Fix vertex array element limit condition.

src/libANGLE/VertexAttribute.cpp

@@ -123,22 +123,30 @@ void VertexAttribute::updateCachedElementLimit(const VertexBinding &binding)
     angle::CheckedNumeric<GLint64> elementLimit =
         (bufferSize - bufferOffset - attribOffset - attribSize);
 
-    if (binding.getStride() > 0)
+    // Use the special integer overflow value if there was a math error.
+    if (!elementLimit.IsValid())
     {
-        angle::CheckedNumeric<GLint64> bindingStride(binding.getStride());
-        elementLimit /= bindingStride;
+        static_assert(kIntegerOverflow < 0, "Unexpected value");
+        mCachedElementLimit = kIntegerOverflow;
+        return;
     }
-    else
+
+    mCachedElementLimit = elementLimit.ValueOrDie();
+    if (mCachedElementLimit < 0)
+    {
+        return;
+    }
+
+    if (binding.getStride() == 0)
     {
         // Special case for a zero stride. If we can fit one vertex we can fit infinite vertices.
-        mCachedElementLimit = elementLimit.ValueOrDefault(-1);
-        if (mCachedElementLimit >= 0)
-        {
-            mCachedElementLimit = std::numeric_limits<GLint64>::max();
-        }
+        mCachedElementLimit = std::numeric_limits<GLint64>::max();
         return;
     }
 
+    angle::CheckedNumeric<GLint64> bindingStride(binding.getStride());
+    elementLimit /= bindingStride;
+
     if (binding.getDivisor() > 0)
     {
         // For instanced draws, the element count is floor(instanceCount - 1) / binding.divisor.
@@ -149,7 +157,7 @@ void VertexAttribute::updateCachedElementLimit(const VertexBinding &binding)
         elementLimit += bindingDivisor - 1;
     }
 
-    mCachedElementLimit = elementLimit.ValueOrDefault(-1);
+    mCachedElementLimit = elementLimit.ValueOrDefault(kIntegerOverflow);
 }
 
 size_t ComputeVertexAttributeTypeSize(const VertexAttribute& attrib)

src/libANGLE/VertexAttribute.h

@@ -85,6 +85,9 @@ struct VertexAttribute final : private angle::NonCopyable
     GLuint vertexAttribArrayStride;  // ONLY for queries of VERTEX_ATTRIB_ARRAY_STRIDE
     GLuint bindingIndex;
 
+    // Special value for the cached element limit on the integer overflow case.
+    static constexpr GLint64 kIntegerOverflow = std::numeric_limits<GLint64>::min();
+
   private:
     // This is kept in sync by the VertexArray. It is used to optimize draw call validation.
     GLint64 mCachedElementLimit;

src/libANGLE/validationES.cpp

@@ -117,9 +117,11 @@ bool ValidateDrawAttribs(Context *context, GLint primcount, GLint maxVertex)
         return true;
     }
 
-    // An overflow can happen when adding the offset. Negative indicates overflow.
-    if (context->getStateCache().getNonInstancedVertexElementLimit() < 0 ||
-        context->getStateCache().getInstancedVertexElementLimit() < 0)
+    // An overflow can happen when adding the offset. Check against a special constant.
+    if (context->getStateCache().getNonInstancedVertexElementLimit() ==
+            VertexAttribute::kIntegerOverflow ||
+        context->getStateCache().getInstancedVertexElementLimit() ==
+            VertexAttribute::kIntegerOverflow)
     {
         ANGLE_VALIDATION_ERR(context, InvalidOperation(), IntegerOverflow);
         return false;

src/tests/gl_tests/VertexAttributeTest.cpp

@@ -749,8 +749,12 @@ TEST_P(VertexAttributeTest, SimpleBindAttribLocation)
 }
 
 // Verify that drawing with a large out-of-range offset generates INVALID_OPERATION.
-TEST_P(VertexAttributeTest, DrawArraysBufferTooSmall)
+// Requires an ANGLE or similar implementation that checks buffer bounds.
+TEST_P(VertexAttributeTest, ANGLEDrawArraysBufferTooSmall)
 {
+    // Test skipped due to supporting GL_KHR_robust_buffer_access_behavior
+    ANGLE_SKIP_TEST_IF(extensionEnabled("GL_KHR_robust_buffer_access_behavior"));
+
     std::array<GLfloat, kVertexCount> inputData;
     std::array<GLfloat, kVertexCount> expectedData;
     InitTestData(inputData, expectedData);
@@ -764,7 +768,8 @@ TEST_P(VertexAttributeTest, DrawArraysBufferTooSmall)
 }
 
 // Verify that index draw with an out-of-range offset generates INVALID_OPERATION.
-TEST_P(VertexAttributeTest, DrawElementsBufferTooSmall)
+// Requires an ANGLE or similar implementation that checks buffer bounds.
+TEST_P(VertexAttributeTest, ANGLEDrawElementsBufferTooSmall)
 {
     // Test skipped due to supporting GL_KHR_robust_buffer_access_behavior
     ANGLE_SKIP_TEST_IF(extensionEnabled("GL_KHR_robust_buffer_access_behavior"));
@@ -781,6 +786,26 @@ TEST_P(VertexAttributeTest, DrawElementsBufferTooSmall)
     EXPECT_GL_ERROR(GL_INVALID_OPERATION);
 }
 
+TEST_P(VertexAttributeTest, ANGLEDrawArraysOutOfBoundsCases)
+{
+    // Test skipped due to supporting GL_KHR_robust_buffer_access_behavior
+    ANGLE_SKIP_TEST_IF(extensionEnabled("GL_KHR_robust_buffer_access_behavior"));
+
+    initBasicProgram();
+
+    GLfloat singleFloat = 1.0f;
+    GLsizei dataSize    = TypeStride(GL_FLOAT);
+
+    glBindBuffer(GL_ARRAY_BUFFER, mBuffer);
+    glBufferData(GL_ARRAY_BUFFER, dataSize, &singleFloat, GL_STATIC_DRAW);
+    glVertexAttribPointer(mTestAttrib, 2, GL_FLOAT, GL_FALSE, 8, 0);
+    glEnableVertexAttribArray(mTestAttrib);
+    glBindBuffer(GL_ARRAY_BUFFER, 0);
+
+    drawIndexedQuad(mProgram, "position", 0.5f);
+    EXPECT_GL_ERROR(GL_INVALID_OPERATION);
+}
+
 // Verify that using a different start vertex doesn't mess up the draw.
 TEST_P(VertexAttributeTest, DrawArraysWithBufferOffset)
 {