Hash :
a8e98a23
Author :
Date :
2021-07-10T15:25:20
Fix gl::Context::unMakeCurrent crashes The crash is because Display::makeCurrent() may fail, in that case, egl_stubs.cpp will not update the current context in global_state and Thread accordingly. And then Context::refCount could be reach 0, and be released, however egl_stubs.cpp still thinks the context is current, and then user-after-free happens. This CL fixes the problem by updating current context of Thread in Display::makeCurrent, and reading the current context of Thread in egl_stubs.cpp and setting it to global_state. Bug: chromium:1171371 Change-Id: Ifc5fffb0e4902c9c72514839d03e5783d50fe283 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/3017210 Reviewed-by: Jonah Ryan-Davis <jonahr@google.com> Reviewed-by: Geoff Lang <geofflang@chromium.org> Commit-Queue: Peng Huang <penghuang@chromium.org>
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253
//
// Copyright 2014 The ANGLE Project Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// global_state.cpp : Implements functions for querying the thread-local GL and EGL state.
#include "libGLESv2/global_state.h"
#include "common/debug.h"
#include "common/platform.h"
#include "common/system_utils.h"
#include "libANGLE/ErrorStrings.h"
#include "libANGLE/Thread.h"
#include "libGLESv2/resource.h"
#include <atomic>
namespace egl
{
namespace
{
ANGLE_REQUIRE_CONSTANT_INIT std::atomic<angle::GlobalMutex *> g_Mutex(nullptr);
static_assert(std::is_trivially_destructible<decltype(g_Mutex)>::value,
"global mutex is not trivially destructible");
ANGLE_REQUIRE_CONSTANT_INIT gl::Context *g_LastContext(nullptr);
static_assert(std::is_trivially_destructible<decltype(g_LastContext)>::value,
"global last context is not trivially destructible");
void SetContextToAndroidOpenGLTLSSlot(gl::Context *value)
{
#if defined(ANGLE_PLATFORM_ANDROID)
if (angle::gUseAndroidOpenGLTlsSlot)
{
ANGLE_ANDROID_GET_GL_TLS()[angle::kAndroidOpenGLTlsSlot] = static_cast<void *>(value);
}
#endif
}
Thread *AllocateCurrentThread()
{
{
// Global thread intentionally leaked
ANGLE_SCOPED_DISABLE_LSAN();
gCurrentThread = new Thread();
}
// Initialize fast TLS slot
SetContextToAndroidOpenGLTLSSlot(nullptr);
gl::gCurrentValidContext = nullptr;
return gCurrentThread;
}
void AllocateMutex()
{
if (g_Mutex == nullptr)
{
std::unique_ptr<angle::GlobalMutex> newMutex(new angle::GlobalMutex());
angle::GlobalMutex *expected = nullptr;
if (g_Mutex.compare_exchange_strong(expected, newMutex.get()))
{
newMutex.release();
}
}
}
} // anonymous namespace
thread_local Thread *gCurrentThread = nullptr;
angle::GlobalMutex &GetGlobalMutex()
{
AllocateMutex();
return *g_Mutex;
}
gl::Context *GetGlobalLastContext()
{
return g_LastContext;
}
void SetGlobalLastContext(gl::Context *context)
{
g_LastContext = context;
}
// This function causes an MSAN false positive, which is muted. See https://crbug.com/1211047
// It also causes a flaky false positive in TSAN. http://crbug.com/1223970
ANGLE_NO_SANITIZE_MEMORY ANGLE_NO_SANITIZE_THREAD Thread *GetCurrentThread()
{
Thread *current = gCurrentThread;
return (current ? current : AllocateCurrentThread());
}
void SetContextCurrent(Thread *thread, gl::Context *context)
{
ASSERT(gCurrentThread == thread);
SetContextToAndroidOpenGLTLSSlot(context);
gl::gCurrentValidContext = context;
#if defined(ANGLE_FORCE_CONTEXT_CHECK_EVERY_CALL)
DirtyContextIfNeeded(context);
#endif
}
ScopedSyncCurrentContextFromThread::ScopedSyncCurrentContextFromThread(egl::Thread *thread)
: mThread(thread)
{
ASSERT(mThread);
}
ScopedSyncCurrentContextFromThread::~ScopedSyncCurrentContextFromThread()
{
SetContextCurrent(mThread, mThread->getContext());
}
} // namespace egl
namespace gl
{
void GenerateContextLostErrorOnContext(Context *context)
{
if (context && context->isContextLost())
{
context->validationError(GL_CONTEXT_LOST, err::kContextLost);
}
}
void GenerateContextLostErrorOnCurrentGlobalContext()
{
GenerateContextLostErrorOnContext(GetGlobalContext());
}
} // namespace gl
#if defined(ANGLE_PLATFORM_WINDOWS) && !defined(ANGLE_STATIC)
namespace egl
{
namespace
{
void DeallocateCurrentThread()
{
SafeDelete(gCurrentThread);
}
void DeallocateMutex()
{
angle::GlobalMutex *mutex = g_Mutex.exchange(nullptr);
{
// Wait for the mutex to become released by other threads before deleting.
