Commit 034a8b3f by Jamie Madill

Fix stale validation cache on buffer deletion.

When we would delete the currently bound element array buffer we would neglect to invalidate a specific validation cache variable. This incorrectly would let us skip buffer size validation and lead to internal invalid memory accesses. Bug: chromium:1105202 Change-Id: I23ab28ccd3ac6b5d461cb8745b930f4d42d53b35 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/2315622Reviewed-by: 's avatarJamie Madill <jmadill@chromium.org>
parent 6d781655
...@@ -8694,6 +8694,7 @@ void StateCache::onVertexArrayStateChange(Context *context) ...@@ -8694,6 +8694,7 @@ void StateCache::onVertexArrayStateChange(Context *context)
updateActiveAttribsMask(context); updateActiveAttribsMask(context);
updateVertexElementLimits(context); updateVertexElementLimits(context);
updateBasicDrawStatesError(); updateBasicDrawStatesError();
updateBasicDrawElementsError();
} }
void StateCache::onVertexArrayBufferStateChange(Context *context) void StateCache::onVertexArrayBufferStateChange(Context *context)
......
...@@ -202,6 +202,7 @@ class StateCache final : angle::NonCopyable ...@@ -202,6 +202,7 @@ class StateCache final : angle::NonCopyable
// 1. onActiveTransformFeedbackChange. // 1. onActiveTransformFeedbackChange.
// 2. onVertexArrayBufferStateChange. // 2. onVertexArrayBufferStateChange.
// 3. onBufferBindingChange. // 3. onBufferBindingChange.
// 4. onVertexArrayStateChange.
intptr_t getBasicDrawElementsError(const Context *context) const intptr_t getBasicDrawElementsError(const Context *context) const
{ {
if (mCachedBasicDrawElementsError != kInvalidPointer) if (mCachedBasicDrawElementsError != kInvalidPointer)
......
...@@ -5128,6 +5128,26 @@ TEST_P(ImageRespecificationTest, ImageTarget2DOESSwitch) ...@@ -5128,6 +5128,26 @@ TEST_P(ImageRespecificationTest, ImageTarget2DOESSwitch)
eglDestroyImageKHR(window->getDisplay(), firstEGLImage); eglDestroyImageKHR(window->getDisplay(), firstEGLImage);
eglDestroyImageKHR(window->getDisplay(), secondEGLImage); eglDestroyImageKHR(window->getDisplay(), secondEGLImage);
} }
TEST_P(WebGL2ValidationStateChangeTest, DeleteElementArrayBufferValidation)
{
GLushort indexData[] = {0, 1, 2, 3};
GLBuffer elementArrayBuffer;
glBindBuffer(GL_ELEMENT_ARRAY_BUFFER, elementArrayBuffer);
glBufferData(GL_ELEMENT_ARRAY_BUFFER, sizeof(indexData), indexData, GL_STATIC_DRAW);
ANGLE_GL_PROGRAM(program, essl1_shaders::vs::Zero(), essl1_shaders::fs::Red());
glUseProgram(program);
glDrawElements(GL_POINTS, 4, GL_UNSIGNED_SHORT, 0);
elementArrayBuffer.reset();
// Must use a non-0 offset and a multiple of the type size.
glDrawElements(GL_POINTS, 4, GL_UNSIGNED_SHORT, reinterpret_cast<const void *>(0x4));
EXPECT_GL_ERROR(GL_INVALID_OPERATION);
}
} // anonymous namespace } // anonymous namespace
ANGLE_INSTANTIATE_TEST_ES2(StateChangeTest); ANGLE_INSTANTIATE_TEST_ES2(StateChangeTest);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment