From ee21230bc87855404b87b97b738091cd04b0d3f3 Mon Sep 17 00:00:00 2001
From: Geoff Lang <[email protected]>
Date: Wed, 20 May 2026 11:46:30 -0400
Subject: [PATCH] Validate that TF buffers cannot be modified when TF is unbound.

The buffer transform feedback conflict validation would only track
buffers that are bound to the current transform feedback object. Since
it is possible to pause transform feedback and unbind it, the buffers
could be modified when in this state.

Add additional tracking for when the buffer is attached to an active
transform feedback.

Apply this validation to hardened contexts as well as WebGL since it is
undefined behaviour in the GL spec to use a buffer for transform
feedback and other usages simultaneously.

Fixed: chromium:492218546
Fixed: chromium:513925114
Change-Id: I45b99ce847d74946870ba35fc9a17294e3386523
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7864196
Reviewed-by: Shahbaz Youssefi <[email protected]>
Commit-Queue: Geoff Lang <[email protected]>
---

diff --git a/src/libANGLE/Buffer.cpp b/src/libANGLE/Buffer.cpp
index 5bb8139..8470826 100644
--- a/src/libANGLE/Buffer.cpp
+++ b/src/libANGLE/Buffer.cpp
@@ -85,6 +85,7 @@
       mBindingCount(0),
       mTransformFeedbackIndexedBindingCount(0),
       mTransformFeedbackGenericBindingCount(0),
+      mActiveTransformFeedbackCount(0),
       mImmutable(GL_FALSE),
       mStorageExtUsageFlags(0),
       mExternal(GL_FALSE),
@@ -465,20 +466,28 @@
 void Buffer::onTFBindingChanged(const Context *context, bool bound, bool indexed)
 {
     ASSERT(bound || mState.mBindingCount > 0);
-    mState.mBindingCount += bound ? 1 : -1;
+    const int delta = bound ? 1 : -1;
+    mState.mBindingCount += delta;
     if (indexed)
     {
         ASSERT(bound || mState.mTransformFeedbackIndexedBindingCount > 0);
-        mState.mTransformFeedbackIndexedBindingCount += bound ? 1 : -1;
+        mState.mTransformFeedbackIndexedBindingCount += delta;
 
         onStateChange(context, angle::SubjectMessage::BindingChanged);
     }
     else
     {
-        mState.mTransformFeedbackGenericBindingCount += bound ? 1 : -1;
+        mState.mTransformFeedbackGenericBindingCount += delta;
     }
 }
 
+void Buffer::onTFActiveChanged(const Context *context, bool active)
+{
+    const int delta = active ? 1 : -1;
+    mState.mActiveTransformFeedbackCount += delta;
+    ASSERT(mState.mActiveTransformFeedbackCount >= 0);
+}
+
 angle::Result Buffer::getSubData(const gl::Context *context,
                                  GLintptr offset,
                                  GLsizeiptr size,
@@ -589,4 +598,5 @@
         onStateChange(context, angle::SubjectMessage::SubjectChanged);
     }
 }
+
 }  // namespace gl
diff --git a/src/libANGLE/Buffer.h b/src/libANGLE/Buffer.h
index 853ec51..057b8d3 100644
--- a/src/libANGLE/Buffer.h
+++ b/src/libANGLE/Buffer.h
@@ -70,7 +70,6 @@
     GLint64 getMapOffset() const { return mMapOffset; }
     GLint64 getMapLength() const { return mMapLength; }
     GLint64 getSize() const { return mSize; }
-    bool isBoundForTransformFeedback() const { return mTransformFeedbackIndexedBindingCount != 0; }
     std::string getLabel() const { return mLabel; }
     WebGLBufferType getWebGLType() const { return mWebGLType; }
 
