Fix T38045: Clone stamp crashes

Issue seems to be caused by thread-unsafe IMB_freeImBuf.
Now use generic BKE_image_release_ibuf to de-reference
image buffer which was acquired from image datablock.

4 files changed, 8 insertions, 12 deletions

diff --git a/source/blender/blenkernel/intern/image.c b/source/blender/blenkernel/intern/image.c
index 288443db650..f83112ba283 100644
--- a/source/blender/blenkernel/intern/image.c
+++ b/source/blender/blenkernel/intern/image.c
@@ -3611,7 +3611,9 @@ bool BKE_image_has_loaded_ibuf(Image *image)
 	return has_loaded_ibuf;
 }
 
-/* References the result, IMB_freeImBuf is to be called to de-reference. */
+/* References the result, BKE_image_release_ibuf is to be called to de-reference.
+ * Use lock=NULL when calling BKE_image_release_ibuf().
+ */
 ImBuf *BKE_image_get_ibuf_with_name(Image *image, const char *name)
 {
 	ImBuf *ibuf = NULL;
@@ -3635,7 +3637,8 @@ ImBuf *BKE_image_get_ibuf_with_name(Image *image, const char *name)
 	return ibuf;
 }
 
-/* References the result, IMB_freeImBuf is to be called to de-reference.
+/* References the result, BKE_image_release_ibuf is to be called to de-reference.
+ * Use lock=NULL when calling BKE_image_release_ibuf().
  *
  * TODO(sergey): This is actually "get first entry from the cache", which is
  *               not so much predictable. But using first loaded image buffer
diff --git a/source/blender/editors/sculpt_paint/paint_image.c b/source/blender/editors/sculpt_paint/paint_image.c
index 5b323a0a396..adcbc721e80 100644
--- a/source/blender/editors/sculpt_paint/paint_image.c
+++ b/source/blender/editors/sculpt_paint/paint_image.c
@@ -250,7 +250,6 @@ void ED_image_undo_restore(bContext *C, ListBase *lb)
 
 	for (tile = lb->first; tile; tile = tile->next) {
 		short use_float;
-		bool need_release = true;
 
 		/* find image based on name, pointer becomes invalid with global undo */
 		if (ima && strcmp(tile->idname, ima->id.name) == 0) {
@@ -269,7 +268,6 @@ void ED_image_undo_restore(bContext *C, ListBase *lb)
 			 * matched file name in list of already loaded images */
 
 			BKE_image_release_ibuf(ima, ibuf, NULL);
-			need_release = false;
 
 			ibuf = BKE_image_get_ibuf_with_name(ima, tile->ibufname);
 		}
@@ -300,12 +298,7 @@ void ED_image_undo_restore(bContext *C, ListBase *lb)
 			ibuf->userflags |= IB_MIPMAP_INVALID;  /* force mipmap recreatiom */
 		ibuf->userflags |= IB_DISPLAY_BUFFER_INVALID;
 
-		if (need_release) {
-			BKE_image_release_ibuf(ima, ibuf, NULL);
-		}
-		else {
-			IMB_freeImBuf(ibuf);
-		}
+		BKE_image_release_ibuf(ima, ibuf, NULL);
 	}
 
 	IMB_freeImBuf(tmpibuf);
diff --git a/source/blender/editors/sculpt_paint/paint_image_proj.c b/source/blender/editors/sculpt_paint/paint_image_proj.c
index 4b402bc1741..385d1aa57ed 100644
--- a/source/blender/editors/sculpt_paint/paint_image_proj.c
+++ b/source/blender/editors/sculpt_paint/paint_image_proj.c
@@ -598,7 +598,7 @@ static bool project_paint_PickColor(const ProjPaintState *ps, const float pt[2],
 			}
 		}
 	}
-	IMB_freeImBuf(ibuf);
+	BKE_image_release_ibuf(ima, ibuf, NULL);
 	return 1;
 }
 
diff --git a/source/blender/gpu/intern/gpu_draw.c b/source/blender/gpu/intern/gpu_draw.c
index 1f0e20a9210..5910941cb3c 100644
--- a/source/blender/gpu/intern/gpu_draw.c
+++ b/source/blender/gpu/intern/gpu_draw.c
@@ -187,7 +187,7 @@ void GPU_render_text(MTFace *tface, int mode,
 		}
 		glPopMatrix();
 
-		IMB_freeImBuf(first_ibuf);
+		BKE_image_release_ibuf(ima, first_ibuf, NULL);
 	}
 }