util: fix assertion failures in pipe_buffer_flush_mapped_range

src/gallium/auxiliary/util/u_inlines.h

@@ -223,7 +223,7 @@ pipe_buffer_flush_mapped_range(struct pipe_context *pipe,
 
    assert(length);
    assert(transfer->box.x <= offset);
-   assert(transfer->box.x + transfer->box.width <= offset + length);
+   assert(offset + length <= transfer->box.x + transfer->box.width);
 
    /* Match old screen->buffer_flush_mapped_range() behaviour, where
     * offset parameter is relative to the start of the buffer, not the

src/gallium/auxiliary/util/u_upload_mgr.c

@@ -95,7 +95,7 @@ my_buffer_write(struct pipe_context *pipe,
    assert(dirty_size >= size);
    assert(size);
 
-   map = pipe_buffer_map_range(pipe, buf, offset, size, 
+   map = pipe_buffer_map_range(pipe, buf, offset, dirty_size,
                                PIPE_TRANSFER_WRITE |
                                PIPE_TRANSFER_FLUSH_EXPLICIT |
                                PIPE_TRANSFER_DISCARD |