1 files changed, 7 insertions, 1 deletions
diff --git a/src/mesa/main/renderbuffer.c b/src/mesa/main/renderbuffer.c
index 1145e91e3b4..6f1d7c39605 100644
--- a/src/mesa/main/renderbuffer.c
+++ b/src/mesa/main/renderbuffer.c
@@ -1471,6 +1471,7 @@ _mesa_init_renderbuffer(struct gl_renderbuffer *rb, GLuint name)
 {
    _glthread_INIT_MUTEX(rb->Mutex);
 
+   rb->Magic = RB_MAGIC;
    rb->ClassID = 0;
    rb->Name = name;
    rb->RefCount = 0;
@@ -2149,21 +2150,26 @@ _mesa_reference_renderbuffer(struct gl_renderbuffer **ptr,
       GLboolean deleteFlag = GL_FALSE;
       struct gl_renderbuffer *oldRb = *ptr;
 
+      assert(oldRb->Magic == RB_MAGIC);
       _glthread_LOCK_MUTEX(oldRb->Mutex);
+      assert(oldRb->Magic == RB_MAGIC);
       ASSERT(oldRb->RefCount > 0);
       oldRb->RefCount--;
       /*printf("RB DECR %p (%d) to %d\n", (void*) oldRb, oldRb->Name, oldRb->RefCount);*/
       deleteFlag = (oldRb->RefCount == 0);
       _glthread_UNLOCK_MUTEX(oldRb->Mutex);
 
-      if (deleteFlag)
+      if (deleteFlag) {
+         oldRb->Magic = 0; /* now invalid memory! */
          oldRb->Delete(oldRb);
+      }
 
       *ptr = NULL;
    }
    assert(!*ptr);
 
    if (rb) {
+      assert(rb->Magic == RB_MAGIC);
       /* reference new renderbuffer */
       _glthread_LOCK_MUTEX(rb->Mutex);
       rb->RefCount++;