Command buffers: ensure we only read immediate data once

gpu/command_buffer/service/gles2_cmd_decoder.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
 
 #include <limits.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <stdio.h>
 
 #include <algorithm>
 #include <cmath>
 #include <list>
 #include <map>
 #include <memory>
 #include <queue>
 
 #include "base/callback.h"
 #include "base/callback_helpers.h"
 #include "base/logging.h"
+#include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/numerics/safe_math.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/trace_event/trace_event.h"
 #include "base/trace_event/trace_event_synthetic_delay.h"
 #include "build/build_config.h"
 #include "gpu/command_buffer/common/debug_marker_manager.h"
 #include "gpu/command_buffer/common/gles2_cmd_format.h"
 #include "gpu/command_buffer/common/gles2_cmd_utils.h"
@@ skipping 3835 matching lines @@
 bool GLES2DecoderImpl::DeletePathsCHROMIUMHelper(GLuint first_client_id,
                                                  GLsizei range) {
   GLuint last_client_id;
   if (!SafeAddUint32(first_client_id, range - 1, &last_client_id))
     return false;
 
   path_manager()->RemovePaths(first_client_id, last_client_id);
   return true;
 }
 
-void GLES2DecoderImpl::DeleteBuffersHelper(
-    GLsizei n, const GLuint* client_ids) {
+void GLES2DecoderImpl::DeleteBuffersHelper(GLsizei n,
+                                           const GLuint* client_ids) {
   for (GLsizei ii = 0; ii < n; ++ii) {
-    Buffer* buffer = GetBuffer(client_ids[ii]);
+    GLuint client_id = client_ids[ii];
+    Buffer* buffer = GetBuffer(client_id);
     if (buffer && !buffer->IsDeleted()) {
       buffer->RemoveMappedRange();
       state_.RemoveBoundBuffer(buffer);
       transform_feedback_manager_->RemoveBoundBuffer(buffer);
-      RemoveBuffer(client_ids[ii]);
+      RemoveBuffer(client_id);
     }
   }
 }
 
-void GLES2DecoderImpl::DeleteFramebuffersHelper(
-    GLsizei n, const GLuint* client_ids) {
+void GLES2DecoderImpl::DeleteFramebuffersHelper(GLsizei n,
+                                                const GLuint* client_ids) {
   bool supports_separate_framebuffer_binds =
      features().chromium_framebuffer_multisample;
 
   for (GLsizei ii = 0; ii < n; ++ii) {
-    Framebuffer* framebuffer =
-        GetFramebuffer(client_ids[ii]);
+    GLuint client_id = client_ids[ii];
+    Framebuffer* framebuffer = GetFramebuffer(client_id);
     if (framebuffer && !framebuffer->IsDeleted()) {
       if (framebuffer == framebuffer_state_.bound_draw_framebuffer.get()) {
         GLenum target = supports_separate_framebuffer_binds ?
             GL_DRAW_FRAMEBUFFER_EXT : GL_FRAMEBUFFER;
 
         // Unbind attachments on FBO before deletion.
         if (workarounds().unbind_attachments_on_bound_render_fbo_delete)
           framebuffer->DoUnbindGLAttachmentsForWorkaround(target);
 
         glBindFramebufferEXT(target, GetBackbufferServiceId());
         framebuffer_state_.bound_draw_framebuffer = NULL;
         framebuffer_state_.clear_state_dirty = true;
       }
       if (framebuffer == framebuffer_state_.bound_read_framebuffer.get()) {
         framebuffer_state_.bound_read_framebuffer = NULL;
         GLenum target = supports_separate_framebuffer_binds ?
             GL_READ_FRAMEBUFFER_EXT : GL_FRAMEBUFFER;
         glBindFramebufferEXT(target, GetBackbufferServiceId());
       }
       OnFboChanged();
-      RemoveFramebuffer(client_ids[ii]);
+      RemoveFramebuffer(client_id);
     }
   }
 }
 