std::lock_guard<angle::GlobalMutex> lock(*mutex);
}
SafeDelete(mutex);
}
bool InitializeProcess()
{
EnsureDebugAllocated();
AllocateMutex();
return AllocateCurrentThread() != nullptr;
}
void TerminateProcess()
{
DeallocateDebug();
DeallocateMutex();
DeallocateCurrentThread();
}
} // anonymous namespace
} // namespace egl
namespace
{
// The following WaitForDebugger code is based on SwiftShader. See:
// https://cs.chromium.org/chromium/src/third_party/swiftshader/src/Vulkan/main.cpp
# if defined(ANGLE_ENABLE_ASSERTS) && !defined(ANGLE_ENABLE_WINDOWS_UWP)
INT_PTR CALLBACK DebuggerWaitDialogProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
RECT rect;
switch (uMsg)
{
case WM_INITDIALOG:
::GetWindowRect(GetDesktopWindow(), &rect);
::SetWindowPos(hwnd, HWND_TOP, rect.right / 2, rect.bottom / 2, 0, 0, SWP_NOSIZE);
::SetTimer(hwnd, 1, 100, NULL);
return TRUE;
case WM_COMMAND:
if (LOWORD(wParam) == IDCANCEL)
{
::EndDialog(hwnd, 0);
}
break;
case WM_TIMER:
if (angle::IsDebuggerAttached())
{
::EndDialog(hwnd, 0);
}
}
return FALSE;
}
void WaitForDebugger(HINSTANCE instance)
{
if (angle::IsDebuggerAttached())
return;
HRSRC dialog = ::FindResourceA(instance, MAKEINTRESOURCEA(IDD_DIALOG1), MAKEINTRESOURCEA(5));
if (!dialog)
{
printf("Error finding wait for debugger dialog. Error %lu.\n", ::GetLastError());
return;
}
DLGTEMPLATE *dialogTemplate = reinterpret_cast<DLGTEMPLATE *>(::LoadResource(instance, dialog));
::DialogBoxIndirectA(instance, dialogTemplate, NULL, DebuggerWaitDialogProc);
}
# else
void WaitForDebugger(HINSTANCE instance) {}
# endif // defined(ANGLE_ENABLE_ASSERTS) && !defined(ANGLE_ENABLE_WINDOWS_UWP)
} // namespace
extern "C" BOOL WINAPI DllMain(HINSTANCE instance, DWORD reason, LPVOID)
{
switch (reason)
{
case DLL_PROCESS_ATTACH:
if (angle::GetEnvironmentVar("ANGLE_WAIT_FOR_DEBUGGER") == "1")
{
WaitForDebugger(instance);
}
return static_cast<BOOL>(egl::InitializeProcess());
case DLL_THREAD_ATTACH:
return static_cast<BOOL>(egl::AllocateCurrentThread() != nullptr);
case DLL_THREAD_DETACH:
egl::DeallocateCurrentThread();
break;
case DLL_PROCESS_DETACH:
egl::TerminateProcess();
break;
}
return TRUE;
}
#endif // defined(ANGLE_PLATFORM_WINDOWS) && !defined(ANGLE_STATIC)