r300-gallium: Fix vertex memory offsets.

Wow, I must have been asleep when I made that mistake.

src/gallium/drivers/r300/r300_state_derived.c

@@ -57,14 +57,13 @@ static void r300_update_vertex_layout(struct r300_context* r300)
             case TGSI_SEMANTIC_COLOR:
                 tab[i] = 2 + cols++;
                 break;
-            case TGSI_SEMANTIC_FOG:
-                fog = TRUE;
-                tab[i] = 6 + texs++;
-                break;
             case TGSI_SEMANTIC_PSIZE:
                 psize = TRUE;
                 tab[i] = 1;
                 break;
+            case TGSI_SEMANTIC_FOG:
+                fog = TRUE;
+                /* Fall through... */
             case TGSI_SEMANTIC_GENERIC:
                 tab[i] = 6 + texs++;
                 break;
@@ -89,7 +88,7 @@ static void r300_update_vertex_layout(struct r300_context* r300)
         debug_printf("r300: Forcing vertex position attribute emit...\n");
         /* Make room for the position attribute
          * at the beginning of the tab. */
-        for (i = 1; i < 16; i++) {
+        for (i = 15; i > 0; i--) {
             tab[i] = tab[i-1];
         }
         tab[0] = 0;