-void GLES2DecoderImpl::DeleteRenderbuffersHelper(
-    GLsizei n, const GLuint* client_ids) {
+void GLES2DecoderImpl::DeleteRenderbuffersHelper(GLsizei n,
+                                                 const GLuint* client_ids) {
   bool supports_separate_framebuffer_binds =
      features().chromium_framebuffer_multisample;
   for (GLsizei ii = 0; ii < n; ++ii) {
-    Renderbuffer* renderbuffer =
-        GetRenderbuffer(client_ids[ii]);
+    GLuint client_id = client_ids[ii];
+    Renderbuffer* renderbuffer = GetRenderbuffer(client_id);
     if (renderbuffer && !renderbuffer->IsDeleted()) {
       if (state_.bound_renderbuffer.get() == renderbuffer) {
         state_.bound_renderbuffer = NULL;
       }
       // Unbind from current framebuffers.
       if (supports_separate_framebuffer_binds) {
         if (framebuffer_state_.bound_read_framebuffer.get()) {
           framebuffer_state_.bound_read_framebuffer
               ->UnbindRenderbuffer(GL_READ_FRAMEBUFFER_EXT, renderbuffer);
         }
         if (framebuffer_state_.bound_draw_framebuffer.get()) {
           framebuffer_state_.bound_draw_framebuffer
               ->UnbindRenderbuffer(GL_DRAW_FRAMEBUFFER_EXT, renderbuffer);
         }
       } else {
         if (framebuffer_state_.bound_draw_framebuffer.get()) {
           framebuffer_state_.bound_draw_framebuffer
               ->UnbindRenderbuffer(GL_FRAMEBUFFER, renderbuffer);
         }
       }
       framebuffer_state_.clear_state_dirty = true;
-      RemoveRenderbuffer(client_ids[ii]);
+      RemoveRenderbuffer(client_id);
     }
   }
 }
 
-void GLES2DecoderImpl::DeleteTexturesHelper(
-    GLsizei n, const GLuint* client_ids) {
+void GLES2DecoderImpl::DeleteTexturesHelper(GLsizei n,
+                                            const GLuint* client_ids) {
   bool supports_separate_framebuffer_binds =
      features().chromium_framebuffer_multisample;
   for (GLsizei ii = 0; ii < n; ++ii) {
-    TextureRef* texture_ref = GetTexture(client_ids[ii]);
+    GLuint client_id = client_ids[ii];
+    TextureRef* texture_ref = GetTexture(client_id);
     if (texture_ref) {
       Texture* texture = texture_ref->texture();
       if (texture->IsAttachedToFramebuffer()) {
         framebuffer_state_.clear_state_dirty = true;
       }
       // Unbind texture_ref from texture_ref units.
       state_.UnbindTexture(texture_ref);
 
       // Unbind from current framebuffers.
       if (supports_separate_framebuffer_binds) {
         if (framebuffer_state_.bound_read_framebuffer.get()) {
           framebuffer_state_.bound_read_framebuffer
               ->UnbindTexture(GL_READ_FRAMEBUFFER_EXT, texture_ref);
         }
         if (framebuffer_state_.bound_draw_framebuffer.get()) {
           framebuffer_state_.bound_draw_framebuffer
               ->UnbindTexture(GL_DRAW_FRAMEBUFFER_EXT, texture_ref);
         }
       } else {
         if (framebuffer_state_.bound_draw_framebuffer.get()) {
           framebuffer_state_.bound_draw_framebuffer
               ->UnbindTexture(GL_FRAMEBUFFER, texture_ref);
         }
       }
-      RemoveTexture(client_ids[ii]);
+      RemoveTexture(client_id);
     }
   }
 }
 
-void GLES2DecoderImpl::DeleteSamplersHelper(
-    GLsizei n, const GLuint* client_ids) {
+void GLES2DecoderImpl::DeleteSamplersHelper(GLsizei n,
+                                            const GLuint* client_ids) {
   for (GLsizei ii = 0; ii < n; ++ii) {
-    Sampler* sampler = GetSampler(client_ids[ii]);
+    GLuint client_id = client_ids[ii];
+    Sampler* sampler = GetSampler(client_id);
     if (sampler && !sampler->IsDeleted()) {
       // Unbind from current sampler units.
       state_.UnbindSampler(sampler);
 
