Fix/improve framebuffer object reference counting.

Use _mesa_reference_framebuffer() and _mesa_unreference_framebuffer() functions
to be sure reference counting is done correctly.  Additional assertions are
done too.  Note _mesa_dereference_framebuffer() renamed to "unreference" as
that's more accurate.

30 files changed, 101 insertions, 97 deletions

diff --git a/src/mesa/drivers/allegro/amesa.c b/src/mesa/drivers/allegro/amesa.c
index 594668affd..518211ccf4 100644
--- a/src/mesa/drivers/allegro/amesa.c
+++ b/src/mesa/drivers/allegro/amesa.c
@@ -338,7 +338,7 @@ void AMesaDestroyBuffer(AMesaBuffer buffer)
 {

    if (buffer->Screen)     destroy_bitmap(buffer->Screen);

    if (buffer->Background) destroy_bitmap(buffer->Background);

-   _mesa_destroy_framebuffer(buffer->GLBuffer);

+   _mesa_unreference_framebuffer(&buffer->GLBuffer);

    free(buffer);

 }

 

diff --git a/src/mesa/drivers/dri/fb/fb_dri.c b/src/mesa/drivers/dri/fb/fb_dri.c
index 08b52b4d8f..a6d7590eff 100644
--- a/src/mesa/drivers/dri/fb/fb_dri.c
+++ b/src/mesa/drivers/dri/fb/fb_dri.c
@@ -480,11 +480,7 @@ fbCreateBuffer( __DRIscreenPrivate *driScrnPriv,
 static void
 fbDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-   struct gl_framebuffer *mesa_framebuffer = (struct gl_framebuffer *)driDrawPriv->driverPrivate;
-   
-   _mesa_free(mesa_framebuffer->Attachment[BUFFER_BACK_LEFT].Renderbuffer->Data);
-   _mesa_destroy_framebuffer(mesa_framebuffer);
-   driDrawPriv->driverPrivate = NULL;
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 
diff --git a/src/mesa/drivers/dri/ffb/ffb_xmesa.c b/src/mesa/drivers/dri/ffb/ffb_xmesa.c
index 215aaf8ffb..4c5323d230 100644
--- a/src/mesa/drivers/dri/ffb/ffb_xmesa.c
+++ b/src/mesa/drivers/dri/ffb/ffb_xmesa.c
@@ -392,7 +392,7 @@ ffbCreateBuffer(__DRIscreenPrivate *driScrnPriv,
 static void
 ffbDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-   _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 
diff --git a/src/mesa/drivers/dri/gamma/gamma_xmesa.c b/src/mesa/drivers/dri/gamma/gamma_xmesa.c
index e8922b1503..f41682cea7 100644
--- a/src/mesa/drivers/dri/gamma/gamma_xmesa.c
+++ b/src/mesa/drivers/dri/gamma/gamma_xmesa.c
@@ -97,7 +97,7 @@ gammaCreateBuffer( __DRIscreenPrivate *driScrnPriv,
 static void
 gammaDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-   _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 static void
diff --git a/src/mesa/drivers/dri/i810/i810screen.c b/src/mesa/drivers/dri/i810/i810screen.c
index ebe2615fe8..f64c10a9ae 100644
--- a/src/mesa/drivers/dri/i810/i810screen.c
+++ b/src/mesa/drivers/dri/i810/i810screen.c
@@ -398,8 +398,7 @@ i810CreateBuffer( __DRIscreenPrivate *driScrnPriv,
 static void
 i810DestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-    /* _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate)); */
-    _mesa_dereference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
+    _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 
diff --git a/src/mesa/drivers/dri/i915/intel_screen.c b/src/mesa/drivers/dri/i915/intel_screen.c
index 942e1e9c22..67e176a1c6 100644
--- a/src/mesa/drivers/dri/i915/intel_screen.c
+++ b/src/mesa/drivers/dri/i915/intel_screen.c
@@ -449,8 +449,7 @@ static GLboolean intelCreateBuffer( __DRIscreenPrivate *driScrnPriv,
 
