radeon: fix pointer dangling

6 files changed, 16 insertions, 12 deletions

diff --git a/src/mesa/drivers/dri/r300/Makefile b/src/mesa/drivers/dri/r300/Makefile
index d0616aaca6e..cbb09e6ce59 100644
--- a/src/mesa/drivers/dri/r300/Makefile
+++ b/src/mesa/drivers/dri/r300/Makefile
@@ -57,8 +57,7 @@ C_SOURCES = $(COMMON_SOURCES) $(DRIVER_SOURCES)
 
 DRIVER_DEFINES = -DCOMPILE_R300 -DR200_MERGED=0 \
 	-DRADEON_COMMON=1 -DRADEON_COMMON_FOR_R300 \
-#	-DRADEON_BO_TRACK_REF \
-#	-DRADEON_BO_TRACK_OPEN \
+#	-DRADEON_BO_TRACK \
 	-Wall
 
 SYMLINKS = \
diff --git a/src/mesa/drivers/dri/r300/r300_cmdbuf.c b/src/mesa/drivers/dri/r300/r300_cmdbuf.c
index b8740e298ba..9d0ed698e16 100644
--- a/src/mesa/drivers/dri/r300/r300_cmdbuf.c
+++ b/src/mesa/drivers/dri/r300/r300_cmdbuf.c
@@ -83,6 +83,7 @@ int r300FlushCmdBufLocked(r300ContextPtr r300, const char *caller)
 	r300->cmdbuf.flushing = 1;
     if (r300->cmdbuf.cs->cdw) {
         ret = radeon_cs_emit(r300->cmdbuf.cs);
+        r300->hw.all_dirty = 1;
     }
     radeon_cs_erase(r300->cmdbuf.cs);
 	r300->cmdbuf.flushing = 0;
@@ -208,8 +209,7 @@ void r300EmitState(r300ContextPtr r300)
 	if (RADEON_DEBUG & (DEBUG_STATE | DEBUG_PRIMS))
 		fprintf(stderr, "%s\n", __FUNCTION__);
 
-	if (r300->cmdbuf.cs->cdw && !r300->hw.is_dirty
-	    && !r300->hw.all_dirty)
+	if (r300->cmdbuf.cs->cdw && !r300->hw.is_dirty && !r300->hw.all_dirty)
 		return;
 
 	/* To avoid going across the entire set of states multiple times, just check
@@ -325,7 +325,7 @@ static void emit_cb_offset(r300ContextPtr r300, struct r300_state_atom * atom)
     if (r300->radeon.radeonScreen->driScreen->dri2.enabled) {
         rrb = fb->Attachment[BUFFER_BACK_LEFT].Renderbuffer;
     }
-	if (!rrb) {
+	if (!rrb || !rrb->bo) {
 		fprintf(stderr, "no rrb\n");
 		return;
 	}
diff --git a/src/mesa/drivers/dri/r300/r300_emit.c b/src/mesa/drivers/dri/r300/r300_emit.c
index d2628633d48..4405b7a3f50 100644
--- a/src/mesa/drivers/dri/r300/r300_emit.c
+++ b/src/mesa/drivers/dri/r300/r300_emit.c
@@ -169,6 +169,7 @@ static void r300EmitVec(GLcontext * ctx, struct r300_aos *aos,
 	uint32_t *out;
     uint32_t bo_size;
 
