https://bugs.freedesktop.org/show_bug.cgi?id=29901
--- Comment #5 from Marek Olšák maraeo@gmail.com 2010-09-13 04:30:10 PDT --- The problem is:
- r300_render_allocate_vertices allocates a vertex buffer. - Draw stores vertices in the buffer. - r300_render_draw_arrays is called. - r300_prepare_for_rendering is called and inside that function, assume the command stream is full and must be flushed. r300_flush calls r300_draw_flush_vbuf, which releases the vertex buffer. - r300_prepare_for_rendering begins to emit states. - r300_emit_aos_swtcl is called, which crashes due to the buffer having been deleted.
The commit 0392e48867c27f2aa445c5c9b35f4a52ecef2f2d in Mesa fixes the regressions I was able to reproduce.
I have split r300_prepare_for_rendering into 2 parts: - r300_reserve_cs_dwords, which is called before r300_render_allocate_vertices - r300_emit_states, which is called instead of r300_prepare_for_rendering
Please test.