GLES3: Fix glMapBufferRange return null when r_index + last_item_index > max_instance

[jsjtxietian]

fixes #80986.
The origin code has bug because when r_index == data.max_instances_per_buffer, glMapBufferRange trys to map length = data.max_instances_per_buffer * sizeof(InstanceData) range from offset state.last_item_index * sizeof(InstanceData), but array buffer size is equal to data.max_instances_per_buffer * sizeof(InstanceData), smaller than length + offset, so the glMapBufferRange failed and returned null instead, and thus caused the crash.

r_index++;
if (r_index >= data.max_instances_per_buffer) {
...
void *buffer = glMapBufferRange(GL_ARRAY_BUFFER, state.last_item_index * sizeof(InstanceData), r_index * sizeof(InstanceData), GL_MAP_WRITE_BIT | GL_MAP_UNSYNCHRONIZED_BIT);
memcpy(buffer, state.instance_data_array, r_index * sizeof(InstanceData));

[clayjohn]

Good catch! Looks good to me

[akien-mga]

Thanks!

[YuriSizov]

Cherry-picked for 4.1.2.