 static void intelDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-    /* _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate)); */
-    _mesa_dereference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 
diff --git a/src/mesa/drivers/dri/i915tex/intel_screen.c b/src/mesa/drivers/dri/i915tex/intel_screen.c
index bc538902b4..ac83254593 100644
--- a/src/mesa/drivers/dri/i915tex/intel_screen.c
+++ b/src/mesa/drivers/dri/i915tex/intel_screen.c
@@ -609,8 +609,7 @@ intelCreateBuffer(__DRIscreenPrivate * driScrnPriv,
 static void
 intelDestroyBuffer(__DRIdrawablePrivate * driDrawPriv)
 {
-    /* _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate)); */
-    _mesa_dereference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 
diff --git a/src/mesa/drivers/dri/i965/intel_screen.c b/src/mesa/drivers/dri/i965/intel_screen.c
index 06e5d0c5bd..5dac50df32 100644
--- a/src/mesa/drivers/dri/i965/intel_screen.c
+++ b/src/mesa/drivers/dri/i965/intel_screen.c
@@ -457,8 +457,7 @@ static GLboolean intelCreateBuffer( __DRIscreenPrivate *driScrnPriv,
 
 static void intelDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-    /* _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate)); */
-    _mesa_dereference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 
diff --git a/src/mesa/drivers/dri/mach64/mach64_screen.c b/src/mesa/drivers/dri/mach64/mach64_screen.c
index 1014b8acd5..4e9e216e7d 100644
--- a/src/mesa/drivers/dri/mach64/mach64_screen.c
+++ b/src/mesa/drivers/dri/mach64/mach64_screen.c
@@ -435,7 +435,7 @@ mach64CreateBuffer( __DRIscreenPrivate *driScrnPriv,
 static void
 mach64DestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-   _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 
diff --git a/src/mesa/drivers/dri/mga/mga_xmesa.c b/src/mesa/drivers/dri/mga/mga_xmesa.c
index f024f73eb6..67a6f8bdf0 100644
--- a/src/mesa/drivers/dri/mga/mga_xmesa.c
+++ b/src/mesa/drivers/dri/mga/mga_xmesa.c
@@ -831,7 +831,7 @@ mgaCreateBuffer( __DRIscreenPrivate *driScrnPriv,
 static void
 mgaDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-   _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 static void
diff --git a/src/mesa/drivers/dri/nouveau/nouveau_screen.c b/src/mesa/drivers/dri/nouveau/nouveau_screen.c
index 24e77750f9..e00080fce1 100644
--- a/src/mesa/drivers/dri/nouveau/nouveau_screen.c
+++ b/src/mesa/drivers/dri/nouveau/nouveau_screen.c
@@ -202,7 +202,7 @@ nouveauCreateBuffer(__DRIscreenPrivate *driScrnPriv,
 static void
 nouveauDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-	_mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate));
+	_mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 static int
diff --git a/src/mesa/drivers/dri/r128/r128_screen.c b/src/mesa/drivers/dri/r128/r128_screen.c
index 4f1b20aadd..880dee85c2 100644
--- a/src/mesa/drivers/dri/r128/r128_screen.c
+++ b/src/mesa/drivers/dri/r128/r128_screen.c
@@ -357,7 +357,7 @@ r128CreateBuffer( __DRIscreenPrivate *driScrnPriv,
 static void
 r128DestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-   _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 
diff --git a/src/mesa/drivers/dri/radeon/radeon_screen.c b/src/mesa/drivers/dri/radeon/radeon_screen.c
