Upgrade Tex{Sub}Image{2|3}D to handle ES3 unpack parameters.

gpu/command_buffer/client/gles2_implementation.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // A class to emulate GLES2 over command buffers.
 
 #include "gpu/command_buffer/client/gles2_implementation.h"
 
 #include <GLES2/gl2.h>
 #include <GLES2/gl2ext.h>
@@ skipping 940 matching lines @@
     case GL_MINOR_VERSION:
       *params = capabilities_.minor_version;
       return true;
     case GL_NUM_EXTENSIONS:
       UpdateCachedExtensionsIfNeeded();
       *params = cached_extensions_.size();
       return true;
     case GL_NUM_PROGRAM_BINARY_FORMATS:
       *params = capabilities_.num_program_binary_formats;
       return true;
+    case GL_PACK_SKIP_PIXELS:
+      *params = pack_skip_pixels_;
+      return true;
+    case GL_PACK_SKIP_ROWS:
+      *params = pack_skip_rows_;
+      return true;
     case GL_PIXEL_PACK_BUFFER_BINDING:
       *params = bound_pixel_pack_buffer_;
       return true;
     case GL_PIXEL_UNPACK_BUFFER_BINDING:
       *params = bound_pixel_unpack_buffer_;
       return true;
     case GL_TRANSFORM_FEEDBACK_BUFFER_BINDING:
       *params = bound_transform_feedback_buffer_;
       return true;
     case GL_UNIFORM_BUFFER_BINDING:
       *params = bound_uniform_buffer_;
       return true;
     case GL_UNIFORM_BUFFER_OFFSET_ALIGNMENT:
       *params = capabilities_.uniform_buffer_offset_alignment;
       return true;
+    case GL_UNPACK_SKIP_IMAGES:
+      *params = unpack_skip_images_;
+      return true;
+    case GL_UNPACK_SKIP_PIXELS:
+      *params = unpack_skip_pixels_;
+      return true;
+    case GL_UNPACK_SKIP_ROWS:
+      *params = unpack_skip_rows_;
+      return true;
 
     // Non-cached ES3 parameters.
     case GL_DRAW_BUFFER0:
     case GL_DRAW_BUFFER1:
     case GL_DRAW_BUFFER2:
     case GL_DRAW_BUFFER3:
     case GL_DRAW_BUFFER4:
     case GL_DRAW_BUFFER5:
     case GL_DRAW_BUFFER6:
     case GL_DRAW_BUFFER7:
     case GL_DRAW_BUFFER8:
     case GL_DRAW_BUFFER9:
     case GL_DRAW_BUFFER10:
     case GL_DRAW_BUFFER11:
     case GL_DRAW_BUFFER12:
     case GL_DRAW_BUFFER13:
     case GL_DRAW_BUFFER14:
     case GL_DRAW_BUFFER15:
     case GL_DRAW_FRAMEBUFFER_BINDING:
     case GL_FRAGMENT_SHADER_DERIVATIVE_HINT:
     case GL_PACK_ROW_LENGTH:
-    case GL_PACK_SKIP_PIXELS:
-    case GL_PACK_SKIP_ROWS:
     case GL_PRIMITIVE_RESTART_FIXED_INDEX:
     case GL_PROGRAM_BINARY_FORMATS:
     case GL_RASTERIZER_DISCARD:
     case GL_READ_BUFFER:
     case GL_READ_FRAMEBUFFER_BINDING:
     case GL_SAMPLER_BINDING:
     case GL_TEXTURE_BINDING_2D_ARRAY:
     case GL_TEXTURE_BINDING_3D:
     case GL_TRANSFORM_FEEDBACK_BINDING:
     case GL_TRANSFORM_FEEDBACK_ACTIVE:
     case GL_TRANSFORM_FEEDBACK_PAUSED:
     case GL_TRANSFORM_FEEDBACK_BUFFER_SIZE:
     case GL_TRANSFORM_FEEDBACK_BUFFER_START:
     case GL_UNIFORM_BUFFER_SIZE:
     case GL_UNIFORM_BUFFER_START:
     case GL_UNPACK_IMAGE_HEIGHT:
     case GL_UNPACK_ROW_LENGTH:
-    case GL_UNPACK_SKIP_IMAGES:
-    case GL_UNPACK_SKIP_PIXELS:
-    case GL_UNPACK_SKIP_ROWS:
     case GL_VERTEX_ARRAY_BINDING:
       return false;
     default:
       return false;
   }
 }
 
 bool GLES2Implementation::GetBooleanvHelper(GLenum pname, GLboolean* params) {
   // TODO(gman): Make this handle pnames that return more than 1 value.
   GLint value;
@@ skipping 728 matching lines @@
       buffer.offset() + shader_id_size,
       length);
   CheckGLError();
 }
 