@@ -90,6 +89,7 @@
     int mBindingCount;
     int mTransformFeedbackIndexedBindingCount;
     int mTransformFeedbackGenericBindingCount;
+    int mActiveTransformFeedbackCount;
     GLboolean mImmutable;
     GLbitfield mStorageExtUsageFlags;
     GLboolean mExternal;
@@ -190,15 +190,8 @@
 
     rx::BufferImpl *getImplementation() const { return mImpl; }
 
-    // Note: we pass "isWebGL" to this function to clarify it's only valid if WebGL is enabled.
-    // We pass the boolean flag instead of the pointer because this header can't read Context.h.
-    ANGLE_INLINE bool hasWebGLXFBBindingConflict(bool isWebGL) const
+    ANGLE_INLINE bool isBoundToTFAndNonTFSimultaneously() const
     {
-        if (!isWebGL)
-        {
-            return false;
-        }
-
         // The transform feedback generic binding point is not an indexed binding point but it also
         // does not count as a non-transform-feedback use of the buffer, so we subtract it from the
         // binding count when checking if the buffer is bound to a non-transform-feedback location.
@@ -208,8 +201,21 @@
                    mState.mBindingCount - mState.mTransformFeedbackGenericBindingCount;
     }
 
+    // If this buffer is bound as a transform feedback output, even if that transform feedback is
+    // paused and not the current transform feedback.
+    ANGLE_INLINE bool isBoundToActiveTransformFeedback() const
+    {
+        return mState.mActiveTransformFeedbackCount > 0;
+    }
+
+    ANGLE_INLINE bool hasTFBBindingConflict() const
+    {
+        return isBoundToTFAndNonTFSimultaneously() || isBoundToActiveTransformFeedback();
+    }
+
     bool isDoubleBoundForTransformFeedback() const;
     void onTFBindingChanged(const Context *context, bool bound, bool indexed);
+    void onTFActiveChanged(const Context *context, bool active);
     void onNonTFBindingChanged(int incr) { mState.mBindingCount += incr; }
     angle::Result getSubData(const gl::Context *context,
                              GLintptr offset,
diff --git a/src/libANGLE/TransformFeedback.cpp b/src/libANGLE/TransformFeedback.cpp
index 8075e2f..136bdf5 100644
--- a/src/libANGLE/TransformFeedback.cpp
+++ b/src/libANGLE/TransformFeedback.cpp
@@ -157,6 +157,14 @@
     bindProgramPipeline(context, programPipeline);
     bindPPOPrograms(programPipeline);
 
+    for (auto &buffer : mState.mIndexedBuffers)
+    {
+        if (buffer.get())
+        {
+            buffer->onTFActiveChanged(context, true);
+        }
+    }
+
     return angle::Result::Continue;
 }
 
@@ -182,6 +190,13 @@
     {
         mState.mPPOPrograms[shaderType].value = 0;
     }
+    for (auto &buffer : mState.mIndexedBuffers)
+    {
+        if (buffer.get())
+        {
+            buffer->onTFActiveChanged(context, false);
+        }
+    }
     return angle::Result::Continue;
 }
 
@@ -402,7 +417,7 @@
 {
     for (auto &buffer : mState.mIndexedBuffers)
     {
-        if (buffer.get() && buffer->hasWebGLXFBBindingConflict(true))
+        if (buffer.get() && buffer->isBoundToTFAndNonTFSimultaneously())
         {
             return true;
         }
diff --git a/src/libANGLE/VertexArray.cpp b/src/libANGLE/VertexArray.cpp
index bc17874..fcc2d72 100644
--- a/src/libANGLE/VertexArray.cpp
+++ b/src/libANGLE/VertexArray.cpp
@@ -520,10 +520,10 @@
             boundBuffer->addRef();
             boundBuffer->onNonTFBindingChanged(1);
             boundBuffer->addVertexArrayBinding(context, bindingIndex);
-            if (context->isWebGL())
+            if (context->isWebGL() || context->isHardenedContext())
             {
                 mCachedBufferPropertyTransformFeedbackConflict.set(
-                    bindingIndex, boundBuffer->hasWebGLXFBBindingConflict(true));
+                    bindingIndex, boundBuffer->hasTFBBindingConflict());
             }
             mBufferBindingMask.set(bindingIndex);
             mState.mClientMemoryAttribsMask &= ~binding->getBoundAttributesMask();
@@ -531,10 +531,7 @@
         }
         else
         {
-            if (context->isWebGL())
-            {
-                mCachedBufferPropertyTransformFeedbackConflict.set(bindingIndex, false);