index fc5aa11462..abb14faaa1 100644
--- a/src/mesa/drivers/dri/radeon/radeon_screen.c
+++ b/src/mesa/drivers/dri/radeon/radeon_screen.c
@@ -901,7 +901,7 @@ radeonCreateBuffer( __DRIscreenPrivate *driScrnPriv,
 static void
 radeonDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-   _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 #if RADEON_COMMON && defined(RADEON_COMMON_FOR_R300)
diff --git a/src/mesa/drivers/dri/s3v/s3v_xmesa.c b/src/mesa/drivers/dri/s3v/s3v_xmesa.c
index c451f7452b..c66fd6dac3 100644
--- a/src/mesa/drivers/dri/s3v/s3v_xmesa.c
+++ b/src/mesa/drivers/dri/s3v/s3v_xmesa.c
@@ -131,7 +131,7 @@ s3vCreateBuffer( __DRIscreenPrivate *driScrnPriv,
 static void
 s3vDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-   _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 static void
diff --git a/src/mesa/drivers/dri/savage/savage_xmesa.c b/src/mesa/drivers/dri/savage/savage_xmesa.c
index ad79b9235c..f859217069 100644
--- a/src/mesa/drivers/dri/savage/savage_xmesa.c
+++ b/src/mesa/drivers/dri/savage/savage_xmesa.c
@@ -710,7 +710,7 @@ savageCreateBuffer( __DRIscreenPrivate *driScrnPriv,
 static void
 savageDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-   _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 #if 0
diff --git a/src/mesa/drivers/dri/sis/sis_screen.c b/src/mesa/drivers/dri/sis/sis_screen.c
index 8f52cfe098..89d734ba78 100644
--- a/src/mesa/drivers/dri/sis/sis_screen.c
+++ b/src/mesa/drivers/dri/sis/sis_screen.c
@@ -233,7 +233,7 @@ sisCreateBuffer( __DRIscreenPrivate *driScrnPriv,
 static void
 sisDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-   _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 static void sisCopyBuffer( __DRIdrawablePrivate *dPriv )
diff --git a/src/mesa/drivers/dri/tdfx/tdfx_screen.c b/src/mesa/drivers/dri/tdfx/tdfx_screen.c
index 646f5126eb..1f9ff4e30c 100644
--- a/src/mesa/drivers/dri/tdfx/tdfx_screen.c
+++ b/src/mesa/drivers/dri/tdfx/tdfx_screen.c
@@ -233,7 +233,7 @@ tdfxCreateBuffer( __DRIscreenPrivate *driScrnPriv,
 static void
 tdfxDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-   _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 
diff --git a/src/mesa/drivers/dri/trident/trident_context.c b/src/mesa/drivers/dri/trident/trident_context.c
index dbbd1ac0c6..8dc7f0dc78 100644
--- a/src/mesa/drivers/dri/trident/trident_context.c
+++ b/src/mesa/drivers/dri/trident/trident_context.c
@@ -279,7 +279,7 @@ tridentCreateBuffer( __DRIscreenPrivate *driScrnPriv,
 static void
 tridentDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-   _mesa_destroy_framebuffer((GLframebuffer *) (driDrawPriv->driverPrivate));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 static void
diff --git a/src/mesa/drivers/dri/unichrome/via_screen.c b/src/mesa/drivers/dri/unichrome/via_screen.c
index 28e1f9451e..90f76be44d 100644
--- a/src/mesa/drivers/dri/unichrome/via_screen.c
+++ b/src/mesa/drivers/dri/unichrome/via_screen.c
@@ -320,7 +320,7 @@ viaCreateBuffer(__DRIscreenPrivate *driScrnPriv,
 static void
 viaDestroyBuffer(__DRIdrawablePrivate *driDrawPriv)
 {
-    _mesa_destroy_framebuffer((GLframebuffer *)(driDrawPriv->driverPrivate));
+   _mesa_unreference_framebuffer((GLframebuffer **)(&(driDrawPriv->driverPrivate)));
 }
 
