fd9a1302705 100644
--- a/src/mesa/vbo/vbo_save.c
+++ b/src/mesa/vbo/vbo_save.c
@@ -58,8 +58,19 @@ void vbo_save_init( GLcontext *ctx )
 
    {
       struct gl_client_array *arrays = save->arrays;
+      unsigned i;
+
       memcpy(arrays,      vbo->legacy_currval,  16 * sizeof(arrays[0]));
       memcpy(arrays + 16, vbo->generic_currval, 16 * sizeof(arrays[0]));
+
+      for (i = 0; i < 16; ++i) {
+         arrays[i     ].BufferObj = NULL;
+         arrays[i + 16].BufferObj = NULL;
+         _mesa_reference_buffer_object(ctx, &arrays[i     ].BufferObj, 
+                                       vbo->legacy_currval[i].BufferObj);
+         _mesa_reference_buffer_object(ctx, &arrays[i + 16].BufferObj,
+                                       vbo->generic_currval[i].BufferObj);
+      }
    }
 
    ctx->Driver.CurrentSavePrimitive = PRIM_UNKNOWN;