Fixed: DCanvas::FillSimplePoly must set dc_destorg

- dc_destorg is normally set to the upper-left corner of the view window.
  If there is a border, then this won't coincide with the upper-left
  corner of the screen, and DCanvas::FillSimplePoly would merrily write off
  the end of the screen buffer.

src/v_draw.cpp

@@ -1330,6 +1330,13 @@ void DCanvas::FillSimplePoly(FTexture *tex, FVector2 *points, int npoints,
 		return;
 	}
 
+	BYTE *destorgsave = dc_destorg;
+	dc_destorg = screen->GetBuffer();
+	if (dc_destorg == NULL)
+	{
+		I_FatalError("Attempt to write to buffer of hardware canvas");
+	}
+
 	scalex /= tex->Scale.X;
 	scaley /= tex->Scale.Y;
 
@@ -1432,6 +1439,7 @@ void DCanvas::FillSimplePoly(FTexture *tex, FVector2 *points, int npoints,
 		pt1 = pt2;
 		pt2--;			if (pt2 < 0) pt2 = npoints;
 	} while (pt1 != botpt);
+	dc_destorg = destorgsave;
 #endif
 }