Bugfix #25657

Three code fixes for 1 report. User experienced crashes while
painting on float buffer + having preview renders on.

- Texture Nodes: Image was re-allocated without using
  proper thread lock
- Paint code: old convention to free the byte rect from
  a float image as signal to re-create now is a proper
  flag. This keeps image memory unchanged. Nice for render.
- Imbuf: call to make a byte rect from float was freeing
  mipmaps unnecessary.

source/blender/editors/sculpt_paint/paint_image.c

@@ -432,7 +432,8 @@ static void image_undo_restore(bContext *C, ListBase *lb)
 
 		GPU_free_image(ima); /* force OpenGL reload */
 		if(ibuf->rect_float)
-			imb_freerectImBuf(ibuf); /* force recreate of char rect */
+			ibuf->userflags |= IB_RECT_INVALID; /* force recreate of char rect */
+
 	}
 
 	IMB_freeImBuf(tmpibuf);
@@ -4022,7 +4023,7 @@ static void imapaint_image_update(SpaceImage *sima, Image *image, ImBuf *ibuf, s
 {
 	if(ibuf->rect_float)
 		/* TODO - should just update a portion from imapaintpartial! */
-		imb_freerectImBuf(ibuf); /* force recreate of char rect */
+		ibuf->userflags |= IB_RECT_INVALID; /* force recreate of char rect */
 	
 	if(ibuf->mipmap[0])
 		ibuf->userflags |= IB_MIPMAP_INVALID;

source/blender/editors/space_image/image_draw.c

@@ -83,7 +83,7 @@ static void image_verify_buffer_float(Image *ima, ImBuf *ibuf, int color_manage)
 	   NOTE: if float buffer changes, we have to manually remove the rect
 	*/
 
-	if(ibuf->rect_float && ibuf->rect==NULL) {
+	if(ibuf->rect_float && (ibuf->rect==NULL || (ibuf->userflags & IB_RECT_INVALID)) ) {
 		if(color_manage) {
 			if(ima && ima->source == IMA_SRC_VIEWER)
 				ibuf->profile = IB_PROFILE_LINEAR_RGB;

source/blender/imbuf/IMB_imbuf_types.h

@@ -137,12 +137,7 @@ typedef struct ImBuf {
 #define IB_BITMAPFONT		(1 << 0)	/* this image is a font */
 #define IB_BITMAPDIRTY		(1 << 1)	/* image needs to be saved is not the same as filename */
 #define IB_MIPMAP_INVALID	(1 << 2)	/* image mipmaps are invalid, need recreate */
-
+#define IB_RECT_INVALID		(1 << 3)    /* float buffer changed, needs recreation of byte rect */
-/* From iff.h. This was once moved away by Frank, now Nzc moves it
- * back. Such is the way it is... It is a long list of defines, and
- * there are a few external defines in the back. Most of the stuff is
- * probably imbuf_intern only. This will need to be merged later
- * on. */
 
 /**
  * \name Imbuf Component flags

source/blender/imbuf/intern/allocimbuf.c

@@ -277,7 +277,8 @@ short imb_addrectfloatImBuf(ImBuf *ibuf)
 	
 	if(ibuf==NULL) return FALSE;
 	
-	imb_freerectfloatImBuf(ibuf);
+	if(ibuf->rect_float)
+		imb_freerectfloatImBuf(ibuf); /* frees mipmap too, hrm */
 	
 	size = ibuf->x *ibuf->y;
 	size = size *4 *sizeof(float);

source/blender/imbuf/intern/divers.c

@@ -188,6 +188,8 @@ void IMB_rect_from_float(struct ImBuf *ibuf)
 			}
 		}
 	}
+	/* ensure user flag is reset */
+	ibuf->userflags &= ~IB_RECT_INVALID;
 }
 
 static void imb_float_from_rect_nonlinear(struct ImBuf *ibuf, float *fbuf)

source/blender/nodes/intern/TEX_nodes/TEX_image.c

@@ -58,7 +58,13 @@ static void colorfn(float *out, TexParams *p, bNode *node, bNodeStack **UNUSED(i
 			py = (int)( (y-yoff) * ysize );
 		
 			if( (!xsize) || (!ysize) ) return;
-			if( !ibuf->rect_float ) IMB_float_from_rect(ibuf);
+			
+			if( !ibuf->rect_float ) {
+				BLI_lock_thread(LOCK_IMAGE);
+				if( !ibuf->rect_float )
+					IMB_float_from_rect(ibuf);
+				BLI_unlock_thread(LOCK_IMAGE);
+			}
 			
 			while( px < 0 ) px += ibuf->x;
 			while( py < 0 ) py += ibuf->y;