Created attachment 122572 [details]
Patch for problem.

Noticed while looking at a crash that pb_reference is called in several
places with src set to NULL which is interesting since pb_reference then
calls pipe_reference with &src->reference.  The existing code works since
struct pb_buffer looks like:

  struct pb_buffer {
   struct pipe_reference  reference;
   ...

meaning &src->reference with src = NULL happens to equal NULL.  The
attached patch explicitly handles src = NULL which is less fragile and
clearly communicates that being passed NULL is valid.