 void GLES2Implementation::PixelStorei(GLenum pname, GLint param) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glPixelStorei("
       << GLES2Util::GetStringPixelStore(pname) << ", "
       << param << ")");
+  // We have to validate before caching these parameters because we use them
+  // to compute image sizes on the client side.
+  switch (pname) {
+    case GL_PACK_ALIGNMENT:
+    case GL_UNPACK_ALIGNMENT:
+      if (param != 1 && param != 2 && param != 4 && param != 8) {
+        SetGLError(GL_INVALID_VALUE, "glPixelStorei", "invalid param");
+        return;
+      }
+      break;
+    case GL_PACK_ROW_LENGTH:
+    case GL_PACK_SKIP_PIXELS:
+    case GL_PACK_SKIP_ROWS:
+    case GL_UNPACK_IMAGE_HEIGHT:
+    case GL_UNPACK_SKIP_IMAGES:
+      if (capabilities_.major_version < 3) {
+        SetGLError(GL_INVALID_ENUM, "glPixelStorei", "invalid pname");
+        return;
+      }
+      if (param < 0) {
+        SetGLError(GL_INVALID_VALUE, "glPixelStorei", "invalid param");
+        return;
+      }
+      break;
+    case GL_UNPACK_ROW_LENGTH:
+    case GL_UNPACK_SKIP_ROWS:
+    case GL_UNPACK_SKIP_PIXELS:
+      // These parameters are always enabled in ES2 by EXT_unpack_subimage.
+      if (param < 0) {
+        SetGLError(GL_INVALID_VALUE, "glPixelStorei", "invalid param");
+        return;
+      }
+      break;
+    default:
+      SetGLError(GL_INVALID_ENUM, "glPixelStorei", "invalid pname");
+      return;
+  }
+  // Do not send SKIP parameters to the service side.
+  // Handle them on the client side.
   switch (pname) {
     case GL_PACK_ALIGNMENT:
       pack_alignment_ = param;
       break;
     case GL_PACK_ROW_LENGTH:
       pack_row_length_ = param;
       break;
     case GL_PACK_SKIP_PIXELS:
       pack_skip_pixels_ = param;
-      break;
+      return;
     case GL_PACK_SKIP_ROWS:
       pack_skip_rows_ = param;
-      break;
+      return;
     case GL_UNPACK_ALIGNMENT:
       unpack_alignment_ = param;
       break;
-    case GL_UNPACK_ROW_LENGTH_EXT:
+    case GL_UNPACK_ROW_LENGTH:
       unpack_row_length_ = param;
+      if (capabilities_.major_version < 3) {
+        // In ES2 with EXT_unpack_subimage, it's handled on the client side
+        // and there is no need to send it to the service side.
+        return;
+      }
       break;
     case GL_UNPACK_IMAGE_HEIGHT:
       unpack_image_height_ = param;
       break;
-    case GL_UNPACK_SKIP_ROWS_EXT:
+    case GL_UNPACK_SKIP_ROWS:
       unpack_skip_rows_ = param;
-      break;
-    case GL_UNPACK_SKIP_PIXELS_EXT:
+      return;
+    case GL_UNPACK_SKIP_PIXELS:
       unpack_skip_pixels_ = param;
-      break;
+      return;
     case GL_UNPACK_SKIP_IMAGES:
       unpack_skip_images_ = param;
-      break;
+      return;
     default:
+      NOTREACHED();
       break;
   }
   helper_->PixelStorei(pname, param);
   CheckGLError();
 }
 
 void GLES2Implementation::VertexAttribIPointer(
     GLuint index, GLint size, GLenum type, GLsizei stride, const void* ptr) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glVertexAttribIPointer("
@@ skipping 267 matching lines @@
   DCHECK(buffer_id);
   BufferTracker::Buffer* buffer = buffer_tracker_->GetBuffer(buffer_id);
   if (!buffer) {
     SetGLError(GL_INVALID_OPERATION, function_name, "invalid buffer");
     return NULL;
   }
   if (buffer->mapped()) {
     SetGLError(GL_INVALID_OPERATION, function_name, "buffer mapped");
     return NULL;
   }
-  if ((buffer->size() - offset) < static_cast<GLuint>(size)) {
+  base::CheckedNumeric<uint32_t> buffer_offset = buffer->shm_offset();
+  buffer_offset += offset;
+  if (!buffer_offset.IsValid()) {
+    SetGLError(GL_INVALID_VALUE, function_name, "offset to large");
+    return NULL;
+  }
+  base::CheckedNumeric<uint32_t> required_size = offset;
+  required_size += size;
+  if (!required_size.IsValid() ||
+      buffer->size() < required_size.ValueOrDefault(0)) {
     SetGLError(GL_INVALID_VALUE, function_name, "unpack size to large");
     return NULL;
   }
   return buffer;
 }
 
 void GLES2Implementation::CompressedTexImage2D(
     GLenum target, GLint level, GLenum internalformat, GLsizei width,
     GLsizei height, GLint border, GLsizei image_size, const void* data) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
@@ skipping 173 matching lines @@
                       uint32_t height,
                       uint32_t unpadded_row_size,
                       uint32_t pixels_padded_row_size,
                       void* buffer,
                       uint32_t buffer_padded_row_size) {
   if (height == 0)
     return;
   const int8_t* source = static_cast<const int8_t*>(pixels);
   int8_t* dest = static_cast<int8_t*>(buffer);
   if (pixels_padded_row_size != buffer_padded_row_size) {
-    // the last row is copied unpadded at the end
-    for (; height > 1; --height) {
-      memcpy(dest, source, buffer_padded_row_size);
+    for (uint32_t ii = 0; ii < height; ++ii) {
+      memcpy(dest, source, unpadded_row_size);
       dest += buffer_padded_row_size;
       source += pixels_padded_row_size;
     }
-    memcpy(dest, source, unpadded_row_size);
   } else {
     uint32_t size = (height - 1) * pixels_padded_row_size + unpadded_row_size;
     memcpy(dest, source, size);
   }
 }
 
 }  // anonymous namespace
 
+PixelStoreParams GLES2Implementation::GetUnpackParameters(Dimension dimension) {
+  PixelStoreParams params;
+  params.alignment = unpack_alignment_;
+  params.row_length = unpack_row_length_;
+  params.skip_pixels = unpack_skip_pixels_;
+  params.skip_rows = unpack_skip_rows_;
+  if (dimension == k3D) {
+    params.image_height = unpack_image_height_;
+    params.skip_images = unpack_skip_images_;
+  }
+  return params;
+}
+
 void GLES2Implementation::TexImage2D(
     GLenum target, GLint level, GLint internalformat, GLsizei width,
     GLsizei height, GLint border, GLenum format, GLenum type,
     const void* pixels) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glTexImage2D("
       << GLES2Util::GetStringTextureTarget(target) << ", "
       << level << ", "
       << GLES2Util::GetStringTextureInternalFormat(internalformat) << ", "
       << width << ", " << height << ", " << border << ", "
       << GLES2Util::GetStringTextureFormat(format) << ", "
       << GLES2Util::GetStringPixelType(type) << ", "
       << static_cast<const void*>(pixels) << ")");
   if (level < 0 || height < 0 || width < 0) {
     SetGLError(GL_INVALID_VALUE, "glTexImage2D", "dimension < 0");
     return;
   }
   if (border != 0) {
     SetGLError(GL_INVALID_VALUE, "glTexImage2D", "border != 0");
     return;
   }
   uint32_t size;
   uint32_t unpadded_row_size;
   uint32_t padded_row_size;
-  if (!GLES2Util::ComputeImageDataSizes(
-          width, height, 1, format, type, unpack_alignment_, &size,
-          &unpadded_row_size, &padded_row_size)) {
+  uint32_t skip_size;
+  PixelStoreParams params = GetUnpackParameters(k2D);
+  if (!GLES2Util::ComputeImageDataSizesES3(width, height, 1,
+                                           format, type,
+                                           params,
+                                           &size,
+                                           &unpadded_row_size,
+                                           &padded_row_size,
+                                           &skip_size,
+                                           nullptr)) {
     SetGLError(GL_INVALID_VALUE, "glTexImage2D", "image size too large");
     return;
   }
 
