r300/compiler: fix buffer underflow when setting SEM_WAIT on last instruction

Do it after we check whether inst_end != -1.
Also move the code structure at the beginning of r300_fragment_shader_code
to detect underflows easily with valgrind.

2 files changed, 4 insertions, 4 deletions

diff --git a/src/gallium/drivers/r300/compiler/r500_fragprog_emit.c b/src/gallium/drivers/r300/compiler/r500_fragprog_emit.c
index bfd4aa82b95..87b96d15079 100644
--- a/src/gallium/drivers/r300/compiler/r500_fragprog_emit.c
+++ b/src/gallium/drivers/r300/compiler/r500_fragprog_emit.c
@@ -650,9 +650,6 @@ void r500BuildFragmentProgramHwCode(struct radeon_compiler *c, void *user)
 		}
 	}
 
-	/* Make sure TEX_SEM_WAIT is set on the last instruction */
-	code->inst[code->inst_end].inst0 |= R500_INST_TEX_SEM_WAIT;
-
 	if (code->max_temp_idx >= compiler->Base.max_temp_regs)
 		rc_error(&compiler->Base, "Too many hardware temporaries used");
 
@@ -674,6 +671,9 @@ void r500BuildFragmentProgramHwCode(struct radeon_compiler *c, void *user)
 		code->inst[ip].inst0 = R500_INST_TYPE_OUT | R500_INST_TEX_SEM_WAIT;
 	}
 
+	/* Make sure TEX_SEM_WAIT is set on the last instruction */
+	code->inst[code->inst_end].inst0 |= R500_INST_TEX_SEM_WAIT;
+
 	/* Enable full flow control mode if we are using loops or have if
 	 * statements nested at least four deep. */
 	if (s.MaxBranchDepth >= 4 || s.LoopsReserved > 0) {
diff --git a/src/gallium/drivers/r300/r300_fs.h b/src/gallium/drivers/r300/r300_fs.h
index 45c9e8801c3..39eb73da65d 100644
--- a/src/gallium/drivers/r300/r300_fs.h
+++ b/src/gallium/drivers/r300/r300_fs.h
@@ -31,6 +31,7 @@
 #include "r300_shader_semantics.h"
 
 struct r300_fragment_shader_code {
+    struct rX00_fragment_program_code code;
     struct tgsi_shader_info info;
     struct r300_shader_semantics inputs;
 
@@ -48,7 +49,6 @@ struct r300_fragment_shader_code {
     uint32_t us_out_w;          /* R300_US_W_FMT:     0x46b4 */
 
     struct r300_fragment_program_external_state compare_state;
-    struct rX00_fragment_program_code code;
 
     unsigned cb_code_size;
     uint32_t *cb_code;