-      RemoveSampler(client_ids[ii]);
+      RemoveSampler(client_id);
     }
   }
 }
 
 void GLES2DecoderImpl::DeleteTransformFeedbacksHelper(
-    GLsizei n, const GLuint* client_ids) {
+    GLsizei n,
+    const GLuint* client_ids) {
   for (GLsizei ii = 0; ii < n; ++ii) {
-    TransformFeedback* transform_feedback = GetTransformFeedback(
-        client_ids[ii]);
+    GLuint client_id = client_ids[ii];
+    TransformFeedback* transform_feedback = GetTransformFeedback(client_id);
     if (transform_feedback) {
       if (transform_feedback->active()) {
         LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION, "glDeleteTransformFeedbacks",
                            "Deleting transform feedback is active");
         return;
       }
       if (state_.bound_transform_feedback.get() == transform_feedback) {
         // Bind to the default transform feedback.
         DCHECK(state_.default_transform_feedback.get());
         state_.default_transform_feedback->DoBindTransformFeedback(
             GL_TRANSFORM_FEEDBACK);
         state_.bound_transform_feedback =
             state_.default_transform_feedback.get();
       }
-      RemoveTransformFeedback(client_ids[ii]);
+      RemoveTransformFeedback(client_id);
     }
   }
 }
 
 void GLES2DecoderImpl::DeleteSyncHelper(GLuint sync) {
   GLsync service_id = 0;
   if (group_->GetSyncServiceId(sync, &service_id)) {
     glDeleteSync(service_id);
     group_->RemoveSyncId(sync);
   } else if (sync != 0) {
@@ skipping 1650 matching lines @@
     if (index != 0 || gl_version_info().BehavesLikeGLES()) {
       glDisableVertexAttribArray(index);
     }
   } else {
     LOCAL_SET_GL_ERROR(
         GL_INVALID_VALUE,
         "glDisableVertexAttribArray", "index out of range");
   }
 }
 
-void GLES2DecoderImpl::InvalidateFramebufferImpl(
-    GLenum target, GLsizei count, const GLenum* attachments,
-    GLint x, GLint y, GLsizei width, GLsizei height,
-    const char* function_name, FramebufferOperation op) {
+void GLES2DecoderImpl::InvalidateFramebufferImpl(GLenum target,
+                                                 GLsizei count,
+                                                 const GLenum* attachments,
+                                                 GLint x,
+                                                 GLint y,
+                                                 GLsizei width,
+                                                 GLsizei height,
+                                                 const char* function_name,
+                                                 FramebufferOperation op) {
   Framebuffer* framebuffer = GetFramebufferInfoForTarget(GL_FRAMEBUFFER);
 
   // Because of performance issues, no-op if the format of the attachment is
   // DEPTH_STENCIL and only one part is intended to be invalidated.
   bool has_depth_stencil_format = framebuffer &&
       framebuffer->HasDepthStencilFormatAttachment();
   bool invalidate_depth = false;
   bool invalidate_stencil = false;
   std::unique_ptr<GLenum[]> validated_attachments(new GLenum[count]);
   GLsizei validated_count = 0;
 
