r300g: fix invalid dereference in winsys

radeon_bo_unref may destroy the buffer, so call it after p_atomic_dec, not before.

diff --git a/src/gallium/winsys/radeon/drm/radeon_drm_cs.c b/src/gallium/winsys/radeon/drm/radeon_drm_cs.c
index 8f6f4a1f35af074ad41f9e3301d50bdb0c110b25..a38b01048b2c124ea7436caec1c3d68bbc4877ca 100644 (file)
--- a/src/gallium/winsys/radeon/drm/radeon_drm_cs.c
+++ b/src/gallium/winsys/radeon/drm/radeon_drm_cs.c
@@ -110,8 +110,8 @@ static void radeon_cs_context_cleanup(struct radeon_cs_context *csc)
     unsigned i;
 
     for (i = 0; i < csc->crelocs; i++) {
-        radeon_bo_unref(csc->relocs_bo[i]);
         p_atomic_dec(&csc->relocs_bo[i]->num_cs_references);
+        radeon_bo_unref(csc->relocs_bo[i]);
         csc->relocs_bo[i] = NULL;
     }