+  if (bound_pixel_unpack_buffer_) {
+    base::CheckedNumeric<uint32_t> offset = ToGLuint(pixels);
+    offset += skip_size;
+    if (!offset.IsValid()) {
+      SetGLError(GL_INVALID_VALUE, "glTexImage2D", "skip size too large");
+      return;
+    }
+    helper_->TexImage2D(
+        target, level, internalformat, width, height, format, type,
+        0, offset.ValueOrDefault(0));
+    CheckGLError();
+    return;
+  }
+
   // If there's a pixel unpack buffer bound use it when issuing TexImage2D.
   if (bound_pixel_unpack_transfer_buffer_id_) {
+    if (unpack_row_length_ > 0 || unpack_image_height_ > 0 ||
+        unpack_skip_pixels_ > 0 || unpack_skip_rows_ > 0 ||
+        unpack_skip_images_ > 0) {
+      SetGLError(GL_INVALID_OPERATION, "glTexImage2D",
+                 "No ES3 pack parameters with pixel unpack transfer buffer.");
+      return;
+    }
+    DCHECK_EQ(0u, skip_size);
     GLuint offset = ToGLuint(pixels);
     BufferTracker::Buffer* buffer = GetBoundPixelUnpackTransferBufferIfValid(
-        bound_pixel_unpack_transfer_buffer_id_,
-        "glTexImage2D", offset, size);
+        bound_pixel_unpack_transfer_buffer_id_, "glTexImage2D", offset, size);
     if (buffer && buffer->shm_id() != -1) {
       helper_->TexImage2D(
           target, level, internalformat, width, height, format, type,
           buffer->shm_id(), buffer->shm_offset() + offset);
       buffer->set_last_usage_token(helper_->InsertToken());
       CheckGLError();
     }
     return;
   }
 
   // If there's no data just issue TexImage2D
-  if (!pixels) {
+  if (!pixels || width == 0 || height == 0) {
     helper_->TexImage2D(
-       target, level, internalformat, width, height, format, type,
-       0, 0);
+       target, level, internalformat, width, height, format, type, 0, 0);
     CheckGLError();
     return;
   }
 
-  // compute the advance bytes per row for the src pixels
-  uint32_t src_padded_row_size;
-  if (unpack_row_length_ > 0) {
-    if (!GLES2Util::ComputeImagePaddedRowSize(
-        unpack_row_length_, format, type, unpack_alignment_,
-        &src_padded_row_size)) {
-      SetGLError(
-          GL_INVALID_VALUE, "glTexImage2D", "unpack row length too large");
+  // Compute the advance bytes per row on the service side.
+  // Note |size| is recomputed here if needed.
+  uint32_t service_padded_row_size;
+  if (unpack_row_length_ > 0 && unpack_row_length_ != width) {
+    // All parameters have been applied to the data that are sent to the
+    // service side except UNPACK_ALIGNMENT.
+    PixelStoreParams service_params;
+    service_params.alignment = unpack_alignment_;
+    if (!GLES2Util::ComputeImageDataSizesES3(width, height, 1,
+                                             format, type,
+                                             service_params,
+                                             &size,
+                                             nullptr,
+                                             &service_padded_row_size,
+                                             nullptr,
+                                             nullptr)) {
+      SetGLError(GL_INVALID_VALUE, "glTexImage2D", "image size too large");
       return;
     }
   } else {
-    src_padded_row_size = padded_row_size;
+    service_padded_row_size = padded_row_size;
   }
 
   // advance pixels pointer past the skip rows and skip pixels
-  pixels = reinterpret_cast<const int8_t*>(pixels) +
-           unpack_skip_rows_ * src_padded_row_size;
-  if (unpack_skip_pixels_) {
-    uint32_t group_size = GLES2Util::ComputeImageGroupSize(format, type);
-    pixels = reinterpret_cast<const int8_t*>(pixels) +
-             unpack_skip_pixels_ * group_size;
-  }
+  pixels = reinterpret_cast<const int8_t*>(pixels) + skip_size;
 
   // Check if we can send it all at once.
   int32_t shm_id = 0;
   uint32_t shm_offset = 0;
   void* buffer_pointer = nullptr;
 
   ScopedTransferBufferPtr transfer_alloc(size, helper_, transfer_buffer_);
   ScopedMappedMemoryPtr mapped_alloc(0, helper_, mapped_memory_.get());
 
   if (transfer_alloc.valid() && transfer_alloc.size() >= size) {
     shm_id = transfer_alloc.shm_id();
     shm_offset = transfer_alloc.offset();
     buffer_pointer = transfer_alloc.address();
   } else if (size < max_extra_transfer_buffer_size_) {
     mapped_alloc.Reset(size);
     if (mapped_alloc.valid()) {
       transfer_alloc.Discard();
 
       mapped_alloc.SetFlushAfterRelease(true);
       shm_id = mapped_alloc.shm_id();
       shm_offset = mapped_alloc.offset();
       buffer_pointer = mapped_alloc.address();
     }
   }
 
   if (buffer_pointer) {
     CopyRectToBuffer(
-        pixels, height, unpadded_row_size, src_padded_row_size,
-        buffer_pointer, padded_row_size);
+        pixels, height, unpadded_row_size, padded_row_size,
+        buffer_pointer, service_padded_row_size);
     helper_->TexImage2D(
         target, level, internalformat, width, height, format, type,
         shm_id, shm_offset);
     CheckGLError();
     return;
   }
 
