Aggressively unbind GL_PIXEL_UNPACK_BUFFER

Bug: 27186019

Theory: It appears to be possible for FontRenderer
to not unbind its PBO prior to textures being uploaded,
resulting in trying to glSubTexImage2D with a bound
GL_PIXEL_UNPACK_BUFFER. In that scenario the void* is
the offset into the PBO which given a non-null data
will almost certainly overrun the end of the buffer. This
in turn produces a GL_INVALID_OPERATION error.

Change PixelBuffer to avoid leaking this state for now.
This will result in more calls to glBindBuffer/glUnbindBuffer
in the worst case, but the worst case is already bad so this
shouldn't be a problem. In the normal case we avoid binding
the PBO at all ever, so this doesn't impact that.

Change-Id: I05473f0d2f9a3a5da0e33d8f9ddea4731ce970e3

1 files changed, 8 insertions, 2 deletions

diff --git a/libs/hwui/PixelBuffer.cpp b/libs/hwui/PixelBuffer.cpp
index 6df994c623f2..165c7db4c85f 100644
--- a/libs/hwui/PixelBuffer.cpp
+++ b/libs/hwui/PixelBuffer.cpp
@@ -36,12 +36,14 @@ public:
     CpuPixelBuffer(GLenum format, uint32_t width, uint32_t height);
 
     uint8_t* map(AccessMode mode = kAccessMode_ReadWrite) override;
-    void unmap() override;
 
     uint8_t* getMappedPointer() const override;
 
     void upload(uint32_t x, uint32_t y, uint32_t width, uint32_t height, int offset) override;
 
+protected:
+    void unmap() override;
+
 private:
     std::unique_ptr<uint8_t[]> mBuffer;
 };
@@ -81,12 +83,14 @@ public:
     ~GpuPixelBuffer();
 
     uint8_t* map(AccessMode mode = kAccessMode_ReadWrite) override;
-    void unmap() override;
 
     uint8_t* getMappedPointer() const override;
 
     void upload(uint32_t x, uint32_t y, uint32_t width, uint32_t height, int offset) override;
 
+protected:
+    void unmap() override;
+
 private:
     GLuint mBuffer;
     uint8_t* mMappedPointer;
@@ -118,6 +122,7 @@ uint8_t* GpuPixelBuffer::map(AccessMode mode) {
             LOG_ALWAYS_FATAL("Failed to map PBO");
         }
         mAccessMode = mode;
+        mCaches.pixelBufferState().unbind();
     }
 
     return mMappedPointer;
@@ -147,6 +152,7 @@ void GpuPixelBuffer::upload(uint32_t x, uint32_t y, uint32_t width, uint32_t hei
     unmap();
     glTexSubImage2D(GL_TEXTURE_2D, 0, x, y, width, height, mFormat,
             GL_UNSIGNED_BYTE, reinterpret_cast<void*>(offset));
+    mCaches.pixelBufferState().unbind();
 }
 
 ///////////////////////////////////////////////////////////////////////////////