 
diff --git a/src/mesa/drivers/glide/fxapi.c b/src/mesa/drivers/glide/fxapi.c
index e535e739b3..00b9d29fac 100644
--- a/src/mesa/drivers/glide/fxapi.c
+++ b/src/mesa/drivers/glide/fxapi.c
@@ -728,7 +728,7 @@ errorhandler:
        FREE(fxMesa->fogTable);
     }
     if (fxMesa->glBuffer) {
-       _mesa_destroy_framebuffer(fxMesa->glBuffer);
+       _mesa_unreference_framebuffer(&fxMesa->glBuffer);
     }
     if (fxMesa->glVis) {
        _mesa_destroy_visual(fxMesa->glVis);
@@ -828,7 +828,7 @@ fxMesaDestroyContext(fxMesaContext fxMesa)
    fxDDDestroyFxMesaContext(fxMesa); /* must be before _mesa_destroy_context */
    _mesa_destroy_visual(fxMesa->glVis);
    _mesa_destroy_context(fxMesa->glCtx);
-   _mesa_destroy_framebuffer(fxMesa->glBuffer);
+   _mesa_unreference_framebuffer(&fxMesa->glBuffer);
    fxTMClose(fxMesa); /* must be after _mesa_destroy_context */
 
    FREE(fxMesa);
diff --git a/src/mesa/drivers/osmesa/osmesa.c b/src/mesa/drivers/osmesa/osmesa.c
index c4fc8821e5..96b9b5c174 100644
--- a/src/mesa/drivers/osmesa/osmesa.c
+++ b/src/mesa/drivers/osmesa/osmesa.c
@@ -1303,7 +1303,8 @@ OSMesaDestroyContext( OSMesaContext osmesa )
       _swrast_DestroyContext( &osmesa->mesa );
 
       _mesa_destroy_visual( osmesa->gl_visual );
-      _mesa_destroy_framebuffer( osmesa->gl_buffer );
+      _mesa_unreference_framebuffer( &osmesa->gl_buffer );
+
       _mesa_free_context_data( &osmesa->mesa );
       _mesa_free( osmesa );
    }
diff --git a/src/mesa/drivers/svga/svgamesa.c b/src/mesa/drivers/svga/svgamesa.c
index 0dd9a144fe..d138587569 100644
--- a/src/mesa/drivers/svga/svgamesa.c
+++ b/src/mesa/drivers/svga/svgamesa.c
@@ -433,7 +433,6 @@ void SVGAMesaDestroyContext( SVGAMesaContext ctx )
    if (ctx) {
       _mesa_destroy_visual( ctx->gl_vis );
       _mesa_destroy_context( ctx->gl_ctx );
-      _mesa_destroy_framebuffer( ctx->gl_buffer );
       free( ctx );
       if (ctx==SVGAMesa) {
          SVGAMesa = NULL;
diff --git a/src/mesa/drivers/x11/xm_api.c b/src/mesa/drivers/x11/xm_api.c
index 2cd7d8a6ca..a42de72827 100644
--- a/src/mesa/drivers/x11/xm_api.c
+++ b/src/mesa/drivers/x11/xm_api.c
@@ -485,8 +485,8 @@ xmesa_free_buffer(XMesaBuffer buffer)
 
          /* mark as delete pending */
          fb->DeletePending = GL_TRUE;
-         /* Dereference.  If count = zero we'll really delete the buffer */
-         _mesa_dereference_framebuffer(&fb);
+         /* Unreference.  If count = zero we'll really delete the buffer */
+         _mesa_unreference_framebuffer(&fb);
 
          return;
       }
diff --git a/src/mesa/main/context.c b/src/mesa/main/context.c
index 1245c10cc2..135c814c0a 100644
--- a/src/mesa/main/context.c
+++ b/src/mesa/main/context.c
@@ -1408,6 +1408,13 @@ _mesa_free_context_data( GLcontext *ctx )
    if (ctx == _mesa_get_current_context()) {
       _mesa_make_current(NULL, NULL, NULL);
    }
+   else {
+      /* unreference WinSysDraw/Read buffers */
+      _mesa_unreference_framebuffer(&ctx->WinSysDrawBuffer);
+      _mesa_unreference_framebuffer(&ctx->WinSysReadBuffer);
+      _mesa_unreference_framebuffer(&ctx->DrawBuffer);
+      _mesa_unreference_framebuffer(&ctx->ReadBuffer);
+   }
 
    _mesa_free_lighting_data( ctx );
    _mesa_free_eval_data( ctx );
@@ -1694,12 +1701,8 @@ _mesa_make_current( GLcontext *newCtx, GLframebuffer *drawBuffer,
    ASSERT(_mesa_get_current_context() == newCtx);
 
    if (oldCtx) {
-      if (oldCtx->WinSysDrawBuffer) {
-         _mesa_dereference_framebuffer(&oldCtx->WinSysDrawBuffer);
-      }
-      if (oldCtx->WinSysReadBuffer) {
-         _mesa_dereference_framebuffer(&oldCtx->WinSysReadBuffer);
-      }
+      _mesa_unreference_framebuffer(&oldCtx->WinSysDrawBuffer);
+      _mesa_unreference_framebuffer(&oldCtx->WinSysReadBuffer);
    }
          
    if (!newCtx) {
@@ -1713,20 +1716,18 @@ _mesa_make_current( GLcontext *newCtx, GLframebuffer *drawBuffer,
 
          ASSERT(drawBuffer->Name == 0);
          ASSERT(readBuffer->Name == 0);
-         newCtx->WinSysDrawBuffer = drawBuffer;
-         newCtx->WinSysReadBuffer = readBuffer;
-         drawBuffer->RefCount++;
-         readBuffer->RefCount++;
+         _mesa_reference_framebuffer(&newCtx->WinSysDrawBuffer, drawBuffer);
+         _mesa_reference_framebuffer(&newCtx->WinSysReadBuffer, readBuffer);
 