   // No, so send it using TexSubImage2D.
   helper_->TexImage2D(
      target, level, internalformat, width, height, format, type,
      0, 0);
   TexSubImage2DImpl(
       target, level, 0, 0, width, height, format, type, unpadded_row_size,
-      pixels, src_padded_row_size, GL_TRUE, &transfer_alloc, padded_row_size);
+      pixels, padded_row_size, GL_TRUE, &transfer_alloc,
+      service_padded_row_size);
   CheckGLError();
 }
 
 void GLES2Implementation::TexImage3D(
     GLenum target, GLint level, GLint internalformat, GLsizei width,
     GLsizei height, GLsizei depth, GLint border, GLenum format, GLenum type,
     const void* pixels) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glTexImage3D("
       << GLES2Util::GetStringTextureTarget(target) << ", "
       << level << ", "
       << GLES2Util::GetStringTextureInternalFormat(internalformat) << ", "
       << width << ", " << height << ", " << depth << ", " << border << ", "
       << GLES2Util::GetStringTextureFormat(format) << ", "
       << GLES2Util::GetStringPixelType(type) << ", "
       << static_cast<const void*>(pixels) << ")");
   if (level < 0 || height < 0 || width < 0 || depth < 0) {
     SetGLError(GL_INVALID_VALUE, "glTexImage3D", "dimension < 0");
     return;
   }
   if (border != 0) {
     SetGLError(GL_INVALID_VALUE, "glTexImage3D", "border != 0");
     return;
   }
+
   uint32_t size;
   uint32_t unpadded_row_size;
   uint32_t padded_row_size;
-  if (!GLES2Util::ComputeImageDataSizes(
-          width, height, depth, format, type, unpack_alignment_, &size,
-          &unpadded_row_size, &padded_row_size)) {
+  uint32_t skip_size;
+  PixelStoreParams params = GetUnpackParameters(k3D);
+  if (!GLES2Util::ComputeImageDataSizesES3(width, height, depth,
+                                           format, type,
+                                           params,
+                                           &size,
+                                           &unpadded_row_size,
+                                           &padded_row_size,
+                                           &skip_size,
+                                           nullptr)) {
     SetGLError(GL_INVALID_VALUE, "glTexImage3D", "image size too large");
     return;
   }
 
+  if (bound_pixel_unpack_buffer_) {
+    base::CheckedNumeric<uint32_t> offset = ToGLuint(pixels);
+    offset += skip_size;
+    if (!offset.IsValid()) {
+      SetGLError(GL_INVALID_VALUE, "glTexImage3D", "skip size too large");
+      return;
+    }
+    helper_->TexImage3D(
+        target, level, internalformat, width, height, depth, format, type,
+        0, offset.ValueOrDefault(0));
+    CheckGLError();
+    return;
+  }
+
   // If there's a pixel unpack buffer bound use it when issuing TexImage3D.
   if (bound_pixel_unpack_transfer_buffer_id_) {
+    if (unpack_row_length_ > 0 || unpack_image_height_ > 0 ||
+        unpack_skip_pixels_ > 0 || unpack_skip_rows_ > 0 ||
+        unpack_skip_images_ > 0) {
+      SetGLError(GL_INVALID_OPERATION, "glTexImage3D",
+                 "No ES3 pack parameters with pixel unpack transfer buffer.");
+      return;
+    }
+    DCHECK_EQ(0u, skip_size);
     GLuint offset = ToGLuint(pixels);
     BufferTracker::Buffer* buffer = GetBoundPixelUnpackTransferBufferIfValid(
-        bound_pixel_unpack_transfer_buffer_id_,
-        "glTexImage3D", offset, size);
+        bound_pixel_unpack_transfer_buffer_id_, "glTexImage3D", offset, size);
     if (buffer && buffer->shm_id() != -1) {
       helper_->TexImage3D(
           target, level, internalformat, width, height, depth, format, type,
           buffer->shm_id(), buffer->shm_offset() + offset);
       buffer->set_last_usage_token(helper_->InsertToken());
       CheckGLError();
     }
     return;
   }
 
   // If there's no data just issue TexImage3D
-  if (!pixels) {
+  if (!pixels || width == 0 || height == 0 || depth == 0) {
     helper_->TexImage3D(
        target, level, internalformat, width, height, depth, format, type,
        0, 0);
     CheckGLError();
     return;
   }
 
-  // compute the advance bytes per row for the src pixels
-  uint32_t src_padded_row_size;
-  if (unpack_row_length_ > 0) {
-    if (!GLES2Util::ComputeImagePaddedRowSize(
-        unpack_row_length_, format, type, unpack_alignment_,
-        &src_padded_row_size)) {
-      SetGLError(
-          GL_INVALID_VALUE, "glTexImage3D", "unpack row length too large");
+  // Compute the advance bytes per row on the service side.
+  // Note |size| is recomputed here if needed.
+  uint32_t service_padded_row_size;
+  if ((unpack_row_length_ > 0 && unpack_row_length_ != width) ||
+      (unpack_image_height_ > 0 && unpack_image_height_ != height)) {
+    // All parameters have been applied to the data that are sent to the
+    // service side except UNPACK_ALIGNMENT.
+    PixelStoreParams service_params;
+    service_params.alignment = unpack_alignment_;
+    if (!GLES2Util::ComputeImageDataSizesES3(width, height, depth,
+                                             format, type,
+                                             service_params,
+                                             &size,
+                                             nullptr,
+                                             &service_padded_row_size,
+                                             nullptr,
+                                             nullptr)) {
+      SetGLError(GL_INVALID_VALUE, "glTexImage3D", "image size too large");
       return;
     }
   } else {
-    src_padded_row_size = padded_row_size;
+    service_padded_row_size = padded_row_size;
   }
   uint32_t src_height =
       unpack_image_height_ > 0 ? unpack_image_height_ : height;
 
   // advance pixels pointer past the skip images/rows/pixels
-  pixels = reinterpret_cast<const int8_t*>(pixels) +
-           unpack_skip_images_ * src_padded_row_size * src_height +
-           unpack_skip_rows_ * src_padded_row_size;
-  if (unpack_skip_pixels_) {
-    uint32_t group_size = GLES2Util::ComputeImageGroupSize(format, type);
-    pixels = reinterpret_cast<const int8_t*>(pixels) +
-             unpack_skip_pixels_ * group_size;
-  }
+  pixels = reinterpret_cast<const int8_t*>(pixels) + skip_size;
 
   // Check if we can send it all at once.
   int32_t shm_id = 0;
   uint32_t shm_offset = 0;
   void* buffer_pointer = nullptr;
 
