[intel] intel_batchbuffer_flush using uninit 'used' to check for buffer empty

Make sure 'used' tracks the right value through the whole function.
Also, use GLint for intel_batchbuffer_space in case we do bad things
in the future.

2 files changed, 8 insertions, 4 deletions

diff --git a/src/mesa/drivers/dri/intel/intel_batchbuffer.c b/src/mesa/drivers/dri/intel/intel_batchbuffer.c
index f22e6c0967..b626e90476 100644
--- a/src/mesa/drivers/dri/intel/intel_batchbuffer.c
+++ b/src/mesa/drivers/dri/intel/intel_batchbuffer.c
@@ -195,7 +195,7 @@ _intel_batchbuffer_flush(struct intel_batchbuffer *batch, const char *file,
 			 int line)
 {
    struct intel_context *intel = batch->intel;
-   GLuint used;
+   GLuint used = batch->ptr - batch->map;
    GLboolean was_locked = intel->locked;
 
    if (used == 0)
@@ -209,19 +209,20 @@ _intel_batchbuffer_flush(struct intel_batchbuffer *batch, const char *file,
    if (!intel->ttm) {
       *(GLuint *) (batch->ptr) = intel->vtbl.flush_cmd();
       batch->ptr += 4;
+      used = batch->ptr - batch->map;
    }
 
    /* Round batchbuffer usage to 2 DWORDs. */
-   used = batch->ptr - batch->map;
+
    if ((used & 4) == 0) {
       *(GLuint *) (batch->ptr) = 0; /* noop */
       batch->ptr += 4;
+      used = batch->ptr - batch->map;
    }
 
    /* Mark the end of the buffer. */
    *(GLuint *) (batch->ptr) = MI_BATCH_BUFFER_END; /* noop */
    batch->ptr += 4;
-
    used = batch->ptr - batch->map;
 
    /* Workaround for recursive batchbuffer flushing: If the window is
@@ -272,6 +273,9 @@ intel_batchbuffer_emit_reloc(struct intel_batchbuffer *batch,
 {
    int ret;
 
+   if (batch->ptr - batch->map > batch->buf->size)
+    _mesa_printf ("bad relocation ptr %p map %p offset %d size %d\n",
+		  batch->ptr, batch->map, batch->ptr - batch->map, batch->buf->size);
    ret = dri_emit_reloc(batch->buf, read_domains, write_domain,
 			delta, batch->ptr - batch->map, buffer);
 
diff --git a/src/mesa/drivers/dri/intel/intel_batchbuffer.h b/src/mesa/drivers/dri/intel/intel_batchbuffer.h
index 7268bd59da..5e8b14b401 100644
--- a/src/mesa/drivers/dri/intel/intel_batchbuffer.h
+++ b/src/mesa/drivers/dri/intel/intel_batchbuffer.h
@@ -88,7 +88,7 @@ GLboolean intel_batchbuffer_emit_reloc(struct intel_batchbuffer *batch,
  * be passed as structs rather than dwords, but that's a little bit of
  * work...
  */
-static INLINE GLuint
+static INLINE GLint
 intel_batchbuffer_space(struct intel_batchbuffer *batch)
 {
    return (batch->size - BATCH_RESERVED) - (batch->ptr - batch->map);