softpipe: Grab a ref when the fb is set.

Nasty bug when the surface is freed and another is allocated right on
top of it. The next time we set the fb state SP thinks it's the same
surface and doesn't flush, and when the flush eventually happens the
surface belongs to a completely different texture.

2 files changed, 9 insertions, 4 deletions

diff --git a/src/gallium/drivers/softpipe/sp_context.c b/src/gallium/drivers/softpipe/sp_context.c
index e1e31ab..94d000a 100644
--- a/src/gallium/drivers/softpipe/sp_context.c
+++ b/src/gallium/drivers/softpipe/sp_context.c
@@ -94,12 +94,17 @@ softpipe_destroy( struct pipe_context *pipe )
       softpipe->quad.depth_test->destroy( softpipe->quad.depth_test );
       softpipe->quad.blend->destroy( softpipe->quad.blend );
 
-   for (i = 0; i < PIPE_MAX_COLOR_BUFS; i++)
+   for (i = 0; i < PIPE_MAX_COLOR_BUFS; i++) {
       sp_destroy_tile_cache(softpipe->cbuf_cache[i]);
+      pipe_surface_reference(&softpipe->framebuffer.cbufs[i], NULL);
+   }
    sp_destroy_tile_cache(softpipe->zsbuf_cache);
+   pipe_surface_reference(&softpipe->framebuffer.zsbuf, NULL);
 
-   for (i = 0; i < PIPE_MAX_SAMPLERS; i++)
+   for (i = 0; i < PIPE_MAX_SAMPLERS; i++) {
       sp_destroy_tex_tile_cache(softpipe->tex_cache[i]);
+      pipe_texture_reference(&softpipe->texture[i], NULL);
+   }
 
    for (i = 0; i < Elements(softpipe->constants); i++) {
       if (softpipe->constants[i].buffer) {
diff --git a/src/gallium/drivers/softpipe/sp_state_surface.c b/src/gallium/drivers/softpipe/sp_state_surface.c
index c8f55c3..bc0e201 100644
--- a/src/gallium/drivers/softpipe/sp_state_surface.c
+++ b/src/gallium/drivers/softpipe/sp_state_surface.c
@@ -56,7 +56,7 @@ softpipe_set_framebuffer_state(struct pipe_context *pipe,
          sp_flush_tile_cache(sp->cbuf_cache[i]);
 
          /* assign new */
-         sp->framebuffer.cbufs[i] = fb->cbufs[i];
+         pipe_surface_reference(&sp->framebuffer.cbufs[i], fb->cbufs[i]);
 
          /* update cache */
          sp_tile_cache_set_surface(sp->cbuf_cache[i], fb->cbufs[i]);
@@ -71,7 +71,7 @@ softpipe_set_framebuffer_state(struct pipe_context *pipe,
       sp_flush_tile_cache(sp->zsbuf_cache);
 
       /* assign new */
-      sp->framebuffer.zsbuf = fb->zsbuf;
+      pipe_surface_reference(&sp->framebuffer.zsbuf, fb->zsbuf);
 
       /* update cache */
       sp_tile_cache_set_surface(sp->zsbuf_cache, fb->zsbuf);