2 files changed, 15 insertions, 5 deletions
diff --git a/src/mesa/drivers/common/meta.h b/src/mesa/drivers/common/meta.h
index 268824cfcb0..856dcdbad7c 100644
--- a/src/mesa/drivers/common/meta.h
+++ b/src/mesa/drivers/common/meta.h
@@ -310,7 +310,8 @@ struct fb_tex_blit_state
 {
    GLint baseLevelSave, maxLevelSave;
    struct gl_sampler_object *samp_obj;
-   GLuint samplerSave, stencilSamplingSave;
+   struct gl_sampler_object *samp_obj_save;
+   GLuint stencilSamplingSave;
    GLuint tempTex;
 };
 
diff --git a/src/mesa/drivers/common/meta_blit.c b/src/mesa/drivers/common/meta_blit.c
index 6c03f5dd778..07bd7e5016a 100644
--- a/src/mesa/drivers/common/meta_blit.c
+++ b/src/mesa/drivers/common/meta_blit.c
@@ -810,9 +810,17 @@ void
 _mesa_meta_fb_tex_blit_begin(const struct gl_context *ctx,
                              struct fb_tex_blit_state *blit)
 {
-   blit->samplerSave =
-      ctx->Texture.Unit[ctx->Texture.CurrentUnit].Sampler ?
-      ctx->Texture.Unit[ctx->Texture.CurrentUnit].Sampler->Name : 0;
+   /* None of the existing callers preinitialize fb_tex_blit_state to zeros,
+    * and both use stack variables.  If samp_obj_save is not NULL,
+    * _mesa_reference_sampler_object will try to dereference it.  Leaving
+    * random garbage in samp_obj_save can only lead to crashes.
+    *
+    * Since the state isn't persistent across calls, we won't catch ref
+    * counting problems.
+    */
+   blit->samp_obj_save = NULL;
+   _mesa_reference_sampler_object(ctx, &blit->samp_obj_save,
+                                  ctx->Texture.Unit[ctx->Texture.CurrentUnit].Sampler);
    blit->tempTex = 0;
 }
 
@@ -838,7 +846,8 @@ _mesa_meta_fb_tex_blit_end(struct gl_context *ctx, GLenum target,
       }
    }
 
-   _mesa_BindSampler(ctx->Texture.CurrentUnit, blit->samplerSave);
+   _mesa_bind_sampler(ctx, ctx->Texture.CurrentUnit, blit->samp_obj_save);
+   _mesa_reference_sampler_object(ctx, &blit->samp_obj_save, NULL);
    _mesa_DeleteSamplers(1, &blit->samp_obj->Name);
    blit->samp_obj = NULL;