   // Validates the attachments. If one of them fails, the whole command fails.
   GLenum thresh0 = GL_COLOR_ATTACHMENT0 + group_->max_color_attachments();
   GLenum thresh1 = GL_COLOR_ATTACHMENT15;
   for (GLsizei i = 0; i < count; ++i) {
+    GLenum attachment = attachments[i];
     if (framebuffer) {
-      if (attachments[i] >= thresh0 && attachments[i] <= thresh1) {
+      if (attachment >= thresh0 && attachment <= thresh1) {
         LOCAL_SET_GL_ERROR(
             GL_INVALID_OPERATION, function_name, "invalid attachment");
         return;
       }
-      if (!validators_->attachment.IsValid(attachments[i])) {
-        LOCAL_SET_GL_ERROR_INVALID_ENUM(
-            function_name, attachments[i], "attachments");
+      if (!validators_->attachment.IsValid(attachment)) {
+        LOCAL_SET_GL_ERROR_INVALID_ENUM(function_name, attachment,
+                                        "attachments");
         return;
       }
       if (has_depth_stencil_format) {
-        switch(attachments[i]) {
+        switch (attachment) {
           case GL_DEPTH_ATTACHMENT:
             invalidate_depth = true;
             continue;
           case GL_STENCIL_ATTACHMENT:
             invalidate_stencil = true;
             continue;
           case GL_DEPTH_STENCIL_ATTACHMENT:
             invalidate_depth = true;
             invalidate_stencil = true;
             continue;
         }
       }
     } else {
-      if (!validators_->backbuffer_attachment.IsValid(attachments[i])) {
-        LOCAL_SET_GL_ERROR_INVALID_ENUM(
-            function_name, attachments[i], "attachments");
+      if (!validators_->backbuffer_attachment.IsValid(attachment)) {
+        LOCAL_SET_GL_ERROR_INVALID_ENUM(function_name, attachment,
+                                        "attachments");
         return;
       }
     }
-    validated_attachments[validated_count++] = attachments[i];
+    validated_attachments[validated_count++] = attachment;
   }
   if (invalidate_depth && invalidate_stencil) {
     validated_attachments[validated_count++] = GL_DEPTH_STENCIL_ATTACHMENT;
   }
 
   // If the default framebuffer is bound but we are still rendering to an
   // FBO, translate attachment names that refer to default framebuffer
   // channels to corresponding framebuffer attachments.
   std::unique_ptr<GLenum[]> translated_attachments(new GLenum[validated_count]);
   for (GLsizei i = 0; i < validated_count; ++i) {
@@ skipping 2482 matching lines @@
   }
   if (!state_.current_program->SetSamplers(
       state_.texture_units.size(), fake_location, 1, &v0)) {
     LOCAL_SET_GL_ERROR(
         GL_INVALID_VALUE, "glUniform1i", "texture unit out of range");
     return;
   }
   glUniform1i(real_location, v0);
 }
 
-void GLES2DecoderImpl::DoUniform1iv(
-    GLint fake_location, GLsizei count, const GLint *value) {
+void GLES2DecoderImpl::DoUniform1iv(GLint fake_location,
+                                    GLsizei count,
+                                    const GLint* values) {
   GLenum type = 0;
   GLint real_location = -1;
   if (!PrepForSetUniformByLocation(fake_location,
                                    "glUniform1iv",
                                    Program::kUniform1i,
                                    &real_location,
                                    &type,
                                    &count)) {
     return;
   }
+  auto values_copy = base::MakeUnique<GLint[]>(count);
+  GLint* safe_values = values_copy.get();
+  std::copy(values, values + count, safe_values);
   if (type == GL_SAMPLER_2D || type == GL_SAMPLER_2D_RECT_ARB ||
       type == GL_SAMPLER_CUBE || type == GL_SAMPLER_EXTERNAL_OES) {
     if (!state_.current_program->SetSamplers(
-          state_.texture_units.size(), fake_location, count, value)) {
+            state_.texture_units.size(), fake_location, count, safe_values)) {
       LOCAL_SET_GL_ERROR(
           GL_INVALID_VALUE, "glUniform1iv", "texture unit out of range");
       return;
     }
   }
-  glUniform1iv(real_location, count, value);
+  glUniform1iv(real_location, count, safe_values);
 }
 
 void GLES2DecoderImpl::DoUniform1uiv(
     GLint fake_location, GLsizei count, const GLuint *value) {
   GLenum type = 0;
   GLint real_location = -1;
   if (!PrepForSetUniformByLocation(fake_location,
                                    "glUniform1uiv",
                                    Program::kUniform1ui,
                                    &real_location,
@@ skipping 1710 matching lines @@
         index, SHADER_VARIABLE_FLOAT);
     glVertexAttrib4f(index, v0, v1, v2, v3);
   }
 }
 
