pvr: Do not free deferred pvr_transfer_cmd instances

Deferred pvr_transfer_cmd instances are allocated from a dyn_array on
the owning pvr_cmd_buffer and must not be freed directly.

Signed-off-by: Matt Coster <matt.coster@imgtec.com>
Reported-by: James Glanville <james.glanville@imgtec.com>
Reviewed-by: Karmjit Mahil <Karmjit.Mahil@imgtec.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/23125>

src/imagination/vulkan/pvr_blit.c

@@ -1734,6 +1734,7 @@ static VkResult pvr_add_deferred_rta_clear(struct pvr_cmd_buffer *cmd_buffer,
       *transfer_cmd = (struct pvr_transfer_cmd){
          .flags = PVR_TRANSFER_CMD_FLAGS_FILL,
          .cmd_buffer = cmd_buffer,
+         .is_deferred_clear = true,
       };
 
       if (attachment->aspectMask == VK_IMAGE_ASPECT_COLOR_BIT) {

src/imagination/vulkan/pvr_cmd_buffer.c

@@ -112,7 +112,8 @@ static void pvr_cmd_buffer_free_sub_cmd(struct pvr_cmd_buffer *cmd_buffer,
                                    &sub_cmd->transfer.transfer_cmds,
                                    link) {
             list_del(&transfer_cmd->link);
-            vk_free(&cmd_buffer->vk.pool->alloc, transfer_cmd);
+            if (!transfer_cmd->is_deferred_clear)
+               vk_free(&cmd_buffer->vk.pool->alloc, transfer_cmd);
          }
          break;
 

src/imagination/vulkan/pvr_private.h

@@ -433,6 +433,11 @@ struct pvr_transfer_cmd {
     * cmd_buffer::bo_list head.
     */
    struct pvr_cmd_buffer *cmd_buffer;
+
+   /* Deferred RTA clears are allocated from pvr_cmd_buffer->deferred_clears and
+    * cannot be freed directly.
+    */
+   bool is_deferred_clear;
 };
 
 struct pvr_sub_cmd_gfx {