   ScopedTransferBufferPtr transfer_alloc(size, helper_, transfer_buffer_);
   ScopedMappedMemoryPtr mapped_alloc(0, helper_, mapped_memory_.get());
 
   if (transfer_alloc.valid() && transfer_alloc.size() >= size) {
     shm_id = transfer_alloc.shm_id();
     shm_offset = transfer_alloc.offset();
     buffer_pointer = transfer_alloc.address();
   } else if (size < max_extra_transfer_buffer_size_) {
     mapped_alloc.Reset(size);
     if (mapped_alloc.valid()) {
       transfer_alloc.Discard();
 
       mapped_alloc.SetFlushAfterRelease(true);
       shm_id = mapped_alloc.shm_id();
       shm_offset = mapped_alloc.offset();
       buffer_pointer = mapped_alloc.address();
     }
   }
 
   if (buffer_pointer) {
     for (GLsizei z = 0; z < depth; ++z) {
-      // Only the last row of the last image is unpadded.
-      uint32_t src_unpadded_row_size =
-          (z == depth - 1) ? unpadded_row_size : src_padded_row_size;
       CopyRectToBuffer(
-          pixels, height, src_unpadded_row_size, src_padded_row_size,
-          buffer_pointer, padded_row_size);
+          pixels, height, unpadded_row_size, padded_row_size,
+          buffer_pointer, service_padded_row_size);
       pixels = reinterpret_cast<const int8_t*>(pixels) +
-               src_padded_row_size * src_height;
-      buffer_pointer =
-          reinterpret_cast<int8_t*>(buffer_pointer) + padded_row_size * height;
+               padded_row_size * src_height;
+      buffer_pointer = reinterpret_cast<int8_t*>(buffer_pointer) +
+                       service_padded_row_size * height;
     }
     helper_->TexImage3D(
         target, level, internalformat, width, height, depth, format, type,
         shm_id, shm_offset);
     CheckGLError();
     return;
   }
 
   // No, so send it using TexSubImage3D.
   helper_->TexImage3D(
      target, level, internalformat, width, height, depth, format, type,
      0, 0);
   TexSubImage3DImpl(
       target, level, 0, 0, 0, width, height, depth, format, type,
-      unpadded_row_size, pixels, src_padded_row_size, GL_TRUE, &transfer_alloc,
-      padded_row_size);
+      unpadded_row_size, pixels, padded_row_size, GL_TRUE, &transfer_alloc,
+      service_padded_row_size);
   CheckGLError();
 }
 
 void GLES2Implementation::TexSubImage2D(
     GLenum target, GLint level, GLint xoffset, GLint yoffset, GLsizei width,
     GLsizei height, GLenum format, GLenum type, const void* pixels) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glTexSubImage2D("
       << GLES2Util::GetStringTextureTarget(target) << ", "
       << level << ", "
       << xoffset << ", " << yoffset << ", "
       << width << ", " << height << ", "
       << GLES2Util::GetStringTextureFormat(format) << ", "
       << GLES2Util::GetStringPixelType(type) << ", "
       << static_cast<const void*>(pixels) << ")");
 
-  if (level < 0 || height < 0 || width < 0) {
+  if (level < 0 || height < 0 || width < 0 || xoffset < 0 || yoffset < 0) {
     SetGLError(GL_INVALID_VALUE, "glTexSubImage2D", "dimension < 0");
     return;
   }
-  if (height == 0 || width == 0) {
+
+  uint32_t size;
+  uint32_t unpadded_row_size;
+  uint32_t padded_row_size;
+  uint32_t skip_size;
+  PixelStoreParams params = GetUnpackParameters(k2D);
+  if (!GLES2Util::ComputeImageDataSizesES3(width, height, 1,
+                                           format, type,
+                                           params,
+                                           &size,
+                                           &unpadded_row_size,
+                                           &padded_row_size,
+                                           &skip_size,
+                                           nullptr)) {
+    SetGLError(GL_INVALID_VALUE, "glTexSubImage2D", "image size to large");
     return;
   }
 
-  uint32_t temp_size;
-  uint32_t unpadded_row_size;
-  uint32_t padded_row_size;
-  if (!GLES2Util::ComputeImageDataSizes(
-        width, height, 1, format, type, unpack_alignment_, &temp_size,
-        &unpadded_row_size, &padded_row_size)) {
-    SetGLError(GL_INVALID_VALUE, "glTexSubImage2D", "size to large");
+  if (bound_pixel_unpack_buffer_) {
+    base::CheckedNumeric<uint32_t> offset = ToGLuint(pixels);
+    offset += skip_size;
+    if (!offset.IsValid()) {
+      SetGLError(GL_INVALID_VALUE, "glTexSubImage2D", "skip size too large");
+      return;
+    }
+    helper_->TexSubImage2D(target, level, xoffset, yoffset, width, height,
+                           format, type, 0, offset.ValueOrDefault(0), false);
+    CheckGLError();
     return;
   }
 
   // If there's a pixel unpack buffer bound use it when issuing TexSubImage2D.
   if (bound_pixel_unpack_transfer_buffer_id_) {
+    if (unpack_row_length_ > 0 || unpack_image_height_ > 0 ||
+        unpack_skip_pixels_ > 0 || unpack_skip_rows_ > 0 ||
+        unpack_skip_images_ > 0) {
+      SetGLError(GL_INVALID_OPERATION, "glTexSubImage2D",
+                 "No ES3 pack parameters with pixel unpack transfer buffer.");
+      return;
+    }
+    DCHECK_EQ(0u, skip_size);
     GLuint offset = ToGLuint(pixels);
     BufferTracker::Buffer* buffer = GetBoundPixelUnpackTransferBufferIfValid(
         bound_pixel_unpack_transfer_buffer_id_,
-        "glTexSubImage2D", offset, temp_size);
+        "glTexSubImage2D", offset, size);
     if (buffer && buffer->shm_id() != -1) {
       helper_->TexSubImage2D(
           target, level, xoffset, yoffset, width, height, format, type,
           buffer->shm_id(), buffer->shm_offset() + offset, false);
       buffer->set_last_usage_token(helper_->InsertToken());
       CheckGLError();
     }
     return;
   }
 
