r600: fix Elts handling

Patch from taiu on IRC.  fixes bug 23585

2 files changed, 16 insertions, 3 deletions

diff --git a/src/mesa/drivers/dri/r600/r600_cmdbuf.c b/src/mesa/drivers/dri/r600/r600_cmdbuf.c
index 65930ff589f..3cfe03a45f7 100644
--- a/src/mesa/drivers/dri/r600/r600_cmdbuf.c
+++ b/src/mesa/drivers/dri/r600/r600_cmdbuf.c
@@ -192,9 +192,9 @@ static int r600_cs_begin(struct radeon_cs *cs,
 
     if (cs->cdw + ndw > cs->ndw) {
         uint32_t tmp, *ptr;
-	int num = (ndw > 0x3FF) ? ndw : 0x3FF;
+	int num = (ndw > 0x400) ? ndw : 0x400;
 
-        tmp = (cs->cdw + 1 + num) & (~num);
+        tmp = (cs->cdw + num + 0x3FF) & (~0x3FF);
         ptr = (uint32_t*)realloc(cs->packets, 4 * tmp);
         if (ptr == NULL) {
             return -ENOMEM;
@@ -229,6 +229,14 @@ static int r600_cs_end(struct radeon_cs *cs,
         return -EPIPE;
     }
 
+    if (cs->cdw > cs->ndw) {
+	    fprintf(stderr, "CS section overflow at (%s,%s,%d) cdw %d ndw %d\n",
+		    cs->section_file, cs->section_func, cs->section_line,cs->cdw,cs->ndw);
+	    fprintf(stderr, "CS section end at (%s,%s,%d)\n",
+		    file, func, line);
+	    assert(0);
+    }
+
     return 0;
 }
 
diff --git a/src/mesa/drivers/dri/r600/r700_render.c b/src/mesa/drivers/dri/r600/r700_render.c
index e1bbbfef35f..3566bf3ca78 100644
--- a/src/mesa/drivers/dri/r600/r700_render.c
+++ b/src/mesa/drivers/dri/r600/r700_render.c
@@ -257,6 +257,8 @@ static void r700RunRenderPrimitive(GLcontext * ctx, int start, int end, int prim
 	uint32_t vgt_index_type     = 0;
 	uint32_t vgt_primitive_type = 0;
 	uint32_t vgt_num_indices    = 0;
+	TNLcontext *tnl = TNL_CONTEXT(ctx);
+	struct vertex_buffer *vb = &tnl->vb;
 
 	type = r700PrimitiveType(prim);
 	num_indices = r700NumVerts(end - start, prim);
@@ -300,7 +302,10 @@ static void r700RunRenderPrimitive(GLcontext * ctx, int start, int end, int prim
         R600_OUT_BATCH(vgt_draw_initiator);
 
         for (i = start; i < (start + num_indices); i++) {
-            R600_OUT_BATCH(i);
+		if(vb->Elts)
+			R600_OUT_BATCH(vb->Elts[i]);
+		else
+			R600_OUT_BATCH(i);
         }
         END_BATCH();
         COMMIT_BATCH();