WebVR: Add sanity checks for decoded pose index values

chrome/browser/android/vr_shell/vr_shell.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/android/vr_shell/vr_shell.h"
 
 #include "base/metrics/histogram_macros.h"
 #include "chrome/browser/android/vr_shell/ui_elements.h"
 #include "chrome/browser/android/vr_shell/ui_interface.h"
 #include "chrome/browser/android/vr_shell/ui_scene.h"
@@ skipping 73 matching lines @@
 // is currently sized to fit the WebVR "insecure transport" warnings,
 // adjust it as needed if there is additional content.
 static constexpr gvr::Sizei kHeadlockedBufferDimensions = {1024, 1024};
 static constexpr gvr::Rectf kHeadlockedBufferFov = {20.f, 20.f, 20.f, 20.f};
 
 // The GVR viewport list has two entries (left eye and right eye) for each
 // GVR buffer.
 static constexpr int kViewportListPrimaryOffset = 0;
 static constexpr int kViewportListHeadlockedOffset = 2;
 
+// Magic numbers used to mark valid pose index values encoded in frame
+// data. Must match the magic numbers used in blink's VRDisplay.cpp.
+static constexpr std::array<uint8_t, 2> kWebVrPosePixelMagicNumbers{{42, 142}};
+
 vr_shell::VrShell* g_instance;
 
 static const char kVrShellUIURL[] = "chrome://vr-shell-ui";
 
 float Distance(const gvr::Vec3f& vec1, const gvr::Vec3f& vec2) {
   float xdiff = (vec1.x - vec2.x);
   float ydiff = (vec1.y - vec2.y);
   float zdiff = (vec1.z - vec2.z);
   float scale = xdiff * xdiff + ydiff * ydiff + zdiff * zdiff;
   return std::sqrt(scale);
@@ skipping 64 matching lines @@
   content_compositor_.reset(new VrCompositor(content_window, false));
   ui_compositor_.reset(new VrCompositor(ui_window, true));
   vr_web_contents_observer_.reset(
       new VrWebContentsObserver(main_contents, html_interface_.get()));
 
   LoadUIContent();
 
   gvr::Mat4f identity;
   SetIdentityM(identity);
   webvr_head_pose_.resize(kPoseRingBufferSize, identity);
+  webvr_head_pose_valid_.resize(kPoseRingBufferSize, false);
 }
 
 void VrShell::UpdateCompositorLayers(JNIEnv* env,
                                      const JavaParamRef<jobject>& obj) {
   content_compositor_->SetLayer(main_contents_);
   ui_compositor_->SetLayer(ui_contents_);
 }
 
 void VrShell::Destroy(JNIEnv* env, const JavaParamRef<jobject>& obj) {
   delete this;
@@ skipping 83 matching lines @@
         gl::init::InitializeGLOneOff());
 
   content_texture_id_ = content_texture_handle;
   ui_texture_id_ = ui_texture_handle;
 
   // While WebVR is going through the compositor path, it shares
   // the same texture ID. This will change once it gets its own
   // surface, but store it separately to avoid future confusion.
   // TODO(klausw,crbug.com/655722): remove this.
   webvr_texture_id_ = content_texture_id_;
+  // Out of paranoia, explicitly reset the "pose valid" flags to false
+  // from the GL thread. The constructor ran in the UI thread.
+  // TODO(klausw,crbug.com/655722): remove this.
+  webvr_head_pose_valid_.assign(kPoseRingBufferSize, false);
 
   gvr_api_->InitializeGl();
   std::vector<gvr::BufferSpec> specs;
   // For kFramePrimaryBuffer (primary VrShell and WebVR content)
   specs.push_back(gvr_api_->CreateBufferSpec());
   render_size_primary_ = specs[kFramePrimaryBuffer].GetSize();
   render_size_primary_vrshell_ = render_size_primary_;
 
   // For kFrameHeadlockedBuffer (for WebVR insecure content warning).
   // Set this up at fixed resolution, the (smaller) FOV gets set below.
@@ skipping 245 matching lines @@
     }
     gesture->type = WebInputEvent::GestureTapDown;
     gesture->data.tapDown.width = pixel_x;
     gesture->data.tapDown.height = pixel_y;
     current_input_target_->ProcessUpdatedGesture(*gesture.get());
   }
 }
 
 void VrShell::SetGvrPoseForWebVr(const gvr::Mat4f& pose, uint32_t pose_num) {
   webvr_head_pose_[pose_num % kPoseRingBufferSize] = pose;
+  webvr_head_pose_valid_[pose_num % kPoseRingBufferSize] = true;
 }
 