-  // compute the advance bytes per row for the src pixels
-  uint32_t src_padded_row_size;
-  if (unpack_row_length_ > 0) {
-    if (!GLES2Util::ComputeImagePaddedRowSize(
-        unpack_row_length_, format, type, unpack_alignment_,
-        &src_padded_row_size)) {
-      SetGLError(
-          GL_INVALID_VALUE, "glTexImage2D", "unpack row length too large");
+  if (width == 0 || height == 0) {
+    // No need to worry about pixel data.
+    helper_->TexSubImage2D(target, level, xoffset, yoffset, width, height,
+                           format, type, 0, 0, false);
+    CheckGLError();
+    return;
+  }
+
+  // Compute the advance bytes per row on the service side.
+  // Note |size| is recomputed here if needed.
+  uint32_t service_padded_row_size;
+  if (unpack_row_length_ > 0 && unpack_row_length_ != width) {
+    // All parameters have been applied to the data that are sent to the
+    // service side except UNPACK_ALIGNMENT.
+    PixelStoreParams service_params;
+    service_params.alignment = unpack_alignment_;
+    if (!GLES2Util::ComputeImageDataSizesES3(width, height, 1,
+                                             format, type,
+                                             service_params,
+                                             &size,
+                                             nullptr,
+                                             &service_padded_row_size,
+                                             nullptr,
+                                             nullptr)) {
+      SetGLError(GL_INVALID_VALUE, "glTexSubImage2D", "image size too large");
       return;
     }
   } else {
-    src_padded_row_size = padded_row_size;
+    service_padded_row_size = padded_row_size;
   }
 
   // advance pixels pointer past the skip rows and skip pixels
-  pixels = reinterpret_cast<const int8_t*>(pixels) +
-           unpack_skip_rows_ * src_padded_row_size;
-  if (unpack_skip_pixels_) {
-    uint32_t group_size = GLES2Util::ComputeImageGroupSize(format, type);
-    pixels = reinterpret_cast<const int8_t*>(pixels) +
-             unpack_skip_pixels_ * group_size;
-  }
+  pixels = reinterpret_cast<const int8_t*>(pixels) + skip_size;
 
-  ScopedTransferBufferPtr buffer(temp_size, helper_, transfer_buffer_);
+  ScopedTransferBufferPtr buffer(size, helper_, transfer_buffer_);
   TexSubImage2DImpl(
       target, level, xoffset, yoffset, width, height, format, type,
-      unpadded_row_size, pixels, src_padded_row_size, GL_FALSE, &buffer,
-      padded_row_size);
+      unpadded_row_size, pixels, padded_row_size, GL_FALSE, &buffer,
+      service_padded_row_size);
   CheckGLError();
 }
 
 void GLES2Implementation::TexSubImage3D(
     GLenum target, GLint level, GLint xoffset, GLint yoffset, GLint zoffset,
     GLsizei width, GLsizei height, GLsizei depth, GLenum format, GLenum type,
     const void* pixels) {
   GPU_CLIENT_SINGLE_THREAD_CHECK();
   GPU_CLIENT_LOG("[" << GetLogPrefix() << "] glTexSubImage3D("
       << GLES2Util::GetStringTextureTarget(target) << ", "
       << level << ", "
       << xoffset << ", " << yoffset << ", " << zoffset << ", "
       << width << ", " << height << ", " << depth << ", "
       << GLES2Util::GetStringTextureFormat(format) << ", "
       << GLES2Util::GetStringPixelType(type) << ", "
       << static_cast<const void*>(pixels) << ")");
 
-  if (level < 0 || height < 0 || width < 0 || depth < 0) {
+  if (level < 0 || height < 0 || width < 0 || depth < 0 ||
+      xoffset < 0 || yoffset < 0 || zoffset < 0) {
     SetGLError(GL_INVALID_VALUE, "glTexSubImage3D", "dimension < 0");
     return;
   }
-  if (height == 0 || width == 0 || depth == 0) {
+
+  uint32_t size;
+  uint32_t unpadded_row_size;
+  uint32_t padded_row_size;
+  uint32_t skip_size;
+  PixelStoreParams params = GetUnpackParameters(k3D);
+  if (!GLES2Util::ComputeImageDataSizesES3(width, height, depth,
+                                           format, type,
+                                           params,
+                                           &size,
+                                           &unpadded_row_size,
+                                           &padded_row_size,
+                                           &skip_size,
+                                           nullptr)) {
+    SetGLError(GL_INVALID_VALUE, "glTexSubImage3D", "image size to large");
     return;
   }
 
-  uint32_t temp_size;
-  uint32_t unpadded_row_size;
-  uint32_t padded_row_size;
-  if (!GLES2Util::ComputeImageDataSizes(
-          width, height, depth, format, type, unpack_alignment_, &temp_size,
-          &unpadded_row_size, &padded_row_size)) {
-    SetGLError(GL_INVALID_VALUE, "glTexSubImage3D", "size to large");
+  if (bound_pixel_unpack_buffer_) {
+    base::CheckedNumeric<uint32_t> offset = ToGLuint(pixels);
+    offset += skip_size;
+    if (!offset.IsValid()) {
+      SetGLError(GL_INVALID_VALUE, "glTexSubImage3D", "skip size too large");
+      return;
+    }
+    helper_->TexSubImage3D(
+        target, level, xoffset, yoffset, zoffset, width, height, depth,
+        format, type, 0, offset.ValueOrDefault(0), false);
+    CheckGLError();
     return;
   }
 
   // If there's a pixel unpack buffer bound use it when issuing TexSubImage2D.
   if (bound_pixel_unpack_transfer_buffer_id_) {
+    if (unpack_row_length_ > 0 || unpack_image_height_ > 0 ||
+        unpack_skip_pixels_ > 0 || unpack_skip_rows_ > 0 ||
+        unpack_skip_images_ > 0) {
+      SetGLError(GL_INVALID_OPERATION, "glTexSubImage2D",
+                 "No ES3 pack parameters with pixel unpack transfer buffer.");
+      return;
+    }
+    DCHECK_EQ(0u, skip_size);
     GLuint offset = ToGLuint(pixels);
     BufferTracker::Buffer* buffer = GetBoundPixelUnpackTransferBufferIfValid(
         bound_pixel_unpack_transfer_buffer_id_,
-        "glTexSubImage3D", offset, temp_size);
+        "glTexSubImage3D", offset, size);
     if (buffer && buffer->shm_id() != -1) {
       helper_->TexSubImage3D(
           target, level, xoffset, yoffset, zoffset, width, height, depth,
           format, type, buffer->shm_id(), buffer->shm_offset() + offset, false);
       buffer->set_last_usage_token(helper_->InsertToken());
       CheckGLError();
     }
     return;
   }
 
