commit 30b604d8d17480bd519fb97ec817db1e4ca90f0e
author James Darpinian <jdarpinian@chromium.org> Mon Mar 12 17:26:57 2018 -0700
committer Commit Bot <commit-bot@chromium.org> Tue Apr 03 02:42:30 2018 +0000
tree 1ce5bf41f2cf5956f100c8a54609f9e797c4e8e8
parent 5a7e61bbda82122cab74d1a5b80d578c1980b493

Check that transform feedback will not overflow its buffers.

Also fix the check for uniform buffer size to use the actual buffer
size instead of the size of the bound range.

Bug: 820639
Change-Id: Iaa2a617ee7ce5ce7cfabbf64bd1d6f8c82c46b65
Reviewed-on: https://chromium-review.googlesource.com/965627
Commit-Queue: James Darpinian <jdarpinian@chromium.org>
Reviewed-by: Jamie Madill <jmadill@chromium.org>

src/libANGLE/Context.cpp

diff --git a/src/libANGLE/Context.cpp b/src/libANGLE/Context.cpp
index 570a961..9140870 100644
--- a/src/libANGLE/Context.cpp
+++ b/src/libANGLE/Context.cpp
@@ -129,20 +129,13 @@
     }
 }
 
-void MarkTransformFeedbackBufferUsage(gl::TransformFeedback *transformFeedback)
+void MarkTransformFeedbackBufferUsage(gl::TransformFeedback *transformFeedback,
+                                      GLsizei count,
+                                      GLsizei instanceCount)
 {
     if (transformFeedback && transformFeedback->isActive() && !transformFeedback->isPaused())
     {
-        for (size_t tfBufferIndex = 0; tfBufferIndex < transformFeedback->getIndexedBufferCount();
-             tfBufferIndex++)
-        {
-            const gl::OffsetBindingPointer<gl::Buffer> &buffer =
-                transformFeedback->getIndexedBuffer(tfBufferIndex);
-            if (buffer.get() != nullptr)
-            {
-                buffer->onTransformFeedback();
-            }
-        }
+        transformFeedback->onVerticesDrawn(count, instanceCount);
     }
 }
 
@@ -1811,7 +1804,7 @@
 
     ANGLE_CONTEXT_TRY(prepareForDraw());
     ANGLE_CONTEXT_TRY(mImplementation->drawArrays(this, mode, first, count));
-    MarkTransformFeedbackBufferUsage(mGLState.getCurrentTransformFeedback());
+    MarkTransformFeedbackBufferUsage(mGLState.getCurrentTransformFeedback(), count, 1);
 }
 
 void Context::drawArraysInstanced(GLenum mode, GLint first, GLsizei count, GLsizei instanceCount)
@@ -1825,7 +1818,7 @@
     ANGLE_CONTEXT_TRY(prepareForDraw());
     ANGLE_CONTEXT_TRY(
         mImplementation->drawArraysInstanced(this, mode, first, count, instanceCount));
-    MarkTransformFeedbackBufferUsage(mGLState.getCurrentTransformFeedback());
+    MarkTransformFeedbackBufferUsage(mGLState.getCurrentTransformFeedback(), count, instanceCount);
 }
 
 void Context::drawElements(GLenum mode, GLsizei count, GLenum type, const void *indices)