Module: Mesa
Branch: staging/23.0
Commit: 9df373d050c7744f80aa34b2a323cd04172ac9af
URL:    
http://cgit.freedesktop.org/mesa/mesa/commit/?id=9df373d050c7744f80aa34b2a323cd04172ac9af

Author: Pierre-Eric Pelloux-Prayer <[email protected]>
Date:   Fri Mar 31 16:57:08 2023 +0200

mesa: fix invalid index_bo refcounting

If take_index_buffer_ownership is true, then we should reserve
enough references of index_bo or we'll get an underflow later.

Fixes: 819627041e7 ("mesa: set pipe_draw_info::index::resource directly and 
remove gl_bo")
Closes: https://gitlab.freedesktop.org/mesa/mesa/-/issues/8747
Reviewed-by: Mike Blumenkrantz <[email protected]>
Reviewed-by: Marek Olšák <[email protected]>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/22237>
(cherry picked from commit 2b717f01f711f4326c956c72a4515871a0987742)

---

 .pick_status.json    | 2 +-
 src/mesa/main/draw.c | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/.pick_status.json b/.pick_status.json
index 679119e8450..3bb9ffb6b43 100644
--- a/.pick_status.json
+++ b/.pick_status.json
@@ -679,7 +679,7 @@
         "description": "mesa: fix invalid index_bo refcounting",
         "nominated": true,
         "nomination_type": 1,
-        "resolution": 0,
+        "resolution": 1,
         "main_sha": null,
         "because_sha": "819627041e737b05d7a9a5c74e29fd9994ec9115"
     },
diff --git a/src/mesa/main/draw.c b/src/mesa/main/draw.c
index 464d6bb5911..2177f2bdd9a 100644
--- a/src/mesa/main/draw.c
+++ b/src/mesa/main/draw.c
@@ -2459,6 +2459,11 @@ _mesa_MultiDrawElementsIndirect(GLenum mode, GLenum type,
          /* Fast path for u_threaded_context to eliminate atomics. */
          info.index.resource = _mesa_get_bufferobj_reference(ctx, index_bo);
          info.take_index_buffer_ownership = true;
+         /* Increase refcount so be able to use take_index_buffer_ownership 
with
+          * multiple draws.
+          */
+         if (primcount > 1 && info.index.resource)
+            p_atomic_add(&info.index.resource->reference.count, primcount - 1);
       } else {
          info.index.resource = index_bo->buffer;
       }

Reply via email to