plane->state->fb and plane->fb should always reference the same FB so
that atomic and legacy codepaths have the same view of display state.
In commit

        commit db068420560511de80ac59222644f2bdf278c3d5
        Author: Matt Roper <matthew.d.roper@intel.com>
        Date:   Fri Jan 30 16:22:36 2015 -0800

            drm/i915: Keep plane->state updated on pageflip

we already fixed one case where these two pointers could get out of
sync.  However it turns out there are a few other places (mainly dealing
with initial FB setup at boot) that directly set plane->fb and neglect
to update plane->state->fb.  If we never do a successful update through
the atomic pipeline, the RmFB cleanup code will look at the
plane->state->fb pointer, which has never actually been set to a
legitimate value, and try to clean it up, leading to BUG's.

Add a quick helper function to synchronize plane->state->fb with
plane->fb (and update reference counts accordingly) and call it
everywhere the driver tries to manually set plane->fb outside of the
atomic pipeline.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=88909Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>