-  // compute the advance bytes per row for the src pixels
-  uint32_t src_padded_row_size;
-  if (unpack_row_length_ > 0) {
-    if (!GLES2Util::ComputeImagePaddedRowSize(
-        unpack_row_length_, format, type, unpack_alignment_,
-        &src_padded_row_size)) {
-      SetGLError(
-          GL_INVALID_VALUE, "glTexImage3D", "unpack row length too large");
+  if (width == 0 || height == 0 || height == 0) {
+    // No need to worry about pixel data.
+    helper_->TexSubImage2D(target, level, xoffset, yoffset, width, height,
+                           format, type, 0, 0, false);
+    CheckGLError();
+    return;
+  }
+
+  // Compute the advance bytes per row on the service side
+  // Note |size| is recomputed here if needed.
+  uint32_t service_padded_row_size;
+  if ((unpack_row_length_ > 0 && unpack_row_length_ != width) ||
+      (unpack_image_height_ > 0 && unpack_image_height_ != height)) {
+    PixelStoreParams service_params;
+    service_params.alignment = unpack_alignment_;
+    if (!GLES2Util::ComputeImageDataSizesES3(width, height, depth,
+                                             format, type,
+                                             service_params,
+                                             &size,
+                                             nullptr,
+                                             &service_padded_row_size,
+                                             nullptr,
+                                             nullptr)) {
+      SetGLError(GL_INVALID_VALUE, "glTexSubImage3D", "image size too large");
       return;
     }
   } else {
-    src_padded_row_size = padded_row_size;
+    service_padded_row_size = padded_row_size;
   }
-  uint32_t src_height =
-      unpack_image_height_ > 0 ? unpack_image_height_ : height;
 
   // advance pixels pointer past the skip images/rows/pixels
-  pixels = reinterpret_cast<const int8_t*>(pixels) +
-           unpack_skip_images_ * src_padded_row_size * src_height +
-           unpack_skip_rows_ * src_padded_row_size;
-  if (unpack_skip_pixels_) {
-    uint32_t group_size = GLES2Util::ComputeImageGroupSize(format, type);
-    pixels = reinterpret_cast<const int8_t*>(pixels) +
-             unpack_skip_pixels_ * group_size;
-  }
+  pixels = reinterpret_cast<const int8_t*>(pixels) + skip_size;
 
-  ScopedTransferBufferPtr buffer(temp_size, helper_, transfer_buffer_);
+  ScopedTransferBufferPtr buffer(size, helper_, transfer_buffer_);
   TexSubImage3DImpl(
       target, level, xoffset, yoffset, zoffset, width, height, depth,
-      format, type, unpadded_row_size, pixels, src_padded_row_size, GL_FALSE,
-      &buffer, padded_row_size);
+      format, type, unpadded_row_size, pixels, padded_row_size, GL_FALSE,
+      &buffer, service_padded_row_size);
   CheckGLError();
 }
 
 static GLint ComputeNumRowsThatFitInBuffer(uint32_t padded_row_size,
                                            uint32_t unpadded_row_size,
                                            unsigned int size,
                                            GLsizei remaining_rows) {
   DCHECK_GE(unpadded_row_size, 0u);
   if (padded_row_size == 0) {
     return 1;
@@ skipping 17 matching lines @@
                                             uint32_t unpadded_row_size,
                                             const void* pixels,
                                             uint32_t pixels_padded_row_size,
                                             GLboolean internal,
                                             ScopedTransferBufferPtr* buffer,
                                             uint32_t buffer_padded_row_size) {
   DCHECK(buffer);
   DCHECK_GE(level, 0);
   DCHECK_GT(height, 0);
   DCHECK_GT(width, 0);
+  DCHECK_GE(xoffset, 0);
+  DCHECK_GE(yoffset, 0);
 
   const int8_t* source = reinterpret_cast<const int8_t*>(pixels);
   // Transfer by rows.
   while (height) {
     unsigned int desired_size =
         buffer_padded_row_size * (height - 1) + unpadded_row_size;
     if (!buffer->valid() || buffer->size() == 0) {
       buffer->Reset(desired_size);
       if (!buffer->valid()) {
         return;
@@ skipping 27 matching lines @@
                                             GLenum format,
                                             GLenum type,
                                             uint32_t unpadded_row_size,
                                             const void* pixels,
                                             uint32_t pixels_padded_row_size,
                                             GLboolean internal,
                                             ScopedTransferBufferPtr* buffer,
                                             uint32_t buffer_padded_row_size) {
   DCHECK(buffer);
   DCHECK_GE(level, 0);
+  DCHECK_GT(width, 0);
   DCHECK_GT(height, 0);
-  DCHECK_GT(width, 0);
   DCHECK_GT(depth, 0);
+  DCHECK_GE(xoffset, 0);
+  DCHECK_GE(yoffset, 0);
+  DCHECK_GE(zoffset, 0);
   const int8_t* source = reinterpret_cast<const int8_t*>(pixels);
   GLsizei total_rows = height * depth;
   GLint row_index = 0, depth_index = 0;
   while (total_rows) {
     // Each time, we either copy one or more images, or copy one or more rows
     // within a single image, depending on the buffer size limit.
     GLsizei max_rows;
     unsigned int desired_size;
     if (row_index > 0) {
       // We are in the middle of an image. Send the remaining of the image.
@@ skipping 31 matching lines @@
       my_depth = 1;
     }
 