 void GLES2DecoderImpl::DoVertexAttrib1fv(GLuint index, const GLfloat* v) {
   GLfloat t[4] = { v[0], 0.0f, 0.0f, 1.0f, };
   if (SetVertexAttribValue("glVertexAttrib1fv", index, t)) {
     state_.SetGenericVertexAttribBaseType(
         index, SHADER_VARIABLE_FLOAT);
-    glVertexAttrib1fv(index, v);
+    glVertexAttrib1fv(index, t);
   }
 }
 
 void GLES2DecoderImpl::DoVertexAttrib2fv(GLuint index, const GLfloat* v) {
   GLfloat t[4] = { v[0], v[1], 0.0f, 1.0f, };
   if (SetVertexAttribValue("glVertexAttrib2fv", index, t)) {
     state_.SetGenericVertexAttribBaseType(
         index, SHADER_VARIABLE_FLOAT);
-    glVertexAttrib2fv(index, v);
+    glVertexAttrib2fv(index, t);
   }
 }
 
 void GLES2DecoderImpl::DoVertexAttrib3fv(GLuint index, const GLfloat* v) {
   GLfloat t[4] = { v[0], v[1], v[2], 1.0f, };
   if (SetVertexAttribValue("glVertexAttrib3fv", index, t)) {
     state_.SetGenericVertexAttribBaseType(
         index, SHADER_VARIABLE_FLOAT);
-    glVertexAttrib3fv(index, v);
+    glVertexAttrib3fv(index, t);
   }
 }
 
 void GLES2DecoderImpl::DoVertexAttrib4fv(GLuint index, const GLfloat* v) {
-  if (SetVertexAttribValue("glVertexAttrib4fv", index, v)) {
+  GLfloat t[4] = {v[0], v[1], v[2], v[3]};
+  if (SetVertexAttribValue("glVertexAttrib4fv", index, t)) {
     state_.SetGenericVertexAttribBaseType(
         index, SHADER_VARIABLE_FLOAT);
-    glVertexAttrib4fv(index, v);
+    glVertexAttrib4fv(index, t);
   }
 }
 
 void GLES2DecoderImpl::DoVertexAttribI4i(
     GLuint index, GLint v0, GLint v1, GLint v2, GLint v3) {
   GLint v[4] = { v0, v1, v2, v3 };
   if (SetVertexAttribValue("glVertexAttribI4i", index, v)) {
     state_.SetGenericVertexAttribBaseType(
         index, SHADER_VARIABLE_INT);
     glVertexAttribI4i(index, v0, v1, v2, v3);
   }
 }
 
 void GLES2DecoderImpl::DoVertexAttribI4iv(GLuint index, const GLint* v) {
-  if (SetVertexAttribValue("glVertexAttribI4iv", index, v)) {
+  GLint t[4] = {v[0], v[1], v[2], v[3]};
+  if (SetVertexAttribValue("glVertexAttribI4iv", index, t)) {
     state_.SetGenericVertexAttribBaseType(
         index, SHADER_VARIABLE_INT);
-    glVertexAttribI4iv(index, v);
+    glVertexAttribI4iv(index, t);
   }
 }
 
 void GLES2DecoderImpl::DoVertexAttribI4ui(
     GLuint index, GLuint v0, GLuint v1, GLuint v2, GLuint v3) {
   GLuint v[4] = { v0, v1, v2, v3 };
   if (SetVertexAttribValue("glVertexAttribI4ui", index, v)) {
     state_.SetGenericVertexAttribBaseType(
         index, SHADER_VARIABLE_UINT);
     glVertexAttribI4ui(index, v0, v1, v2, v3);
   }
 }
 
 void GLES2DecoderImpl::DoVertexAttribI4uiv(GLuint index, const GLuint* v) {
-  if (SetVertexAttribValue("glVertexAttribI4uiv", index, v)) {
+  GLuint t[4] = {v[0], v[1], v[2], v[3]};
+  if (SetVertexAttribValue("glVertexAttribI4uiv", index, t)) {
     state_.SetGenericVertexAttribBaseType(
         index, SHADER_VARIABLE_UINT);
-    glVertexAttribI4uiv(index, v);
+    glVertexAttribI4uiv(index, t);
   }
 }
 
 error::Error GLES2DecoderImpl::HandleVertexAttribIPointer(
     uint32_t immediate_data_size,
     const void* cmd_data) {
   if (!unsafe_es3_apis_enabled())
     return error::kUnknownCommand;
   const gles2::cmds::VertexAttribIPointer& c =
       *static_cast<const gles2::cmds::VertexAttribIPointer*>(cmd_data);
@@ skipping 4518 matching lines @@
     GLsizei n, const GLuint* client_ids) {
   for (GLsizei ii = 0; ii < n; ++ii) {
     if (query_manager_->IsValidQuery(client_ids[ii])) {
       return false;
     }
   }
   query_manager_->GenQueries(n, client_ids);
   return true;
 }
 
