nvc0: avoid negatives in PUSH_SPACE argument

Fixup to commit 03b3eb90d - the number of buffers could be larger than
the number of elements, in which case we'd pass a negative argument to
PUSH_SPACE, which would be bad. While we're at it, merge it with the
other PUSH_SPACE at the top of the function.

Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
Cc: mesa-stable@lists.freedesktop.org

diff --git a/src/gallium/drivers/nouveau/nvc0/nvc0_vbo.c b/src/gallium/drivers/nouveau/nvc0/nvc0_vbo.c
index f7769da05030373898de0bad6033a08ac0444915..44aed1adeeba9517034aa74825af247227087679 100644 (file)
--- a/src/gallium/drivers/nouveau/nvc0/nvc0_vbo.c
+++ b/src/gallium/drivers/nouveau/nvc0/nvc0_vbo.c
@@ -382,7 +382,7 @@ nvc0_validate_vertex_buffers_shared(struct nvc0_context *nvc0)
    unsigned b;
    const uint32_t mask = nvc0->vbo_user;
 
-   PUSH_SPACE(push, nvc0->num_vtxbufs * 8);
+   PUSH_SPACE(push, nvc0->num_vtxbufs * 8 + nvc0->vertex->num_elements);
    for (b = 0; b < nvc0->num_vtxbufs; ++b) {
       struct pipe_vertex_buffer *vb = &nvc0->vtxbuf[b];
       struct nv04_resource *buf;
@@ -417,7 +417,6 @@ nvc0_validate_vertex_buffers_shared(struct nvc0_context *nvc0)
    /* If there are more elements than buffers, we might not have unset
     * fetching on the later elements.
     */
-   PUSH_SPACE(push, nvc0->vertex->num_elements - b);
    for (; b < nvc0->vertex->num_elements; ++b)
       IMMED_NVC0(push, NVC0_3D(VERTEX_ARRAY_FETCH(b)), 0);