sna: Check that the bo exists before attempting to undo it

Fixes a NULL dereference from sna_blt_composite().

Bugzilla: https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/1228677
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

src/sna/kgem.c

@@ -1932,6 +1932,7 @@ void kgem_bo_undo(struct kgem *kgem, struct kgem_bo *bo)
 	if (kgem->nexec != 1 || bo->exec == NULL)
 		return;
 
+	assert(bo);
 	DBG(("%s: only handle in batch, discarding last operations for handle=%d\n",
 	     __FUNCTION__, bo->handle));
 

src/sna/sna_blt.c

@@ -2250,7 +2250,7 @@ fill:
 	tmp->dst.bo = sna_drawable_use_bo(dst->pDrawable, hint,
 					  &dst_box, &tmp->damage);
 
-	if (hint & REPLACES)
+	if (tmp->dst.bo && hint & REPLACES)
 		kgem_bo_undo(&sna->kgem, tmp->dst.bo);
 
 	ret = false;

src/sna/sna_io.c

@@ -1438,6 +1438,7 @@ bool sna_replace(struct sna *sna,
 	struct kgem *kgem = &sna->kgem;
 	void *dst;
 
+	assert(bo);
 	DBG(("%s(handle=%d, %dx%d, bpp=%d, tiling=%d) busy?=%d\n",
 	     __FUNCTION__, bo->handle,
 	     pixmap->drawable.width,