Hash :
18e323ab
Author :
Date :
2018-05-11T16:54:17
D3D11: Fix out-of-range access with robust access. When using a vertex buffer with DYNAMIC usage, with robust buffer access enabled, we would sometimes read out-of-bounds when using very large values for the index range. An unchecked signed addition would overflow and lead to reading a negative offset. Fix this problem by keeping the value size_t whenever possible. Also do clamped casts when converting to a smaller values. Also adds a regression test. Bug: chromium:842028 Change-Id: Ie630ac857c6acfc0bace849a03eebfbaa2fbe89a Reviewed-on: https://chromium-review.googlesource.com/1055928 Commit-Queue: Jamie Madill <jmadill@chromium.org> Reviewed-by: Geoff Lang <geofflang@chromium.org>
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195
//
// Copyright 2015 The ANGLE Project Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// IndexDataManagerPerfTest:
// Performance test for index buffer management.
//
#include "ANGLEPerfTest.h"
#include <gmock/gmock.h>
#include "angle_unittests_utils.h"
#include "libANGLE/renderer/d3d/BufferD3D.h"
#include "libANGLE/renderer/d3d/IndexBuffer.h"
#include "libANGLE/renderer/d3d/IndexDataManager.h"
using namespace testing;
namespace
{
class MockIndexBuffer : public rx::IndexBuffer
{
public:
MockIndexBuffer(unsigned int bufferSize, GLenum indexType)
: mBufferSize(bufferSize), mIndexType(indexType)
{
}
MOCK_METHOD3(initialize, gl::Error(unsigned int, GLenum, bool));
MOCK_METHOD3(mapBuffer, gl::Error(unsigned int, unsigned int, void **));
MOCK_METHOD0(unmapBuffer, gl::Error());
MOCK_METHOD0(discard, gl::Error());
MOCK_METHOD2(setSize, gl::Error(unsigned int, GLenum));
// inlined for speed
GLenum getIndexType() const override { return mIndexType; }
unsigned int getBufferSize() const override { return mBufferSize; }
private:
unsigned int mBufferSize;
GLenum mIndexType;
};
class MockBufferFactoryD3D : public rx::BufferFactoryD3D
{
public:
MockBufferFactoryD3D(unsigned int bufferSize, GLenum indexType)
: mBufferSize(bufferSize), mIndexType(indexType)
{
}
MOCK_METHOD0(createVertexBuffer, rx::VertexBuffer *());
MOCK_CONST_METHOD1(getVertexConversionType, rx::VertexConversionType(gl::VertexFormatType));
MOCK_CONST_METHOD1(getVertexComponentType, GLenum(gl::VertexFormatType));
MOCK_CONST_METHOD4(getVertexSpaceRequired,
gl::ErrorOrResult<unsigned int>(const gl::VertexAttribute &,
const gl::VertexBinding &,
size_t,
GLsizei));
// Dependency injection
rx::IndexBuffer *createIndexBuffer() override
{
return new MockIndexBuffer(mBufferSize, mIndexType);
}
private:
unsigned int mBufferSize;
GLenum mIndexType;
};
class MockBufferD3D : public rx::BufferD3D
{
public:
MockBufferD3D(rx::BufferFactoryD3D *factory) : BufferD3D(mockState, factory), mData() {}
// BufferImpl
gl::Error setData(const gl::Context *context,
gl::BufferBinding target,
const void *data,
size_t size,
gl::BufferUsage) override
{
mData.resize(size);
if (data && size > 0)
{
memcpy(&mData[0], data, size);
}
return gl::NoError();
}
MOCK_METHOD5(setSubData,
gl::Error(const gl::Context *, gl::BufferBinding, const void *, size_t, size_t));
MOCK_METHOD5(copySubData,
gl::Error(const gl::Context *, BufferImpl *, GLintptr, GLintptr, GLsizeiptr));
MOCK_METHOD3(map, gl::Error(const gl::Context *context, GLenum, void **));
MOCK_METHOD5(mapRange, gl::Error(const gl::Context *, size_t, size_t, GLbitfield, void **));
MOCK_METHOD2(unmap, gl::Error(const gl::Context *context, GLboolean *));
// BufferD3D
MOCK_METHOD1(markTransformFeedbackUsage, gl::Error(const gl::Context *));
// inlined for speed
bool supportsDirectBinding() const override { return false; }
size_t getSize() const override { return mData.size(); }
gl::Error getData(const gl::Context *context, const uint8_t **outData) override
{
*outData = &mData[0];
return gl::NoError();
}
private:
gl::BufferState mockState;
std::vector<uint8_t> mData;
};
class MockGLFactoryD3D : public rx::MockGLFactory
{
public:
MockGLFactoryD3D(MockBufferFactoryD3D *bufferFactory) : mBufferFactory(bufferFactory) {}
rx::BufferImpl *createBuffer(const gl::BufferState &state) override
{
MockBufferD3D *mockBufferD3D = new MockBufferD3D(mBufferFactory);
EXPECT_CALL(*mBufferFactory, createVertexBuffer())
.WillOnce(Return(nullptr))
.RetiresOnSaturation();
mockBufferD3D->initializeStaticData(nullptr);
return mockBufferD3D;
}
MockBufferFactoryD3D *mBufferFactory;
};
class IndexDataManagerPerfTest : public ANGLEPerfTest
{
public:
IndexDataManagerPerfTest();
void step() override;
rx::IndexDataManager mIndexDataManager;
GLsizei mIndexCount;
unsigned int mBufferSize;
MockBufferFactoryD3D mMockBufferFactory;
MockGLFactoryD3D mMockGLFactory;
gl::Buffer mIndexBuffer;
};
IndexDataManagerPerfTest::IndexDataManagerPerfTest()
: ANGLEPerfTest("IndexDataManger", "_run"),
mIndexDataManager(&mMockBufferFactory),
mIndexCount(4000),
mBufferSize(mIndexCount * sizeof(GLushort)),
mMockBufferFactory(mBufferSize, GL_UNSIGNED_SHORT),
mMockGLFactory(&mMockBufferFactory),
mIndexBuffer(&mMockGLFactory, 1)
{
std::vector<GLushort> indexData(mIndexCount);
for (GLsizei index = 0; index < mIndexCount; ++index)
{
indexData[index] = static_cast<GLushort>(index);
}
EXPECT_FALSE(mIndexBuffer
.bufferData(nullptr, gl::BufferBinding::Array, &indexData[0],
indexData.size() * sizeof(GLushort), gl::BufferUsage::StaticDraw)
.isError());
}
void IndexDataManagerPerfTest::step()
{
rx::TranslatedIndexData translatedIndexData;
gl::IndexRange indexRange;
for (unsigned int iteration = 0; iteration < 100; ++iteration)
{
(void)mIndexBuffer.getIndexRange(nullptr, GL_UNSIGNED_SHORT, 0, mIndexCount, false,
&indexRange);
(void)mIndexDataManager.prepareIndexData(nullptr, GL_UNSIGNED_SHORT, GL_UNSIGNED_SHORT,
mIndexCount, &mIndexBuffer, nullptr,
&translatedIndexData);
}
}
TEST_F(IndexDataManagerPerfTest, Run)
{
run();
}
} // anonymous namespace