-void GLES2DecoderImpl::DeleteQueriesEXTHelper(
-    GLsizei n, const GLuint* client_ids) {
+void GLES2DecoderImpl::DeleteQueriesEXTHelper(GLsizei n,
+                                              const GLuint* client_ids) {
   for (GLsizei ii = 0; ii < n; ++ii) {
-    query_manager_->RemoveQuery(client_ids[ii]);
+    GLuint client_id = client_ids[ii];
+    query_manager_->RemoveQuery(client_id);
   }
 }
 
 bool GLES2DecoderImpl::HasPendingQueries() const {
   return query_manager_.get() && query_manager_->HavePendingQueries();
 }
 
 void GLES2DecoderImpl::ProcessPendingQueries(bool did_finish) {
   if (!query_manager_.get())
     return;
@@ skipping 250 matching lines @@
 
     glGenVertexArraysOES(n, service_ids.get());
     for (GLsizei ii = 0; ii < n; ++ii) {
       CreateVertexAttribManager(client_ids[ii], service_ids[ii], true);
     }
   }
 
   return true;
 }
 
-void GLES2DecoderImpl::DeleteVertexArraysOESHelper(
-    GLsizei n, const GLuint* client_ids) {
+void GLES2DecoderImpl::DeleteVertexArraysOESHelper(GLsizei n,
+                                                   const GLuint* client_ids) {
   for (GLsizei ii = 0; ii < n; ++ii) {
-    VertexAttribManager* vao =
-        GetVertexAttribManager(client_ids[ii]);
+    GLuint client_id = client_ids[ii];
+    VertexAttribManager* vao = GetVertexAttribManager(client_id);
     if (vao && !vao->IsDeleted()) {
       if (state_.vertex_attrib_manager.get() == vao) {
         DoBindVertexArrayOES(0);
       }
-      RemoveVertexAttribManager(client_ids[ii]);
+      RemoveVertexAttribManager(client_id);
     }
   }
 }
 
 void GLES2DecoderImpl::DoBindVertexArrayOES(GLuint client_id) {
   VertexAttribManager* vao = NULL;
   if (client_id != 0) {
     vao = GetVertexAttribManager(client_id);
     if (!vao) {
       // Unlike most Bind* methods, the spec explicitly states that VertexArray
@@ skipping 887 matching lines @@
 
   ProduceTextureRef("glProduceTextureDirectCHROMIUM", !client_id,
                     GetTexture(client_id), target, data);
 }
 
 void GLES2DecoderImpl::ProduceTextureRef(const char* func_name,
                                          bool clear,
                                          TextureRef* texture_ref,
                                          GLenum target,
                                          const GLbyte* data) {
-  const Mailbox mailbox = *reinterpret_cast<const Mailbox*>(data);
+  Mailbox mailbox = *reinterpret_cast<const Mailbox*>(data);
   DLOG_IF(ERROR, !mailbox.Verify()) << func_name << " was passed a "
                                        "mailbox that was not generated by "
                                        "GenMailboxCHROMIUM.";
 
   if (clear) {
     DCHECK(!texture_ref);
 
     group_->mailbox_manager()->ProduceTexture(mailbox, nullptr);
     return;
   }
@@ skipping 18 matching lines @@
   }
 
