sna/gen4+: Clear redirect bo before falling back to BLT paths

Just in case we later try to take action on the already freed
redirection.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

4 files changed, 42 insertions, 9 deletions

diff --git a/src/sna/gen4_render.c b/src/sna/gen4_render.c
index b1224087..c6a1e6d2 100644
--- a/src/sna/gen4_render.c
+++ b/src/sna/gen4_render.c
@@ -2411,8 +2411,13 @@ fallback_blt:
 		kgem_submit(&sna->kgem);
 		if (!kgem_check_bo(&sna->kgem, dst_bo, src_bo, NULL)) {
 			kgem_bo_destroy(&sna->kgem, tmp.src.bo);
-			if (tmp.redirect.real_bo)
+			tmp.src.bo = NULL;
+
+			if (tmp.redirect.real_bo) {
 				kgem_bo_destroy(&sna->kgem, tmp.dst.bo);
+				tmp.redirect.real_bo = NULL;
+			}
+
 			goto fallback_blt;
 		}
 	}
@@ -2441,9 +2446,12 @@ fallback_blt:
 	return true;
 
 fallback_tiled_dst:
-	if (tmp.redirect.real_bo)
+	if (tmp.redirect.real_bo) {
 		kgem_bo_destroy(&sna->kgem, tmp.dst.bo);
+		tmp.redirect.real_bo = NULL;
+	}
 fallback_tiled:
+	assert(tmp.src.bo == NULL);
 	if (sna_blt_compare_depth(&src->drawable, &dst->drawable) &&
 	    sna_blt_copy_boxes(sna, alu,
 			       src_bo, src_dx, src_dy,
diff --git a/src/sna/gen5_render.c b/src/sna/gen5_render.c
index 59ce2be6..1e904138 100644
--- a/src/sna/gen5_render.c
+++ b/src/sna/gen5_render.c
@@ -2371,8 +2371,13 @@ fallback_blt:
 		if (!kgem_check_bo(&sna->kgem, dst_bo, src_bo, NULL)) {
 			DBG(("%s: aperture check failed\n", __FUNCTION__));
 			kgem_bo_destroy(&sna->kgem, tmp.src.bo);
-			if (tmp.redirect.real_bo)
+			tmp.src.bo = NULL;
+
+			if (tmp.redirect.real_bo) {
 				kgem_bo_destroy(&sna->kgem, tmp.dst.bo);
+				tmp.redirect.real_bo = NULL;
+			}
+
 			goto fallback_blt;
 		}
 	}
@@ -2421,9 +2426,12 @@ fallback_blt:
 	return true;
 
 fallback_tiled_dst:
-	if (tmp.redirect.real_bo)
+	if (tmp.redirect.real_bo) {
 		kgem_bo_destroy(&sna->kgem, tmp.dst.bo);
+		tmp.redirect.real_bo = NULL;
+	}
 fallback_tiled:
+	assert(tmp.src.bo == NULL);
 	if (sna_blt_compare_depth(&src->drawable, &dst->drawable) &&
 	    sna_blt_copy_boxes(sna, alu,
 			       src_bo, src_dx, src_dy,
diff --git a/src/sna/gen6_render.c b/src/sna/gen6_render.c
index a2b4082c..f03b893e 100644
--- a/src/sna/gen6_render.c
+++ b/src/sna/gen6_render.c
@@ -2785,8 +2785,11 @@ fallback_blt:
 			     __FUNCTION__));
 			if (tmp.src.bo != src_bo)
 				kgem_bo_destroy(&sna->kgem, tmp.src.bo);
-			if (tmp.redirect.real_bo)
+			tmp.src.bo = NULL;
+			if (tmp.redirect.real_bo) {
 				kgem_bo_destroy(&sna->kgem, tmp.dst.bo);
+				tmp.redirect.real_bo = NULL;
+			}
 			goto fallback_blt;
 		}
 		_kgem_set_mode(&sna->kgem, KGEM_RENDER);
@@ -2831,9 +2834,12 @@ fallback_blt:
 	return true;
 
 fallback_tiled_dst:
-	if (tmp.redirect.real_bo)
+	if (tmp.redirect.real_bo) {
 		kgem_bo_destroy(&sna->kgem, tmp.dst.bo);
+		tmp.redirect.real_bo = NULL;
+	}
 fallback_tiled:
+	assert(tmp.src.bo == NULL);
 	if (sna_blt_compare_depth(&src->drawable, &dst->drawable) &&
 	    sna_blt_copy_boxes(sna, alu,
 			       src_bo, src_dx, src_dy,
diff --git a/src/sna/gen7_render.c b/src/sna/gen7_render.c
index 9a7be4ca..bd37ced3 100644
--- a/src/sna/gen7_render.c
+++ b/src/sna/gen7_render.c
@@ -3040,8 +3040,11 @@ fallback_blt:
 		if (!kgem_check_bo(&sna->kgem, tmp.dst.bo, tmp.src.bo, NULL)) {
 			if (tmp.src.bo != src_bo)
 				kgem_bo_destroy(&sna->kgem, tmp.src.bo);
-			if (tmp.redirect.real_bo)
+			tmp.src.bo = NULL;
+			if (tmp.redirect.real_bo) {
 				kgem_bo_destroy(&sna->kgem, tmp.dst.bo);
+				tmp.redirect.real_bo = NULL;
+			}
 			goto fallback_blt;
 		}
 		_kgem_set_mode(&sna->kgem, KGEM_RENDER);
@@ -3086,10 +3089,13 @@ fallback_blt:
 	return true;
 
 fallback_tiled_dst:
-	if (tmp.redirect.real_bo)
+	if (tmp.redirect.real_bo) {
 		kgem_bo_destroy(&sna->kgem, tmp.dst.bo);
+		tmp.redirect.real_bo = NULL;
+	}
 fallback_tiled:
 	DBG(("%s: fallback tiled\n", __FUNCTION__));
+	assert(tmp.src.bo == NULL);
 	if (sna_blt_compare_depth(&src->drawable, &dst->drawable) &&
 	    sna_blt_copy_boxes(sna, alu,
 			       src_bo, src_dx, src_dy,
@@ -3351,8 +3357,13 @@ gen7_render_fill_boxes(struct sna *sna,
 		kgem_submit(&sna->kgem);
 		if (!kgem_check_bo(&sna->kgem, dst_bo, NULL)) {
 			kgem_bo_destroy(&sna->kgem, tmp.src.bo);
-			if (tmp.redirect.real_bo)
+			tmp.src.bo = NULL;
+
+			if (tmp.redirect.real_bo) {
 				kgem_bo_destroy(&sna->kgem, tmp.dst.bo);
+				tmp.redirect.real_bo = NULL;
+			}
+
 			return false;
 		}
 		_kgem_set_mode(&sna->kgem, KGEM_RENDER);