John Reck f3ad324a8d Aggressively unbind GL_PIXEL_UNPACK_BUFFER
Bug: 27186019

Theory: It appears to be possible for FontRenderer
to not unbind its PBO prior to textures being uploaded,
resulting in trying to glSubTexImage2D with a bound
GL_PIXEL_UNPACK_BUFFER. In that scenario the void* is
the offset into the PBO which given a non-null data
will almost certainly overrun the end of the buffer. This
in turn produces a GL_INVALID_OPERATION error.

Change PixelBuffer to avoid leaking this state for now.
This will result in more calls to glBindBuffer/glUnbindBuffer
in the worst case, but the worst case is already bad so this
shouldn't be a problem. In the normal case we avoid binding
the PBO at all ever, so this doesn't impact that.

Change-Id: I05473f0d2f9a3a5da0e33d8f9ddea4731ce970e3
2016-02-24 15:40:05 -08:00

172 lines
5.2 KiB
C++

/*
* Copyright (C) 2013 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "PixelBuffer.h"
#include "Debug.h"
#include "Extensions.h"
#include "Properties.h"
#include "renderstate/RenderState.h"
#include "utils/GLUtils.h"
#include <utils/Log.h>
namespace android {
namespace uirenderer {
///////////////////////////////////////////////////////////////////////////////
// CPU pixel buffer
///////////////////////////////////////////////////////////////////////////////
class CpuPixelBuffer: public PixelBuffer {
public:
CpuPixelBuffer(GLenum format, uint32_t width, uint32_t height);
uint8_t* map(AccessMode mode = kAccessMode_ReadWrite) override;
uint8_t* getMappedPointer() const override;
void upload(uint32_t x, uint32_t y, uint32_t width, uint32_t height, int offset) override;
protected:
void unmap() override;
private:
std::unique_ptr<uint8_t[]> mBuffer;
};
CpuPixelBuffer::CpuPixelBuffer(GLenum format, uint32_t width, uint32_t height)
: PixelBuffer(format, width, height)
, mBuffer(new uint8_t[width * height * formatSize(format)]) {
}
uint8_t* CpuPixelBuffer::map(AccessMode mode) {
if (mAccessMode == kAccessMode_None) {
mAccessMode = mode;
}
return mBuffer.get();
}
void CpuPixelBuffer::unmap() {
mAccessMode = kAccessMode_None;
}
uint8_t* CpuPixelBuffer::getMappedPointer() const {
return mAccessMode == kAccessMode_None ? nullptr : mBuffer.get();
}
void CpuPixelBuffer::upload(uint32_t x, uint32_t y, uint32_t width, uint32_t height, int offset) {
glTexSubImage2D(GL_TEXTURE_2D, 0, x, y, width, height,
mFormat, GL_UNSIGNED_BYTE, &mBuffer[offset]);
}
///////////////////////////////////////////////////////////////////////////////
// GPU pixel buffer
///////////////////////////////////////////////////////////////////////////////
class GpuPixelBuffer: public PixelBuffer {
public:
GpuPixelBuffer(GLenum format, uint32_t width, uint32_t height);
~GpuPixelBuffer();
uint8_t* map(AccessMode mode = kAccessMode_ReadWrite) override;
uint8_t* getMappedPointer() const override;
void upload(uint32_t x, uint32_t y, uint32_t width, uint32_t height, int offset) override;
protected:
void unmap() override;
private:
GLuint mBuffer;
uint8_t* mMappedPointer;
Caches& mCaches;
};
GpuPixelBuffer::GpuPixelBuffer(GLenum format,
uint32_t width, uint32_t height)
: PixelBuffer(format, width, height)
, mMappedPointer(nullptr)
, mCaches(Caches::getInstance()){
glGenBuffers(1, &mBuffer);
mCaches.pixelBufferState().bind(mBuffer);
glBufferData(GL_PIXEL_UNPACK_BUFFER, getSize(), nullptr, GL_DYNAMIC_DRAW);
mCaches.pixelBufferState().unbind();
}
GpuPixelBuffer::~GpuPixelBuffer() {
glDeleteBuffers(1, &mBuffer);
}
uint8_t* GpuPixelBuffer::map(AccessMode mode) {
if (mAccessMode == kAccessMode_None) {
mCaches.pixelBufferState().bind(mBuffer);
mMappedPointer = (uint8_t*) glMapBufferRange(GL_PIXEL_UNPACK_BUFFER, 0, getSize(), mode);
if (CC_UNLIKELY(!mMappedPointer)) {
GLUtils::dumpGLErrors();
LOG_ALWAYS_FATAL("Failed to map PBO");
}
mAccessMode = mode;
mCaches.pixelBufferState().unbind();
}
return mMappedPointer;
}
void GpuPixelBuffer::unmap() {
if (mAccessMode != kAccessMode_None) {
if (mMappedPointer) {
mCaches.pixelBufferState().bind(mBuffer);
GLboolean status = glUnmapBuffer(GL_PIXEL_UNPACK_BUFFER);
if (status == GL_FALSE) {
ALOGE("Corrupted GPU pixel buffer");
}
}
mAccessMode = kAccessMode_None;
mMappedPointer = nullptr;
}
}
uint8_t* GpuPixelBuffer::getMappedPointer() const {
return mMappedPointer;
}
void GpuPixelBuffer::upload(uint32_t x, uint32_t y, uint32_t width, uint32_t height, int offset) {
// If the buffer is not mapped, unmap() will not bind it
mCaches.pixelBufferState().bind(mBuffer);
unmap();
glTexSubImage2D(GL_TEXTURE_2D, 0, x, y, width, height, mFormat,
GL_UNSIGNED_BYTE, reinterpret_cast<void*>(offset));
mCaches.pixelBufferState().unbind();
}
///////////////////////////////////////////////////////////////////////////////
// Factory
///////////////////////////////////////////////////////////////////////////////
PixelBuffer* PixelBuffer::create(GLenum format,
uint32_t width, uint32_t height, BufferType type) {
if (type == kBufferType_Auto && Caches::getInstance().gpuPixelBuffersEnabled) {
return new GpuPixelBuffer(format, width, height);
}
return new CpuPixelBuffer(format, width, height);
}
}; // namespace uirenderer
}; // namespace android