   group_->mailbox_manager()->ProduceTexture(mailbox, produced);
 }
 
 void GLES2DecoderImpl::DoConsumeTextureCHROMIUM(GLenum target,
                                                 const GLbyte* data) {
   TRACE_EVENT2("gpu", "GLES2DecoderImpl::DoConsumeTextureCHROMIUM",
       "context", logger_.GetLogPrefix(),
       "mailbox[0]", static_cast<unsigned char>(data[0]));
-  const Mailbox& mailbox = *reinterpret_cast<const Mailbox*>(data);
+  Mailbox mailbox = *reinterpret_cast<const Mailbox*>(data);
   DLOG_IF(ERROR, !mailbox.Verify()) << "ConsumeTextureCHROMIUM was passed a "
                                        "mailbox that was not generated by "
                                        "GenMailboxCHROMIUM.";
 
   scoped_refptr<TextureRef> texture_ref =
       texture_manager()->GetTextureInfoForTargetUnlessDefault(&state_, target);
   if (!texture_ref.get()) {
     LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION,
                        "glConsumeTextureCHROMIUM",
                        "unknown texture for target");
@@ skipping 43 matching lines @@
     RestoreCurrentTextureBindings(&state_, target);
   }
 }
 
 void GLES2DecoderImpl::DoCreateAndConsumeTextureINTERNAL(GLenum target,
                                                          GLuint client_id,
                                                          const GLbyte* data) {
   TRACE_EVENT2("gpu", "GLES2DecoderImpl::DoCreateAndConsumeTextureINTERNAL",
       "context", logger_.GetLogPrefix(),
       "mailbox[0]", static_cast<unsigned char>(data[0]));
-  const Mailbox& mailbox = *reinterpret_cast<const Mailbox*>(data);
+  Mailbox mailbox = *reinterpret_cast<const Mailbox*>(data);
   DLOG_IF(ERROR, !mailbox.Verify()) << "CreateAndConsumeTextureCHROMIUM was "
                                        "passed a mailbox that was not "
                                        "generated by GenMailboxCHROMIUM.";
 
   TextureRef* texture_ref = GetTexture(client_id);
   if (texture_ref) {
     // No need to call EnsureTextureForClientId here, the client_id already has
     // an associated texture.
     LOCAL_SET_GL_ERROR(
         GL_INVALID_OPERATION,
@@ skipping 189 matching lines @@
   debug_marker_manager_.PopGroup();
   if (!gpu_tracer_->End(kTraceCHROMIUM)) {
     LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION,
                        "glTraceEndCHROMIUM", "no trace begin found");
     return;
   }
 }
 
 void GLES2DecoderImpl::DoDrawBuffersEXT(
     GLsizei count, const GLenum* bufs) {
+  DCHECK_LE(group_->max_draw_buffers(), 16u);
   if (count > static_cast<GLsizei>(group_->max_draw_buffers())) {
     LOCAL_SET_GL_ERROR(
         GL_INVALID_VALUE,
         "glDrawBuffersEXT", "greater than GL_MAX_DRAW_BUFFERS_EXT");
     return;
   }
 