          /*
           * Only set the context's Draw/ReadBuffer fields if they're NULL
           * or not bound to a user-created FBO.
           */
          if (!newCtx->DrawBuffer || newCtx->DrawBuffer->Name == 0) {
-            newCtx->DrawBuffer = drawBuffer;
+            _mesa_reference_framebuffer(&newCtx->DrawBuffer, drawBuffer);
          }
          if (!newCtx->ReadBuffer || newCtx->ReadBuffer->Name == 0) {
-            newCtx->ReadBuffer = readBuffer;
+            _mesa_reference_framebuffer(&newCtx->ReadBuffer, readBuffer);
          }
 
 	 newCtx->NewState |= _NEW_BUFFERS;
diff --git a/src/mesa/main/fbobject.c b/src/mesa/main/fbobject.c
index a99ff9dc97..6608eefc6c 100644
--- a/src/mesa/main/fbobject.c
+++ b/src/mesa/main/fbobject.c
@@ -602,7 +602,7 @@ _mesa_BindRenderbufferEXT(GLenum target, GLuint renderbuffer)
 
    oldRb = ctx->CurrentRenderbuffer;
    if (oldRb) {
-      _mesa_dereference_renderbuffer(&oldRb);
+      _mesa_unreference_renderbuffer(&oldRb);
    }
 
    ASSERT(newRb != &DummyRenderbuffer);
@@ -639,7 +639,7 @@ _mesa_DeleteRenderbuffersEXT(GLsizei n, const GLuint *renderbuffers)
                /* But the object will not be freed until it's no longer
                 * bound in any context.
                 */
-               _mesa_dereference_renderbuffer(&rb);
+               _mesa_unreference_renderbuffer(&rb);
 	    }
 	 }
       }
@@ -998,12 +998,6 @@ _mesa_BindFramebufferEXT(GLenum target, GLuint framebuffer)
 	 }
          _mesa_HashInsert(ctx->Shared->FrameBuffers, framebuffer, newFb);
       }
-      _glthread_LOCK_MUTEX(newFb->Mutex);
-      if (bindReadBuf)
-         newFb->RefCount++;
-      if (bindDrawBuf)
-         newFb->RefCount++;
-      _glthread_UNLOCK_MUTEX(newFb->Mutex);
    }
    else {
       /* Binding the window system framebuffer (which was originally set
@@ -1020,22 +1014,16 @@ _mesa_BindFramebufferEXT(GLenum target, GLuint framebuffer)
     */
 
    if (bindReadBuf) {
-      struct gl_framebuffer *oldFb = ctx->ReadBuffer;
-      if (oldFb && oldFb->Name != 0) {
-         _mesa_dereference_framebuffer(&oldFb);
-      }
-      ctx->ReadBuffer = newFb;
+      _mesa_unreference_framebuffer(&ctx->ReadBuffer);
+      _mesa_reference_framebuffer(&ctx->ReadBuffer, newFb);
    }
 