-uint32_t GetPixelEncodedPoseIndex() {
+int GetPixelEncodedPoseIndexByte() {
   TRACE_EVENT0("gpu", "VrShell::GetPixelEncodedPoseIndex");
   // Read the pose index encoded in a bottom left pixel as color values.
   // See also third_party/WebKit/Source/modules/vr/VRDisplay.cpp which
   // encodes the pose index, and device/vr/android/gvr/gvr_device.cc
-  // which tracks poses.
+  // which tracks poses. Returns the low byte (0..255) if valid, or -1
+  // if not valid due to bad magic number.
   uint8_t pixels[4];
   // Assume we're reading from the framebuffer we just wrote to.
   // That's true currently, we may need to use glReadBuffer(GL_BACK)
   // or equivalent if the rendering setup changes in the future.
   glReadPixels(0, 0, 1, 1, GL_RGBA, GL_UNSIGNED_BYTE, pixels);
-  return pixels[0] | (pixels[1] << 8) | (pixels[2] << 16);
+
+  // Check for the magic number written by VRDevice.cpp on submit.
+  // This helps avoid glitches from garbage data in the render
+  // buffer that can appear during initialization or resizing. These
+  // often appear as flashes of all-black or all-white pixels.
+  if (pixels[1] == kWebVrPosePixelMagicNumbers[0] &&
+      pixels[2] == kWebVrPosePixelMagicNumbers[1]) {
+    // Pose is good.
+    return pixels[0];
+  }
+  VLOG(1) << "WebVR: reject decoded pose index " << (int)pixels[0] <<
+      ", bad magic number " << (int)pixels[1] << ", " << (int)pixels[2];
+  return -1;
+}
+
+bool VrShell::WebVrPoseByteIsValid(int pose_index_byte) {
+  if (pose_index_byte < 0) {
+    return false;
+  }
+  if (!webvr_head_pose_valid_[pose_index_byte % kPoseRingBufferSize]) {
+    VLOG(1) << "WebVR: reject decoded pose index " << pose_index_byte <<
+        ", not a valid pose";
+    return false;
+  }
+  return true;
 }
 
 void VrShell::DrawFrame(JNIEnv* env, const JavaParamRef<jobject>& obj) {
   TRACE_EVENT0("gpu", "VrShell::DrawFrame");
   // Reset the viewport list to just the pair of viewports for the
   // primary buffer each frame. Head-locked viewports get added by
   // DrawVrShell if needed.
   buffer_viewport_list_->SetToRecommendedBufferViewports();
 
   if (html_interface_->GetMode() == UiInterface::Mode::WEB_VR) {
@@ skipping 45 matching lines @@
     DrawWebVr();
 
     // When using async reprojection, we need to know which pose was used in
     // the WebVR app for drawing this frame. Due to unknown amounts of
     // buffering in the compositor and SurfaceTexture, we read the pose number
     // from a corner pixel. There's no point in doing this for legacy
     // distortion rendering since that doesn't need a pose, and reading back
     // pixels is an expensive operation. TODO(klausw,crbug.com/655722): stop
     // doing this once we have working no-compositor rendering for WebVR.
     if (gvr_api_->GetAsyncReprojectionEnabled()) {
-      uint32_t webvr_pose_frame = GetPixelEncodedPoseIndex();
-      // If we don't get a valid frame ID back we shouldn't attempt to reproject
-      // by an invalid matrix, so turn of reprojection instead.
-      if (webvr_pose_frame == 0) {
+      int pose_index_byte = GetPixelEncodedPoseIndexByte();
+      if (WebVrPoseByteIsValid(pose_index_byte)) {
+        // We have a valid pose, use it for reprojection.
+        webvr_left_viewport_->SetReprojection(GVR_REPROJECTION_FULL);
+        webvr_right_viewport_->SetReprojection(GVR_REPROJECTION_FULL);
+        head_pose = webvr_head_pose_[pose_index_byte % kPoseRingBufferSize];
+        // We can't mark the used pose as invalid since unfortunately
+        // we have to reuse them. The compositor will re-submit stale
+        // frames on vsync, and we can't tell that this has happened
+        // until we've read the pose index from it, and at that point
+        // it's too late to skip rendering.
+      } else {
+        // If we don't get a valid frame ID back we shouldn't attempt
+        // to reproject by an invalid matrix, so turn off reprojection
+        // instead. Invalid poses can permanently break reprojection
+        // for this GVR instance: http://crbug.com/667327
         webvr_left_viewport_->SetReprojection(GVR_REPROJECTION_NONE);
         webvr_right_viewport_->SetReprojection(GVR_REPROJECTION_NONE);
-      } else {
-        webvr_left_viewport_->SetReprojection(GVR_REPROJECTION_FULL);
-        webvr_right_viewport_->SetReprojection(GVR_REPROJECTION_FULL);
-        head_pose = webvr_head_pose_[webvr_pose_frame % kPoseRingBufferSize];
       }
     }
   }
 
   DrawVrShell(head_pose, frame);
 
   frame.Unbind();
   frame.Submit(*buffer_viewport_list_, head_pose);
 }
 
@@ skipping 408 matching lines @@
            const JavaParamRef<jobject>& ui_web_contents,
            jlong ui_window_android) {
   return reinterpret_cast<intptr_t>(new VrShell(
       env, obj, content::WebContents::FromJavaWebContents(content_web_contents),
       reinterpret_cast<ui::WindowAndroid*>(content_window_android),
       content::WebContents::FromJavaWebContents(ui_web_contents),
       reinterpret_cast<ui::WindowAndroid*>(ui_window_android)));
 }
 
 }  // namespace vr_shell