   Framebuffer* framebuffer = GetFramebufferInfoForTarget(GL_FRAMEBUFFER);
   if (framebuffer) {
+    GLenum safe_bufs[16];
     for (GLsizei i = 0; i < count; ++i) {
-      if (bufs[i] != static_cast<GLenum>(GL_COLOR_ATTACHMENT0 + i) &&
-          bufs[i] != GL_NONE) {
+      GLenum buf = bufs[i];
+      if (buf != static_cast<GLenum>(GL_COLOR_ATTACHMENT0 + i) &&
+          buf != GL_NONE) {
         LOCAL_SET_GL_ERROR(
             GL_INVALID_OPERATION,
             "glDrawBuffersEXT",
             "bufs[i] not GL_NONE or GL_COLOR_ATTACHMENTi_EXT");
         return;
       }
+      safe_bufs[i] = buf;
     }
-    glDrawBuffersARB(count, bufs);
-    framebuffer->SetDrawBuffers(count, bufs);
+    glDrawBuffersARB(count, safe_bufs);
+    framebuffer->SetDrawBuffers(count, safe_bufs);
   } else {  // backbuffer
-    if (count != 1 ||
-        (bufs[0] != GL_BACK && bufs[0] != GL_NONE)) {
-      LOCAL_SET_GL_ERROR(
-          GL_INVALID_OPERATION,
-          "glDrawBuffersEXT",
-          "more than one buffer or bufs not GL_NONE or GL_BACK");
+    if (count != 1) {
+      LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION, "glDrawBuffersEXT",
+                         "invalid number of buffers");
       return;
     }
-    GLenum mapped_buf = bufs[0];
-    if (GetBackbufferServiceId() != 0 &&  // emulated backbuffer
-        bufs[0] == GL_BACK) {
-      mapped_buf = GL_COLOR_ATTACHMENT0;
+    GLenum buf = bufs[0];
+    if (buf != GL_BACK && buf != GL_NONE) {
+      LOCAL_SET_GL_ERROR(GL_INVALID_OPERATION, "glDrawBuffersEXT",
+                         "buffer is not GL_NONE or GL_BACK");
+      return;
     }
-    glDrawBuffersARB(count, &mapped_buf);
-    back_buffer_draw_buffer_ = bufs[0];
+    if (buf == GL_BACK && GetBackbufferServiceId() != 0)  // emulated backbuffer
+      buf = GL_COLOR_ATTACHMENT0;
+    glDrawBuffersARB(count, &buf);
+    back_buffer_draw_buffer_ = buf;

[Zhenyao Mo, 2016/08/23 23:53:06]

Here we should store the user buffer, not the mapped buffer. (you could move
this line above #16161.

[piman, 2016/08/24 00:10:32]

Thanks for the catch, done.

   }
 }
 
 void GLES2DecoderImpl::DoLoseContextCHROMIUM(GLenum current, GLenum other) {
   MarkContextLost(GetContextLostReasonFromResetStatus(current));
   group_->LoseContexts(GetContextLostReasonFromResetStatus(other));
   reset_by_robustness_extension_ = true;
 }
 
 void GLES2DecoderImpl::DoFlushDriverCachesCHROMIUM(void) {
   // On Adreno Android devices we need to use a workaround to force caches to
   // clear.
   if (feature_info_->workarounds().unbind_egl_context_to_flush_driver_caches) {
     context_->ReleaseCurrent(nullptr);
     context_->MakeCurrent(surface_.get());
   }
 }
 
 void GLES2DecoderImpl::DoMatrixLoadfCHROMIUM(GLenum matrix_mode,
                                              const GLfloat* matrix) {
   DCHECK(matrix_mode == GL_PATH_PROJECTION_CHROMIUM ||
          matrix_mode == GL_PATH_MODELVIEW_CHROMIUM);
 
   GLfloat* target_matrix = matrix_mode == GL_PATH_PROJECTION_CHROMIUM
                                ? state_.projection_matrix
                                : state_.modelview_matrix;
   memcpy(target_matrix, matrix, sizeof(GLfloat) * 16);
   // The matrix_mode is either GL_PATH_MODELVIEW_NV or GL_PATH_PROJECTION_NV
   // since the values of the _NV and _CHROMIUM tokens match.
-  glMatrixLoadfEXT(matrix_mode, matrix);
+  glMatrixLoadfEXT(matrix_mode, target_matrix);
 }
 
 void GLES2DecoderImpl::DoMatrixLoadIdentityCHROMIUM(GLenum matrix_mode) {
   DCHECK(matrix_mode == GL_PATH_PROJECTION_CHROMIUM ||
          matrix_mode == GL_PATH_MODELVIEW_CHROMIUM);
 
   GLfloat* target_matrix = matrix_mode == GL_PATH_PROJECTION_CHROMIUM
                                ? state_.projection_matrix
                                : state_.modelview_matrix;
   memcpy(target_matrix, kIdentityMatrix, sizeof(kIdentityMatrix));
@@ skipping 1512 matching lines @@
 }
 
 // Include the auto-generated part of this file. We split this because it means
 // we can easily edit the non-auto generated parts right here in this file
 // instead of having to edit some template or the code generator.
 #include "base/macros.h"
 #include "gpu/command_buffer/service/gles2_cmd_decoder_autogen.h"
 
 }  // namespace gles2
 }  // namespace gpu