softpipe: Grab a ref when the fb is set.

Nasty bug when the surface is freed and another is allocated right on
top of it. The next time we set the fb state SP thinks it's the same
surface and doesn't flush, and when the flush eventually happens the
surface belongs to a completely different texture.

2 files changed, 9 insertions, 4 deletions

diff --git a/src/gallium/drivers/softpipe/sp_context.c b/src/gallium/drivers/softpipe/sp_context.c
index e1e31ab047a..94d000a5acc 100644
--- a/src/gallium/drivers/softpipe/sp_context.c
+++ b/src/gallium/drivers/softpipe/sp_context.c
@@ -94,12 +94,17 @@ softpipe_destroy( struct pipe_context *pipe )
       softpipe->quad.depth_test->destroy( softpipe->quad.depth_test );
       softpipe->quad.blend->destroy( softpipe->quad.blend );
 
-   for (i = 0; i < PIPE_MAX_COLOR_BUFS; i++)
+   for (i = 0; i < PIPE_MAX_COLOR_BUFS; i++) {
       sp_destroy_tile_cache(softpipe->cbuf_cache[i]);
+      pipe_surface_reference(&softpipe->framebuffer.cbufs[i], NULL);
+   }
    sp_destroy_tile_cache(softpipe->zsbuf_cache);
+   pipe_surface_reference(&softpipe->framebuffer.zsbuf, NULL);
 
-   for (i = 0; i < PIPE_MAX_SAMPLERS; i++)
+   for (i = 0; i < PIPE_MAX_SAMPLERS; i++) {
       sp_destroy_tex_tile_cache(softpipe->tex_cache[i]);
+      pipe_texture_reference(&softpipe->texture[i], NULL);
+   }
 
    for (i = 0; i < Elements(softpipe->constants); i++) {
       if (softpipe->constants[i].buffer) {
diff --git a/src/gallium/drivers/softpipe/sp_state_surface.c b/src/gallium/drivers/softpipe/sp_state_surface.c
index c8f55c3cec4..bc0e2011300 100644
--- a/src/gallium/drivers/softpipe/sp_state_surface.c
+++ b/src/gallium/drivers/softpipe/sp_state_surface.c
@@ -56,7 +56,7 @@ softpipe_set_framebuffer_state(struct pipe_context *pipe,
          sp_flush_tile_cache(sp->cbuf_cache[i]);
 
          /* assign new */
-         sp->framebuffer.cbufs[i] = fb->cbufs[i];
+         pipe_surface_reference(&sp->framebuffer.cbufs[i], fb->cbufs[i]);
 
          /* update cache */
          sp_tile_cache_set_surface(sp->cbuf_cache[i], fb->cbufs[i]);
@@ -71,7 +71,7 @@ softpipe_set_framebuffer_state(struct pipe_context *pipe,
       sp_flush_tile_cache(sp->zsbuf_cache);
 
       /* assign new */
-      sp->framebuffer.zsbuf = fb->zsbuf;
+      pipe_surface_reference(&sp->framebuffer.zsbuf, fb->zsbuf);
 
       /* update cache */
       sp_tile_cache_set_surface(sp->zsbuf_cache, fb->zsbuf);