     if (num_images > 0) {
       int8_t* buffer_pointer = reinterpret_cast<int8_t*>(buffer->address());
       uint32_t src_height =
           unpack_image_height_ > 0 ? unpack_image_height_ : height;
       uint32_t image_size_dst = buffer_padded_row_size * height;
       uint32_t image_size_src = pixels_padded_row_size * src_height;
       for (GLint ii = 0; ii < num_images; ++ii) {
-        uint32_t my_unpadded_row_size;
-        if (total_rows == num_rows && ii + 1 == num_images)
-          my_unpadded_row_size = unpadded_row_size;
-        else
-          my_unpadded_row_size = pixels_padded_row_size;
         CopyRectToBuffer(
-            source + ii * image_size_src, my_height, my_unpadded_row_size,
+            source + ii * image_size_src, my_height, unpadded_row_size,
             pixels_padded_row_size, buffer_pointer + ii * image_size_dst,
             buffer_padded_row_size);
       }
     } else {
-      uint32_t my_unpadded_row_size;
-      if (total_rows == num_rows)
-        my_unpadded_row_size = unpadded_row_size;
-      else
-        my_unpadded_row_size = pixels_padded_row_size;
       CopyRectToBuffer(
-          source, my_height, my_unpadded_row_size, pixels_padded_row_size,
+          source, my_height, unpadded_row_size, pixels_padded_row_size,
           buffer->address(), buffer_padded_row_size);
     }
     helper_->TexSubImage3D(
         target, level, xoffset, yoffset + row_index, zoffset + depth_index,
         width, my_height, my_depth,
         format, type, buffer->shm_id(), buffer->offset(), internal);
     buffer->Release();
 
     total_rows -= num_rows;
     if (total_rows > 0) {
@@ skipping 652 matching lines @@
       << xoffset << ", " << yoffset << ", "
       << width << ", " << height << ", "
       << GLES2Util::GetStringReadPixelFormat(format) << ", "
       << GLES2Util::GetStringPixelType(type) << ", "
       << static_cast<const void*>(pixels) << ")");
   if (width < 0 || height < 0) {
     SetGLError(GL_INVALID_VALUE, "glReadPixels", "dimensions < 0");
     return;
   }
 
-  // glReadPixel pads the size of each row of pixels by an amount specified by
-  // glPixelStorei. So, we have to take that into account both in the fact that
-  // the pixels returned from the ReadPixel command will include that padding
-  // and that when we copy the results to the user's buffer we need to not
-  // write those padding bytes but leave them as they are.
-
-  TRACE_EVENT0("gpu", "GLES2::ReadPixels");
-  typedef cmds::ReadPixels::Result Result;
-
-  if (bound_pixel_pack_buffer_) {
-    GLuint offset = ToGLuint(pixels);
-    helper_->ReadPixels(
-        xoffset, yoffset, width, height, format, type, 0, offset, 0, 0, false);
-    CheckGLError();
-    return;
-  }
-
   uint32_t size;
   uint32_t unpadded_row_size;
   uint32_t padded_row_size;
   uint32_t skip_size;
   PixelStoreParams params;
   params.alignment = pack_alignment_;
   params.row_length = pack_row_length_;
   params.skip_pixels = pack_skip_pixels_;
   params.skip_rows = pack_skip_rows_;
   if (!GLES2Util::ComputeImageDataSizesES3(width, height, 1,
                                            format, type,
                                            params,
                                            &size,
                                            &unpadded_row_size,
                                            &padded_row_size,
                                            &skip_size,
                                            nullptr)) {
     SetGLError(GL_INVALID_VALUE, "glReadPixels", "size too large.");
     return;
   }
+
+  // glReadPixel pads the size of each row of pixels by an amount specified by
+  // glPixelStorei. So, we have to take that into account both in the fact that
+  // the pixels returned from the ReadPixel command will include that padding
+  // and that when we copy the results to the user's buffer we need to not
+  // write those padding bytes but leave them as they are.
+
+  TRACE_EVENT0("gpu", "GLES2::ReadPixels");
+  typedef cmds::ReadPixels::Result Result;
+
+  if (bound_pixel_pack_buffer_) {
+    base::CheckedNumeric<uint32_t> offset = ToGLuint(pixels);
+    offset += skip_size;
+    if (!offset.IsValid()) {
+      SetGLError(GL_INVALID_VALUE, "glReadPixels", "skip size too large.");
+      return;
+    }
+    helper_->ReadPixels(
+        xoffset, yoffset, width, height, format, type, 0,
+        offset.ValueOrDefault(0), 0, 0, false);
+    CheckGLError();
+    return;
+  }
+
   uint32_t service_padded_row_size = 0;
   if (pack_row_length_ > 0 && pack_row_length_ != width) {
     if (!GLES2Util::ComputeImagePaddedRowSize(width,
                                               format, type,
                                               pack_alignment_,
                                               &service_padded_row_size)) {
       SetGLError(GL_INVALID_VALUE, "glReadPixels", "size too large.");
       return;
     }
   } else {
     service_padded_row_size = padded_row_size;
   }
 
   if (bound_pixel_pack_transfer_buffer_id_) {
     if (pack_row_length_ > 0 || pack_skip_pixels_ > 0 || pack_skip_rows_ > 0) {
       SetGLError(GL_INVALID_OPERATION, "glReadPixels",
                  "No ES3 pack parameters with pixel pack transfer buffer.");
       return;
     }
     DCHECK_EQ(0u, skip_size);
     GLuint offset = ToGLuint(pixels);
     BufferTracker::Buffer* buffer = GetBoundPixelUnpackTransferBufferIfValid(
         bound_pixel_pack_transfer_buffer_id_, "glReadPixels", offset, size);
     if (buffer && buffer->shm_id() != -1) {
       helper_->ReadPixels(xoffset, yoffset, width, height, format, type,
-                          buffer->shm_id(), buffer->shm_offset(),
+                          buffer->shm_id(), buffer->shm_offset() + offset,
                           0, 0, true);
       CheckGLError();
     }
     return;
   }
 
   if (!pixels) {
     SetGLError(GL_INVALID_OPERATION, "glReadPixels", "pixels = NULL");
     return;
   }
@@ skipping 2960 matching lines @@
   cached_extensions_.clear();
 }
 
 // Include the auto-generated part of this file. We split this because it means
 // we can easily edit the non-auto generated parts right here in this file
 // instead of having to edit some template or the code generator.
 #include "gpu/command_buffer/client/gles2_implementation_impl_autogen.h"
 
 }  // namespace gles2
 }  // namespace gpu