[intel] intel_batchbuffer_flush using uninit 'used' to check for buffer empty

Make sure 'used' tracks the right value through the whole function.
Also, use GLint for intel_batchbuffer_space in case we do bad things
in the future.

diff --git a/src/mesa/drivers/dri/intel/intel_batchbuffer.c b/src/mesa/drivers/dri/intel/intel_batchbuffer.c
index f22e6c096741815f6fd798f31824fbcec86e3de4..b626e90476ffc03aede5e4c065edd966194151d9 100644 (file)
--- a/src/mesa/drivers/dri/intel/intel_batchbuffer.c
+++ b/src/mesa/drivers/dri/intel/intel_batchbuffer.c
@@ -195,7 +195,7 @@ _intel_batchbuffer_flush(struct intel_batchbuffer *batch, const char *file,
                         int line)
 {
    struct intel_context *intel = batch->intel;
-   GLuint used;
+   GLuint used = batch->ptr - batch->map;
    GLboolean was_locked = intel->locked;
 
    if (used == 0)
@@ -209,19 +209,20 @@ _intel_batchbuffer_flush(struct intel_batchbuffer *batch, const char *file,
    if (!intel->ttm) {
       *(GLuint *) (batch->ptr) = intel->vtbl.flush_cmd();
       batch->ptr += 4;
+      used = batch->ptr - batch->map;
    }
 
    /* Round batchbuffer usage to 2 DWORDs. */
-   used = batch->ptr - batch->map;
+
    if ((used & 4) == 0) {
       *(GLuint *) (batch->ptr) = 0; /* noop */
       batch->ptr += 4;
+      used = batch->ptr - batch->map;
    }
 
    /* Mark the end of the buffer. */
    *(GLuint *) (batch->ptr) = MI_BATCH_BUFFER_END; /* noop */
    batch->ptr += 4;
-
    used = batch->ptr - batch->map;
 
    /* Workaround for recursive batchbuffer flushing: If the window is
@@ -272,6 +273,9 @@ intel_batchbuffer_emit_reloc(struct intel_batchbuffer *batch,
 {
    int ret;
 
+   if (batch->ptr - batch->map > batch->buf->size)
+    _mesa_printf ("bad relocation ptr %p map %p offset %d size %d\n",
+                 batch->ptr, batch->map, batch->ptr - batch->map, batch->buf->size);
    ret = dri_emit_reloc(batch->buf, read_domains, write_domain,
                        delta, batch->ptr - batch->map, buffer);
 

diff --git a/src/mesa/drivers/dri/intel/intel_batchbuffer.h b/src/mesa/drivers/dri/intel/intel_batchbuffer.h
index 7268bd59da3d672c2e052db0dcbe94e88145f384..5e8b14b4010627da3eff0b7a615cf2f72a951ed9 100644 (file)
--- a/src/mesa/drivers/dri/intel/intel_batchbuffer.h
+++ b/src/mesa/drivers/dri/intel/intel_batchbuffer.h
@@ -88,7 +88,7 @@ GLboolean intel_batchbuffer_emit_reloc(struct intel_batchbuffer *batch,
  * be passed as structs rather than dwords, but that's a little bit of
  * work...
  */
-static INLINE GLuint
+static INLINE GLint
 intel_batchbuffer_space(struct intel_batchbuffer *batch)
 {
    return (batch->size - BATCH_RESERVED) - (batch->ptr - batch->map);