Vulkan: Fix out of bounds access of pWaitDstStageMask

src/common/FixedVector.h

@@ -64,7 +64,7 @@ class FixedVector final
 
     bool empty() const;
     size_type size() const;
-    size_type max_size() const;
+    static constexpr size_type max_size();
 
     void clear();
 
@@ -233,7 +233,7 @@ typename FixedVector<T, N, Storage>::size_type FixedVector<T, N, Storage>::size(
 }
 
 template <class T, size_t N, class Storage>
-typename FixedVector<T, N, Storage>::size_type FixedVector<T, N, Storage>::max_size() const
+constexpr typename FixedVector<T, N, Storage>::size_type FixedVector<T, N, Storage>::max_size()
 {
     return N;
 }

src/libANGLE/renderer/vulkan/ContextVk.cpp

@@ -75,19 +75,27 @@ constexpr size_t kInFlightCommandsLimit = 100u;
 // Initially dumping the command graphs is disabled.
 constexpr bool kEnableCommandGraphDiagnostics = false;
 
+constexpr VkPipelineStageFlags kSubmitInfoWaitDstStageMask[] = {
+    VK_PIPELINE_STAGE_BOTTOM_OF_PIPE_BIT,
+    VK_PIPELINE_STAGE_BOTTOM_OF_PIPE_BIT,
+};
+
 void InitializeSubmitInfo(VkSubmitInfo *submitInfo,
                           const vk::PrimaryCommandBuffer &commandBuffer,
                           const std::vector<VkSemaphore> &waitSemaphores,
-                          VkPipelineStageFlags *waitStageMask,
                           const SignalSemaphoreVector &signalSemaphores)
 {
     submitInfo->sType              = VK_STRUCTURE_TYPE_SUBMIT_INFO;
     submitInfo->commandBufferCount = commandBuffer.valid() ? 1 : 0;
     submitInfo->pCommandBuffers    = commandBuffer.ptr();
 
+    static_assert(std::extent<decltype(kSubmitInfoWaitDstStageMask)>::value ==
+                      std::decay_t<decltype(signalSemaphores)>::max_size(),
+                  "Wrong size for waitStageMask");
+
     submitInfo->waitSemaphoreCount = waitSemaphores.size();
     submitInfo->pWaitSemaphores    = waitSemaphores.data();
-    submitInfo->pWaitDstStageMask  = waitStageMask;
+    submitInfo->pWaitDstStageMask  = kSubmitInfoWaitDstStageMask;
 
     submitInfo->signalSemaphoreCount = signalSemaphores.size();
     submitInfo->pSignalSemaphores    = signalSemaphores.data();
@@ -907,8 +915,7 @@ angle::Result ContextVk::synchronizeCpuGpuTime()
 
         // Submit the command buffer
         VkSubmitInfo submitInfo       = {};
-        VkPipelineStageFlags waitMask = VK_PIPELINE_STAGE_BOTTOM_OF_PIPE_BIT;
-        InitializeSubmitInfo(&submitInfo, commandBatch.get(), {}, &waitMask, {});
+        InitializeSubmitInfo(&submitInfo, commandBatch.get(), {}, {});
 
         ANGLE_TRY(submitFrame(submitInfo, std::move(commandBuffer)));
 
@@ -2098,9 +2105,7 @@ angle::Result ContextVk::flushImpl(const gl::Semaphore *clientSignalSemaphore)
     }
 
     VkSubmitInfo submitInfo       = {};
-    VkPipelineStageFlags waitMask = VK_PIPELINE_STAGE_BOTTOM_OF_PIPE_BIT;
-    InitializeSubmitInfo(&submitInfo, commandBatch.get(), mWaitSemaphores, &waitMask,
-                         signalSemaphores);
+    InitializeSubmitInfo(&submitInfo, commandBatch.get(), mWaitSemaphores, signalSemaphores);
 
     ANGLE_TRY(submitFrame(submitInfo, commandBatch.release()));