mesa: Avoid ABA problem on buffer object bind.

Make sure we do not run into the classic ABA problem on buffer object bind,
reusing this name and may be never rebind since we get an new name
that was just deleted and never rebound in between.
The explicit rebinding to the debault object in the current context
prevents the above in the current context, but another context
sharing the same objects might suffer from this problem.

Minor var renaming and comments edited by Brian.

Signed-off-by: Mathias Fröhlich <Mathias.Froehlich@web.de>
Signed-off-by: Brian Paul <brianp@vmware.com>

src/mesa/main/bufferobj.c

@@ -571,7 +571,7 @@ bind_buffer_object(struct gl_context *ctx, GLenum target, GLuint buffer)
 
    /* Get pointer to old buffer object (to be unbound) */
    oldBufObj = *bindTarget;
-   if (oldBufObj && oldBufObj->Name == buffer)
+   if (oldBufObj && oldBufObj->Name == buffer && !oldBufObj->DeletePending)
       return;   /* rebinding the same buffer object- no change */
 
    /*
@@ -773,6 +773,17 @@ _mesa_DeleteBuffersARB(GLsizei n, const GLuint *ids)
 
          /* The ID is immediately freed for re-use */
          _mesa_HashRemove(ctx->Shared->BufferObjects, ids[i]);
+         /* Make sure we do not run into the classic ABA problem on bind.
+          * We don't want to allow re-binding a buffer object that's been
+          * "deleted" by glDeleteBuffers().
+          *
+          * The explicit rebinding to the default object in the current context
+          * prevents the above in the current context, but another context
+          * sharing the same objects might suffer from this problem.
+          * The alternative would be to do the hash lookup in any case on bind
+          * which would introduce more runtime overhead than this.
+          */
+         bufObj->DeletePending = GL_TRUE;
          _mesa_reference_buffer_object(ctx, &bufObj, NULL);
       }
    }

src/mesa/main/mtypes.h

@@ -1530,6 +1530,7 @@ struct gl_buffer_object
    GLintptr Offset;     /**< Mapped offset */
    GLsizeiptr Length;   /**< Mapped length */
    /*@}*/
+   GLboolean DeletePending;   /**< true if buffer object is removed from the hash */
    GLboolean Written;   /**< Ever written to? (for debugging) */
    GLboolean Purgeable; /**< Is the buffer purgeable under memory pressure? */
 };