+    memset(aos, 0, sizeof(struct r300_aos));
 	if (stride == 0) {
         bo_size = size * 4;
 		count = 1;
@@ -428,7 +429,6 @@ int r300EmitArrays(GLcontext * ctx)
 		for (ci = 0; ci < vb->AttribPtr[tab[i]]->size; ci++) {
 			swizzle[i][ci] = ci;
 		}
-
 		r300EmitVec(ctx, &rmesa->state.aos[i],
 				vb->AttribPtr[tab[i]]->data,
 				vb->AttribPtr[tab[i]]->size,
@@ -486,8 +486,7 @@ void r300ReleaseArrays(GLcontext * ctx)
 	}
 	for (i = 0; i < rmesa->state.aos_count; i++) {
 		if (rmesa->state.aos[i].bo) {
-			radeon_bo_unref(rmesa->state.aos[i].bo);
-			rmesa->state.aos[i].bo = 0;
+			rmesa->state.aos[i].bo = radeon_bo_unref(rmesa->state.aos[i].bo);
 		}
 	}
 }
diff --git a/src/mesa/drivers/dri/r300/r300_texstate.c b/src/mesa/drivers/dri/r300/r300_texstate.c
index 30efc0b6dbc..4fea8228910 100644
--- a/src/mesa/drivers/dri/r300/r300_texstate.c
+++ b/src/mesa/drivers/dri/r300/r300_texstate.c
@@ -510,10 +510,6 @@ void r300SetTexBuffer(__DRIcontext *pDRICtx, GLint target, __DRIdrawable *dPriv)
     if (t->mt) {
         t->mt = NULL;
     }
-    if (rImage->bo) {
-        radeon_bo_unref(rImage->bo);
-        rImage->bo = NULL;
-    }
     if (rImage->mt) {
         r300_miptree_unreference(rImage->mt);
         rImage->mt = NULL;
diff --git a/src/mesa/drivers/dri/r300/radeon_context.c b/src/mesa/drivers/dri/r300/radeon_context.c
index 3a1ab8d96ed..2f4d06110f9 100644
--- a/src/mesa/drivers/dri/r300/radeon_context.c
+++ b/src/mesa/drivers/dri/r300/radeon_context.c
@@ -199,27 +199,33 @@ void radeonCleanupContext(radeonContextPtr radeon)
     rb = (void *)fb->Attachment[BUFFER_FRONT_LEFT].Renderbuffer;
     if (rb && rb->bo) {
         radeon_bo_unref(rb->bo);
+        rb->bo = NULL;
     }
     rb = (void *)fb->Attachment[BUFFER_BACK_LEFT].Renderbuffer;
     if (rb && rb->bo) {
         radeon_bo_unref(rb->bo);
+        rb->bo = NULL;
     }
     rb = (void *)fb->Attachment[BUFFER_DEPTH].Renderbuffer;
     if (rb && rb->bo) {
         radeon_bo_unref(rb->bo);
+        rb->bo = NULL;
     }
     fb = (void*)radeon->dri.readable->driverPrivate;
     rb = (void *)fb->Attachment[BUFFER_FRONT_LEFT].Renderbuffer;
     if (rb && rb->bo) {
         radeon_bo_unref(rb->bo);
+        rb->bo = NULL;
     }
     rb = (void *)fb->Attachment[BUFFER_BACK_LEFT].Renderbuffer;
     if (rb && rb->bo) {
         radeon_bo_unref(rb->bo);
+        rb->bo = NULL;
     }
     rb = (void *)fb->Attachment[BUFFER_DEPTH].Renderbuffer;
     if (rb && rb->bo) {
         radeon_bo_unref(rb->bo);
+        rb->bo = NULL;
     }
 
 	/* _mesa_destroy_context() might result in calls to functions that
diff --git a/src/mesa/drivers/dri/radeon/radeon_screen.c b/src/mesa/drivers/dri/radeon/radeon_screen.c
index 79cc4c8c8ef..9b5f2201b29 100644
--- a/src/mesa/drivers/dri/radeon/radeon_screen.c
+++ b/src/mesa/drivers/dri/radeon/radeon_screen.c
@@ -1179,6 +1179,7 @@ radeon_create_renderbuffer(GLenum format, __DRIdrawablePrivate *driDrawPriv)
 
     radeonSetSpanFunctions(ret);
 
+    ret->bo = NULL;
     return ret;
 }
 
@@ -1365,14 +1366,17 @@ radeonDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
     rb = (void *)fb->Attachment[BUFFER_FRONT_LEFT].Renderbuffer;
     if (rb && rb->bo) {
         radeon_bo_unref(rb->bo);
+        rb->bo = NULL;
     }
     rb = (void *)fb->Attachment[BUFFER_BACK_LEFT].Renderbuffer;
     if (rb && rb->bo) {
         radeon_bo_unref(rb->bo);
+        rb->bo = NULL;
     }
     rb = (void *)fb->Attachment[BUFFER_DEPTH].Renderbuffer;
     if (rb && rb->bo) {
         radeon_bo_unref(rb->bo);
+        rb->bo = NULL;
     }
    _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }