Mesa (18.0): gallium/util: Fix incorrect refcounting of separate stencil.

[Juan Antonio Suárez Romero]

Module: Mesa
Branch: 18.0
Commit: c0aeac153685c784dfc37674957347a2b6a7c7ab
URL:    http://cgit.freedesktop.org/mesa/mesa/commit/?id=c0aeac153685c784dfc37674957347a2b6a7c7ab

Author: Eric Anholt <eric at anholt.net>
Date:   Wed Apr 25 09:47:40 2018 -0700

gallium/util: Fix incorrect refcounting of separate stencil.

The driver may have a reference on the separate stencil buffer for some
reason (like an unflushed job using it), so we can't directly free the
resource and should instead just decrement the refcount that we own.
Fixes double-free in KHR-GLES3.packed_depth_stencil.blit.depth32f_stencil8
on vc5.

Fixes: e94eb5e6000e ("gallium/util: add u_transfer_helper")
Reviewed-by: Rob Clark <robdclark at gmail.com>
(cherry picked from commit 069c409f434ab215940aad2092d5d236b410a7b9)

---

 src/gallium/auxiliary/util/u_transfer_helper.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/gallium/auxiliary/util/u_transfer_helper.c b/src/gallium/auxiliary/util/u_transfer_helper.c
index dd31049920..3b085fd99f 100644
--- a/src/gallium/auxiliary/util/u_transfer_helper.c
+++ b/src/gallium/auxiliary/util/u_transfer_helper.c
@@ -138,8 +138,7 @@ u_transfer_helper_resource_destroy(struct pipe_screen *pscreen,
    if (helper->vtbl->get_stencil) {
       struct pipe_resource *stencil = helper->vtbl->get_stencil(prsc);
 
-      if (stencil)
-         helper->vtbl->resource_destroy(pscreen, stencil);
+      pipe_resource_reference(&stencil, NULL);
    }
 
    helper->vtbl->resource_destroy(pscreen, prsc);