WebVR: Add sanity checks for decoded pose index values

chrome/browser/android/vr_shell/vr_shell.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/android/vr_shell/vr_shell.h"
 
 #include "base/metrics/histogram_macros.h"
 #include "chrome/browser/android/vr_shell/ui_elements.h"
 #include "chrome/browser/android/vr_shell/ui_interface.h"
 #include "chrome/browser/android/vr_shell/ui_scene.h"
@@ skipping 157 matching lines @@
   content_compositor_.reset(new VrCompositor(content_window, false));
   ui_compositor_.reset(new VrCompositor(ui_window, true));
   vr_web_contents_observer_.reset(
       new VrWebContentsObserver(main_contents, html_interface_.get()));
 
   LoadUIContent();
 
   gvr::Mat4f identity;
   SetIdentityM(identity);
   webvr_head_pose_.resize(kPoseRingBufferSize, identity);
+  webvr_head_pose_valid_.resize(kPoseRingBufferSize, false);
 }
 
 void VrShell::UpdateCompositorLayers(JNIEnv* env,
                                      const JavaParamRef<jobject>& obj) {
   content_compositor_->SetLayer(main_contents_);
   ui_compositor_->SetLayer(ui_contents_);
 }
 
 void VrShell::Destroy(JNIEnv* env, const JavaParamRef<jobject>& obj) {
   delete this;
@@ skipping 72 matching lines @@
       break;
   }
   UMA_HISTOGRAM_ENUMERATION("VRViewerType", static_cast<int>(viewerType),
       static_cast<int>(ViewerType::VIEWER_TYPE_MAX));
 }
 
 void VrShell::InitializeGl(JNIEnv* env,
                            const JavaParamRef<jobject>& obj,
                            jint content_texture_handle,
                            jint ui_texture_handle) {
+  VLOG(1) << "VrShell initializing GL start";
   CHECK(gl::GetGLImplementation() != gl::kGLImplementationNone ||
         gl::init::InitializeGLOneOff());
 
   content_texture_id_ = content_texture_handle;
   ui_texture_id_ = ui_texture_handle;
 
   // While WebVR is going through the compositor path, it shares
   // the same texture ID. This will change once it gets its own
   // surface, but store it separately to avoid future confusion.
   // TODO(klausw,crbug.com/655722): remove this.
   webvr_texture_id_ = content_texture_id_;
+  // Out of paranoia, explicitly reset the "pose valid" flags to false
+  // from the GL thread. The constructor ran in the UI thread.
+  // TODO(klausw,crbug.com/655722): remove this.
+  webvr_head_pose_valid_.assign(kPoseRingBufferSize, false);
+  webvr_valid_poses_seen_ = 0;
 
   gvr_api_->InitializeGl();
   std::vector<gvr::BufferSpec> specs;
   // For kFramePrimaryBuffer (primary VrShell and WebVR content)
   specs.push_back(gvr_api_->CreateBufferSpec());
   render_size_primary_ = specs[kFramePrimaryBuffer].GetSize();
   render_size_primary_vrshell_ = render_size_primary_;
 
   // For kFrameHeadlockedBuffer (for WebVR insecure content warning).
   // Set this up at fixed resolution, the (smaller) FOV gets set below.
@@ skipping 44 matching lines @@
       new gvr::BufferViewport(gvr_api_->CreateBufferViewport()));
   buffer_viewport_list_->GetBufferViewport(GVR_LEFT_EYE,
                                            webvr_left_viewport_.get());
   webvr_left_viewport_->SetSourceBufferIndex(kFramePrimaryBuffer);
 
   webvr_right_viewport_.reset(
       new gvr::BufferViewport(gvr_api_->CreateBufferViewport()));
   buffer_viewport_list_->GetBufferViewport(GVR_RIGHT_EYE,
                                            webvr_right_viewport_.get());
   webvr_right_viewport_->SetSourceBufferIndex(kFramePrimaryBuffer);
+  VLOG(1) << "VrShell initializing GL done";
 }
 
 void VrShell::UpdateController(const gvr::Vec3f& forward_vector) {
   controller_->UpdateState();
 
 #if defined(ENABLE_VR_SHELL)
   // Note that button up/down state is transient, so IsButtonUp only returns
   // true for a single frame (and we're guaranteed not to miss it).
   if (controller_->IsButtonUp(
       gvr::ControllerButton::GVR_CONTROLLER_BUTTON_APP)) {
@@ skipping 181 matching lines @@
     }
     gesture->type = WebInputEvent::GestureTapDown;
     gesture->data.tapDown.width = pixel_x;
     gesture->data.tapDown.height = pixel_y;
     current_input_target_->ProcessUpdatedGesture(*gesture.get());
   }
 }
 
 void VrShell::SetGvrPoseForWebVr(const gvr::Mat4f& pose, uint32_t pose_num) {
   webvr_head_pose_[pose_num % kPoseRingBufferSize] = pose;
+  webvr_head_pose_valid_[pose_num % kPoseRingBufferSize] = true;
 }
 