    if (bindDrawBuf) {
-      struct gl_framebuffer *oldFb = ctx->DrawBuffer;
-      if (oldFb && oldFb->Name != 0) {
-         /* check if old FB had any texture attachments */
-         check_end_texture_render(ctx, oldFb);
-         /* check if time to delete this framebuffer */
-         _mesa_dereference_framebuffer(&oldFb);
-      }
-      ctx->DrawBuffer = newFb;
+      /* check if old FB had any texture attachments */
+      check_end_texture_render(ctx, ctx->DrawBuffer);
+      /* check if time to delete this framebuffer */
+      _mesa_unreference_framebuffer(&ctx->DrawBuffer);
+      _mesa_reference_framebuffer(&ctx->DrawBuffer, newFb);
       if (newFb->Name != 0) {
          /* check if newly bound framebuffer has any texture attachments */
          check_begin_texture_render(ctx, newFb);
@@ -1083,7 +1071,7 @@ _mesa_DeleteFramebuffersEXT(GLsizei n, const GLuint *framebuffers)
                /* But the object will not be freed until it's no longer
                 * bound in any context.
                 */
-               _mesa_dereference_framebuffer(&fb);
+               _mesa_unreference_framebuffer(&fb);
 	    }
 	 }
       }
diff --git a/src/mesa/main/framebuffer.c b/src/mesa/main/framebuffer.c
index dabc96d91d..c97d2f0077 100644
--- a/src/mesa/main/framebuffer.c
+++ b/src/mesa/main/framebuffer.c
@@ -78,7 +78,7 @@ set_depth_renderbuffer(struct gl_framebuffer *fb,
                        struct gl_renderbuffer *rb)
 {
    if (fb->_DepthBuffer) {
-      _mesa_dereference_renderbuffer(&fb->_DepthBuffer);
+      _mesa_unreference_renderbuffer(&fb->_DepthBuffer);
    }
    fb->_DepthBuffer = rb;
    if (rb) {
@@ -96,7 +96,7 @@ set_stencil_renderbuffer(struct gl_framebuffer *fb,
                          struct gl_renderbuffer *rb)
 {
    if (fb->_StencilBuffer) {
-      _mesa_dereference_renderbuffer(&fb->_StencilBuffer);
+      _mesa_unreference_renderbuffer(&fb->_StencilBuffer);
    }
    fb->_StencilBuffer = rb;
    if (rb) {
@@ -223,7 +223,7 @@ _mesa_free_framebuffer_data(struct gl_framebuffer *fb)
    for (i = 0; i < BUFFER_COUNT; i++) {
       struct gl_renderbuffer_attachment *att = &fb->Attachment[i];
       if (att->Renderbuffer) {
-         _mesa_dereference_renderbuffer(&att->Renderbuffer);
+         _mesa_unreference_renderbuffer(&att->Renderbuffer);
       }
       if (att->Texture) {
          /* render to texture */
@@ -236,7 +236,6 @@ _mesa_free_framebuffer_data(struct gl_framebuffer *fb)
          }
       }
       att->Type = GL_NONE;
-      att->Renderbuffer = NULL;
       att->Texture = NULL;
    }
 
@@ -247,25 +246,44 @@ _mesa_free_framebuffer_data(struct gl_framebuffer *fb)
 
 
 /**
- * Decrement the reference count on a framebuffer and delete it when
+ * Set *ptr to point to fb, with refcounting and locking.
+ */
+void
+_mesa_reference_framebuffer(struct gl_framebuffer **ptr,
+                            struct gl_framebuffer *fb)
+{
+   assert(ptr);
+   assert(!*ptr);
+   assert(fb);
+   _glthread_LOCK_MUTEX(fb->Mutex);
+   fb->RefCount++;
+   _glthread_UNLOCK_MUTEX(fb->Mutex);
+   *ptr = fb;
+}
+
+
+/**
+ * Undo/remove a reference to a framebuffer object.
+ * Decrement the framebuffer object's reference count and delete it when
  * the refcount hits zero.
- * Note: we pass the address of a pointer and set it to NULL if we delete it.
+ * Note: we pass the address of a pointer and set it to NULL.
  */
 void
-_mesa_dereference_framebuffer(struct gl_framebuffer **fb)
+_mesa_unreference_framebuffer(struct gl_framebuffer **fb)
 {
-   GLboolean deleteFlag = GL_FALSE;
+   assert(fb);
+   if (*fb) {
+      GLboolean deleteFlag = GL_FALSE;
 
-   _glthread_LOCK_MUTEX((*fb)->Mutex);
-   {
+      _glthread_LOCK_MUTEX((*fb)->Mutex);
       ASSERT((*fb)->RefCount > 0);
       (*fb)->RefCount--;
       deleteFlag = ((*fb)->RefCount == 0);
-   }
-   _glthread_UNLOCK_MUTEX((*fb)->Mutex);
+      _glthread_UNLOCK_MUTEX((*fb)->Mutex);
+      
+      if (deleteFlag)
+         (*fb)->Delete(*fb);
 
