From 7f4181fabb329920be950c95b76e69d1ad296cda Mon Sep 17 00:00:00 2001
From: Sunny Sachanandani <[email protected]>
Date: Tue, 16 Jun 2026 15:23:13 -0700
Subject: [PATCH] [gpu] Check GL error before marking GLTexture/EGLImage cleared

GLTextureImageBacking and EGLImageBacking currently mark the backing as
cleared unconditionally when initial pixel data is provided, even if the
subsequent upload via glTexSubImage2D fails (e.g. under resource
pressure / GL_OUT_OF_MEMORY). This bypasses the IsCleared() check,
potentially exposing uninitialized VRAM allocator residue during
readback.

This CL checks for GL errors before calling SetCleared(). If a GL error
is detected, the backing remains uncleared so subsequent read access is
refused.

Landing a shared image unittest for this wasn't feasible since it needs
patching GL function pointers which won't work well in any parallel test
setup. However, I was able to verify the fix locally with a unit test.

Fixed: 517080836
Change-Id: If9ac7f2cb1742601418db52ad163742d6a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7909296
Commit-Queue: Sunny Sachanandani <[email protected]>
Auto-Submit: Sunny Sachanandani <[email protected]>
Reviewed-by: Vasiliy Telezhnikov <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1647933}
---

diff --git a/gpu/command_buffer/service/shared_image/egl_image_backing.cc b/gpu/command_buffer/service/shared_image/egl_image_backing.cc
index d04887c4..583148a 100644
--- a/gpu/command_buffer/service/shared_image/egl_image_backing.cc
+++ b/gpu/command_buffer/service/shared_image/egl_image_backing.cc
@@ -445,6 +445,17 @@
                         format_info.adjusted_format, format_info.gl_type, data);
   }
 
+  // The storage allocation of the sibling texture allocates undefined-content
+  // storage on a context without robust-resource-init. If the following upload
+  // upload failed (e.g. GL_OUT_OF_MEMORY) the storage is still uninitialized.
+  // Return an invalid image so that we don't call SetCleared() on the backing.
+  const GLenum error = api->glGetErrorFn();
+  if (error != GL_NO_ERROR) {
+    LOG(ERROR) << "EGLImageBacking: initial pixel upload failed (GL error 0x"
+               << std::hex << error << ")";
+    return gl::ScopedEGLImage();
+  }
+
   // Use service id of the texture as a source to create the EGLImage.
   const EGLint egl_attrib_list[] = {
       EGL_GL_TEXTURE_LEVEL_KHR, 0, EGL_IMAGE_PRESERVED_KHR, EGL_TRUE, EGL_NONE};
@@ -471,6 +482,12 @@
     AutoLock auto_lock(this);
     create_egl_images = egl_images_.empty();
     if (create_egl_images) {
+      // Drain any pre-existing GL errors so the post-allocation check below in
+      // GenEGLImageSibling is attributable to the storage call. Silently
+      // squelching these errors is unfortunate, but is done in order to mirror
+      // other allocation checks done in the command decoder.
+      while (api->glGetErrorFn() != GL_NO_ERROR) {
+      }
       for (int plane = 0; plane < num_planes; plane++) {
         gl::ScopedEGLImage egl_image =
             GenEGLImageSibling(pixel_data, service_ids, plane);
diff --git a/gpu/command_buffer/service/shared_image/gl_texture_holder.cc b/gpu/command_buffer/service/shared_image/gl_texture_holder.cc
index a601dc1..8c35e9e7 100644
--- a/gpu/command_buffer/service/shared_image/gl_texture_holder.cc
+++ b/gpu/command_buffer/service/shared_image/gl_texture_holder.cc
@@ -232,10 +232,12 @@
       // that it can be used in other ES2 contexts, and so we have to pass
       // gl_format as the internal format in the LevelInfo.
       // https://crbug.com/628064
-      texture_->SetLevelInfo(format_desc_.target, 0, format_desc_.data_format,
-                             size_.width(), size_.height(), /*depth=*/1, 0,
-                             format_desc_.data_format, format_desc_.data_type,
-                             /*cleared_rect=*/gfx::Rect());
+      const gfx::Rect cleared_rect =
+          !pixel_data.empty() ? gfx::Rect(size_) : gfx::Rect();
+      texture_->SetLevelInfo(
+          format_desc_.target, /*level=*/0, format_desc_.data_format,
+          size_.width(), size_.height(), /*depth=*/1, /*border=*/0,
+          format_desc_.data_format, format_desc_.data_type, cleared_rect);
       texture_->SetImmutable(true, format_info.supports_storage);
     } else {
       LOG(ERROR) << "GLTextureHolder: native storage allocation failed";
diff --git a/gpu/command_buffer/service/shared_image/gl_texture_image_backing.cc b/gpu/command_buffer/service/shared_image/gl_texture_image_backing.cc
index c3f178bc..6b2e4df 100644
--- a/gpu/command_buffer/service/shared_image/gl_texture_image_backing.cc
+++ b/gpu/command_buffer/service/shared_image/gl_texture_image_backing.cc
@@ -497,6 +497,14 @@
     base::span<const uint8_t> pixel_data,
     gl::ProgressReporter* progress_reporter,
     bool framebuffer_attachment_angle) {
+  // Drain any pre-existing GL errors so the post-allocation check below is
+  // attributable to the storage call. Silently squelching these errors is
+  // unfortunate, but is done in order to mirror other allocation checks done in
+  // the command decoder.
+  gl::GLApi* const api = gl::g_current_gl_context;
+  while (api->glGetErrorFn() != GL_NO_ERROR) {
+  }
+
   const std::string debug_label =
       "GLSharedImage_" + SharedImageBacking::debug_label();
   int num_planes = format().NumberOfPlanes();
@@ -510,8 +518,23 @@
                                 debug_label);
   }
 
-  if (!pixel_data.empty()) {
-    SetCleared();
+  // Update the cleared state for passthrough textures if the pixel data upload
+  // was successful. We don't need to update the cleared state for validating
+  // decoder textures because we track the cleared state in the decoder texture
+  // objects whose cleared state is set in TextureHolder::Initialize above.
+  if (is_passthrough_ && !pixel_data.empty()) {
+    // The storage allocation allocates undefined-content storage on a context
+    // without robust-resource-init. If the subsequent upload failed (e.g.
+    // GL_OUT_OF_MEMORY) the storage is still uninitialised; only mark the
+    // backing cleared if no GL error was raised.
+    GLenum error = api->glGetErrorFn();
+    if (error == GL_NO_ERROR) {
+      SetCleared();
+    } else {
+      LOG(ERROR)
+          << "GLTextureImageBacking: initial pixel upload failed (GL error 0x"
+          << std::hex << error << ")";
+    }
   }
 }