Fixes for thread related render / compositing crashes:

* Viewer node could free image while it is being redrawn, viewer image
  buffers now need acquire/release to be accessed as was already the
  case for render results.
* The Composite node could free the image buffers outside of a lock,
  also causing simultaneous redraw to crash.
* Especially on Windows, re-rendering could crash when drawing an image
  that was freed. When RE_RenderInProgress was true it would access the
  image buffer and simply return it while it could still contain a pointer
  to a render result buffer that was already freed. I don't understand
  why this case was there in the first place, so I've removed it.

Possibly fixes bugs #20174, #21418, #21391, #21394.

2 files changed, 7 insertions, 3 deletions

diff --git a/source/blender/nodes/intern/CMP_nodes/CMP_composite.c b/source/blender/nodes/intern/CMP_nodes/CMP_composite.c
index 76a78e46e3a..9a302527a61 100644
--- a/source/blender/nodes/intern/CMP_nodes/CMP_composite.c
+++ b/source/blender/nodes/intern/CMP_nodes/CMP_composite.c
@@ -80,10 +80,10 @@ static void node_composit_exec_composite(void *data, bNode *node, bNodeStack **i
 				outbuf->malloc= 0;
 				free_compbuf(outbuf);
 
-				RE_ReleaseResult(re);
-				
 				/* signal for imageviewer to refresh (it converts to byte rects...) */
 				BKE_image_signal(BKE_image_verify_viewer(IMA_TYPE_R_RESULT, "Render Result"), NULL, IMA_SIGNAL_FREE);
+
+				RE_ReleaseResult(re);
 				return;
 			}
 			else
diff --git a/source/blender/nodes/intern/CMP_nodes/CMP_viewer.c b/source/blender/nodes/intern/CMP_nodes/CMP_viewer.c
index e62a7462702..80200ad9ce6 100644
--- a/source/blender/nodes/intern/CMP_nodes/CMP_viewer.c
+++ b/source/blender/nodes/intern/CMP_nodes/CMP_viewer.c
@@ -50,13 +50,15 @@ static void node_composit_exec_viewer(void *data, bNode *node, bNodeStack **in,
 		ImBuf *ibuf;
 		CompBuf *cbuf, *tbuf;
 		int rectx, recty;
+		void *lock;
 		
 		BKE_image_user_calc_frame(node->storage, rd->cfra, 0);
 
 		/* always returns for viewer image, but we check nevertheless */
-		ibuf= BKE_image_get_ibuf(ima, node->storage);
+		ibuf= BKE_image_acquire_ibuf(ima, node->storage, &lock);
 		if(ibuf==NULL) {
 			printf("node_composit_exec_viewer error\n");
+			BKE_image_release_ibuf(ima, lock);
 			return;
 		}
 		
@@ -106,6 +108,8 @@ static void node_composit_exec_viewer(void *data, bNode *node, bNodeStack **in,
 			free_compbuf(zbuf);
 		}
 
+		BKE_image_release_ibuf(ima, lock);
+
 		generate_preview(data, node, cbuf);
 		free_compbuf(cbuf);