Vulkan: Fix use-after-free with DynamicBuffer.
The implementation of DynamicBuffer before my changes could have some
issues in the following use case:
- Allocate buffer 1 for Texture 1 (with size as big as the full buffer
size)
- Allocate buffer 2 for Texture 2 (triggers creation of a new underlying
BufferVk and releases the buffer 1 to the Renderer)
- Render with Texture 2 (texture 1 hasn't been flushed yet)
- swap buffers (causes garbage in the renderer to be cleaned up)
- Try rendering with Texture 1, and you'll get an error stating that
the buffer we're trying to copy is not valid (because its already been
freed).
This set of changes:
- Add a new test that specifically triggers this case.
- enables the texture.filtering.cube* tests in dEQP.
- Fixes the issue by adding a manual releasing pattern of the buffers
in DynamicBuffer.
Bug: angleproject:2505
Change-Id: I207ce4a694016766f008cca67d82b252f460e0df
Reviewed-on: https://chromium-review.googlesource.com/1052551
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Commit-Queue: Luc Ferron <lucferron@chromium.org>
diff --git a/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp b/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp
index 81919a7..5972339 100644
--- a/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp
+++ b/src/libANGLE/renderer/vulkan/VertexArrayVk.cpp
@@ -58,7 +58,6 @@
void VertexArrayVk::destroy(const gl::Context *context)
{
VkDevice device = vk::GetImpl(context)->getRenderer()->getDevice();
-
mDynamicVertexData.destroy(device);
mDynamicIndexData.destroy(device);
mLineLoopHelper.destroy(device);
@@ -108,6 +107,7 @@
}
ANGLE_TRY(mDynamicVertexData.flush(renderer->getDevice()));
+ mDynamicVertexData.releaseRetainedBuffers(renderer);
return gl::NoError();
}
@@ -139,7 +139,7 @@
memcpy(dst, drawCallParams.indices(), amount);
}
ANGLE_TRY(mDynamicIndexData.flush(renderer->getDevice()));
-
+ mDynamicIndexData.releaseRetainedBuffers(renderer);
mCurrentElementArrayBufferOffset = offset;
return gl::NoError();
}