r300: fix r300_destroy_context() related memory leaks

For instance, with "piglit/bin/fcc-blit-between-clears -auto -fbo"":
SUMMARY: AddressSanitizer: 70512 byte(s) leaked in 497 allocation(s).

Fixes: e01f86c67b ("r300: set PIPE_BIND_CONSTANT_BUFFER for const_uploader")
Signed-off-by: Patrick Lerda <patrick9876@free.fr>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/27791>

src/gallium/drivers/r300/r300_context.c

@@ -93,6 +93,8 @@ static void r300_destroy_context(struct pipe_context* context)
         u_upload_destroy(r300->uploader);
     if (r300->context.stream_uploader)
         u_upload_destroy(r300->context.stream_uploader);
+    if (r300->context.const_uploader)
+       u_upload_destroy(r300->context.const_uploader);
 
     /* XXX: This function assumes r300->query_list was initialized */
     r300_release_referenced_objects(r300);
@@ -102,6 +104,7 @@ static void r300_destroy_context(struct pipe_context* context)
         r300->rws->ctx_destroy(r300->ctx);
 
     rc_destroy_regalloc_state(&r300->fs_regalloc_state);
+    rc_destroy_regalloc_state(&r300->vs_regalloc_state);
 
     /* XXX: No way to tell if this was initialized or not? */
     slab_destroy_child(&r300->pool_transfers);
@@ -128,6 +131,9 @@ static void r300_destroy_context(struct pipe_context* context)
             FREE(r300->vertex_stream_state.state);
         }
     }
+
+    FREE(r300->stencilref_fallback);
+
     FREE(r300);
 }