-   if (deleteFlag) {
-      (*fb)->Delete(*fb);
       *fb = NULL;
    }
 }
diff --git a/src/mesa/main/framebuffer.h b/src/mesa/main/framebuffer.h
index 7f3254fe8e..4d76f3a90f 100644
--- a/src/mesa/main/framebuffer.h
+++ b/src/mesa/main/framebuffer.h
@@ -43,7 +43,11 @@ extern void
 _mesa_free_framebuffer_data(struct gl_framebuffer *buffer);
 
 extern void
-_mesa_dereference_framebuffer(struct gl_framebuffer **fb);
+_mesa_reference_framebuffer(struct gl_framebuffer **ptr,
+                            struct gl_framebuffer *fb);
+
+extern void
+_mesa_unreference_framebuffer(struct gl_framebuffer **fb);
 
 extern void
 _mesa_resize_framebuffer(GLcontext *ctx, struct gl_framebuffer *fb,
diff --git a/src/mesa/main/rbadaptors.c b/src/mesa/main/rbadaptors.c
index 313c8d43d6..60f4948bec 100644
--- a/src/mesa/main/rbadaptors.c
+++ b/src/mesa/main/rbadaptors.c
@@ -1,8 +1,8 @@
 /*
  * Mesa 3-D graphics library
- * Version:  6.5.1
+ * Version:  6.5.3
  *
- * Copyright (C) 1999-2006  Brian Paul   All Rights Reserved.
+ * Copyright (C) 1999-2007  Brian Paul   All Rights Reserved.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a
  * copy of this software and associated documentation files (the "Software"),
@@ -45,7 +45,7 @@ Delete_wrapper(struct gl_renderbuffer *rb)
    /* Decrement reference count on the buffer we're wrapping and delete
     * it if refcount hits zero.
     */
-   _mesa_dereference_renderbuffer(&rb->Wrapped);
+   _mesa_unreference_renderbuffer(&rb->Wrapped);
 
    /* delete myself */
    _mesa_delete_renderbuffer(rb);
diff --git a/src/mesa/main/renderbuffer.c b/src/mesa/main/renderbuffer.c
index 6b18d60baf..1cc95a7d3b 100644
--- a/src/mesa/main/renderbuffer.c
+++ b/src/mesa/main/renderbuffer.c
@@ -2089,32 +2089,33 @@ _mesa_remove_renderbuffer(struct gl_framebuffer *fb, GLuint bufferName)
    if (!rb)
       return;
 
-   _mesa_dereference_renderbuffer(&rb);
+   _mesa_unreference_renderbuffer(&rb);
 
    fb->Attachment[bufferName].Renderbuffer = NULL;
 }
 
 
 /**
- * Decrement the reference count on a renderbuffer and delete it when
+ * Decrement a renderbuffer object's reference count and delete it when
  * the refcount hits zero.
- * Note: we pass the address of a pointer and set it to NULL if we delete it.
+ * Note: we pass the address of a pointer.
  */
 void
-_mesa_dereference_renderbuffer(struct gl_renderbuffer **rb)
+_mesa_unreference_renderbuffer(struct gl_renderbuffer **rb)
 {
-   GLboolean deleteFlag = GL_FALSE;
+   assert(rb);
+   if (*rb) {
+      GLboolean deleteFlag = GL_FALSE;
 
-   _glthread_LOCK_MUTEX((*rb)->Mutex);
-   {
+      _glthread_LOCK_MUTEX((*rb)->Mutex);
       ASSERT((*rb)->RefCount > 0);
       (*rb)->RefCount--;
       deleteFlag = ((*rb)->RefCount == 0);
-   }
-   _glthread_UNLOCK_MUTEX((*rb)->Mutex);
+      _glthread_UNLOCK_MUTEX((*rb)->Mutex);
+
+      if (deleteFlag)
+         (*rb)->Delete(*rb);
 
-   if (deleteFlag) {
-      (*rb)->Delete(*rb);
       *rb = NULL;
    }
 }
diff --git a/src/mesa/main/renderbuffer.h b/src/mesa/main/renderbuffer.h
index 74ca43c57a..e1a0a55979 100644
--- a/src/mesa/main/renderbuffer.h
+++ b/src/mesa/main/renderbuffer.h
@@ -99,7 +99,7 @@ extern void
 _mesa_remove_renderbuffer(struct gl_framebuffer *fb, GLuint bufferName);
 
 extern void
-_mesa_dereference_renderbuffer(struct gl_renderbuffer **rb);
+_mesa_unreference_renderbuffer(struct gl_renderbuffer **rb);
 
 extern struct gl_renderbuffer *
 _mesa_new_depthstencil_renderbuffer(GLcontext *ctx, GLuint name);