-uint32_t GetPixelEncodedPoseIndex() {
+int GetPixelEncodedPoseIndexByte() {
   TRACE_EVENT0("gpu", "VrShell::GetPixelEncodedPoseIndex");
   // Read the pose index encoded in a bottom left pixel as color values.
   // See also third_party/WebKit/Source/modules/vr/VRDisplay.cpp which
   // encodes the pose index, and device/vr/android/gvr/gvr_device.cc
-  // which tracks poses.
+  // which tracks poses. Returns the low byte (0..255) if valid, or -1
+  // if not valid due to bad magic number.
   uint8_t pixels[4];
   // Assume we're reading from the framebuffer we just wrote to.
   // That's true currently, we may need to use glReadBuffer(GL_BACK)
   // or equivalent if the rendering setup changes in the future.
   glReadPixels(0, 0, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, pixels);
-  return pixels[0] | (pixels[1] << 8) | (pixels[2] << 16);
+
+  // Check for the magic number written in VRDevice.cpp on submit.
+  // This helps avoid glitches from garbage data in the render
+  // buffer that can appear during initialization or resizing. These
+  // often appear as flashes of all-black or all-white pixels.
+  if (pixels[1] == 42 && pixels[2] == 142) {
+    return pixels[0];
+  }
+  VLOG(2) << "WebVR: reject decoded pose index " << (int)pixels[0] <<
+      ", bad magic number " << (int)pixels[1] << ", " << (int)pixels[2];
+  return -1;
+}
+
+bool VrShell::WebVrPoseByteIsValid(int pose_index_byte) {
+  if (pose_index_byte < 0) {
+    return false;
+  }
+  if (!webvr_head_pose_valid_[pose_index_byte % kPoseRingBufferSize]) {
+    VLOG(1) << "WebVR: reject decoded pose index " << pose_index_byte <<
+        ", not a valid pose";
+    return false;
+  }
+
+  if (webvr_valid_poses_seen_ < webvr_min_valid_poses_) {
+    VLOG_IF(2, webvr_valid_poses_seen_ == 0) <<
+        "WebVR: reject decoded pose index " << pose_index_byte <<
+        ", waiting for " << webvr_min_valid_poses_ << " more good poses";
+    ++webvr_valid_poses_seen_;
+    if (webvr_valid_poses_seen_ == webvr_min_valid_poses_) {
+      VLOG(2) << "WebVR: got sufficient good poses, enabling reprojection";
+      return true;
+    }
+    return false;
+  }
+  return true;
 }
 
 void VrShell::DrawFrame(JNIEnv* env, const JavaParamRef<jobject>& obj) {
   TRACE_EVENT0("gpu", "VrShell::DrawFrame");
   // Reset the viewport list to just the pair of viewports for the
   // primary buffer each frame. Head-locked viewports get added by
   // DrawVrShell if needed.
   buffer_viewport_list_->SetToRecommendedBufferViewports();
 
   if (html_interface_->GetMode() == UiInterface::Mode::WEB_VR) {
@@ skipping 45 matching lines @@
     DrawWebVr();
 
     // When using async reprojection, we need to know which pose was used in
     // the WebVR app for drawing this frame. Due to unknown amounts of
     // buffering in the compositor and SurfaceTexture, we read the pose number
     // from a corner pixel. There's no point in doing this for legacy
     // distortion rendering since that doesn't need a pose, and reading back
     // pixels is an expensive operation. TODO(klausw,crbug.com/655722): stop
     // doing this once we have working no-compositor rendering for WebVR.
     if (gvr_api_->GetAsyncReprojectionEnabled()) {
-      uint32_t webvr_pose_frame = GetPixelEncodedPoseIndex();
-      // If we don't get a valid frame ID back we shouldn't attempt to reproject
-      // by an invalid matrix, so turn of reprojection instead.
-      if (webvr_pose_frame == 0) {
+      int pose_index_byte = GetPixelEncodedPoseIndexByte();
+      if (WebVrPoseByteIsValid(pose_index_byte)) {
+        // We have a valid pose, use it for reprojection.
+        webvr_left_viewport_->SetReprojection(GVR_REPROJECTION_FULL);
+        webvr_right_viewport_->SetReprojection(GVR_REPROJECTION_FULL);
+        head_pose = webvr_head_pose_[pose_index_byte % kPoseRingBufferSize];
+        // We can't mark the used pose as invalid since unfortunately
+        // we have to reuse them. The compositor will re-submit stale
+        // frames on vsync, and we can't tell that this has happened
+        // until we've read the pose index from it, and at that point
+        // it's too late to skip rendering.
+      } else {
+        // If we don't get a valid frame ID back we shouldn't attempt
+        // to reproject by an invalid matrix, so turn off reprojection
+        // instead. Invalid poses can permanently break reprojection
+        // for this GVR instance: http://crbug.com/667327
         webvr_left_viewport_->SetReprojection(GVR_REPROJECTION_NONE);
         webvr_right_viewport_->SetReprojection(GVR_REPROJECTION_NONE);
-      } else {
-        webvr_left_viewport_->SetReprojection(GVR_REPROJECTION_FULL);
-        webvr_right_viewport_->SetReprojection(GVR_REPROJECTION_FULL);
-        head_pose = webvr_head_pose_[webvr_pose_frame % kPoseRingBufferSize];
       }
     }
   }
 
   DrawVrShell(head_pose, frame);
 
   frame.Unbind();
   frame.Submit(*buffer_viewport_list_, head_pose);
 }
 
@@ skipping 408 matching lines @@
            const JavaParamRef<jobject>& ui_web_contents,
            jlong ui_window_android) {
   return reinterpret_cast<intptr_t>(new VrShell(
       env, obj, content::WebContents::FromJavaWebContents(content_web_contents),
       reinterpret_cast<ui::WindowAndroid*>(content_window_android),
       content::WebContents::FromJavaWebContents(ui_web_contents),
       reinterpret_cast<ui::WindowAndroid*>(ui_window_android)));
 }
 
 }  // namespace vr_shell