diff --git a/src/tests/gl_tests/TransformFeedbackTest.cpp b/src/tests/gl_tests/TransformFeedbackTest.cpp
index 0ab7588..4b4e1ca 100644
--- a/src/tests/gl_tests/TransformFeedbackTest.cpp
+++ b/src/tests/gl_tests/TransformFeedbackTest.cpp
@@ -5002,19 +5002,6 @@
     glDrawArrays(GL_POINTS, 0, verticesToDraw);
     EXPECT_GL_ERROR(GL_INVALID_OPERATION);
     glEndTransformFeedback();
-
-    // Set up the buffer to be the right size but make it smaller after glBeginTransformFeedback
-    glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, bytesNeeded, &tfData, GL_STATIC_DRAW);
-    glBeginTransformFeedback(GL_POINTS);
-    glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, bytesNeeded - 1, &tfData, GL_STATIC_DRAW);
-    EXPECT_GL_ERROR(GL_INVALID_OPERATION);
-    glPauseTransformFeedback();
-    glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, bytesNeeded - 1, &tfData, GL_STATIC_DRAW);
-    EXPECT_GL_NO_ERROR();
-    glResumeTransformFeedback();
-    glDrawArrays(GL_POINTS, 0, verticesToDraw);
-    EXPECT_GL_ERROR(GL_INVALID_OPERATION);
-    glEndTransformFeedback();
 }
 
 // Test validation of buffer bounds checking for transform feedback with multidraw commands
@@ -5074,6 +5061,59 @@
     glEndTransformFeedback();
 }
 
+// Changing the buffer storage while transform feedback is active (but paused) is undefined
+// behaviour. Make sure it generates an error for WebGL.
+TEST_P(WebGLTransformFeedbackTest, ChangeBufferWhilePaused)
+{
+    std::vector<std::string> tfVaryings;
+    tfVaryings.push_back("gl_Position");
+    compileDefaultProgram(tfVaryings, GL_INTERLEAVED_ATTRIBS);
+    GLint positionLocation = glGetAttribLocation(mProgram, essl1_shaders::PositionAttrib());
+
+    glUseProgram(mProgram);
+
+    const GLfloat vertices[] = {
+        -1.0f, 1.0f, 0.5f, -1.0f, -1.0f, 0.5f, 1.0f, -1.0f, 0.5f,
+        -1.0f, 1.0f, 0.5f, 1.0f,  -1.0f, 0.5f, 1.0f, 1.0f,  0.5f,
+    };
+
+    GLBuffer buffer;
+    glBindBuffer(GL_ARRAY_BUFFER, buffer);
+    glBufferData(GL_ARRAY_BUFFER, sizeof(vertices), vertices, GL_STATIC_DRAW);
+    glVertexAttribPointer(positionLocation, 3, GL_FLOAT, GL_FALSE, 0, nullptr);
+    glEnableVertexAttribArray(positionLocation);
+
+    const GLsizei verticesToDraw = 3;
+    const size_t stride          = sizeof(float) * 4;
+    const GLsizei drawcount      = 2;
+    const size_t bytesNeeded     = stride * verticesToDraw * drawcount;
+
+    glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, mTransformFeedbackBuffer);
+    uint8_t tfData[bytesNeeded] = {0};
+    glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, bytesNeeded, &tfData, GL_STATIC_DRAW);
+
+    glBeginTransformFeedback(GL_POINTS);
+    glDrawArrays(GL_POINTS, 0, verticesToDraw);
+    EXPECT_GL_NO_ERROR();
+
+    glPauseTransformFeedback();
+    EXPECT_GL_NO_ERROR();
+
+    // Try modifying the buffer while it's a transform feedback output
+    glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, bytesNeeded, &tfData, GL_STATIC_DRAW);
+    EXPECT_GL_ERROR(GL_INVALID_OPERATION);
+
+    glBufferSubData(GL_TRANSFORM_FEEDBACK_BUFFER, 0, bytesNeeded, &tfData);
+    EXPECT_GL_ERROR(GL_INVALID_OPERATION);
+
+    glResumeTransformFeedback();
+    glDrawArrays(GL_POINTS, 0, verticesToDraw);
+    EXPECT_GL_NO_ERROR();
+
+    glEndTransformFeedback();
+    EXPECT_GL_NO_ERROR();
+}
+
 // Test validation of buffer bounds checking for transform feedback with multidraw instanced
 // commands
 TEST_P(WebGLTransformFeedbackTest, TooSmallBuffersMultiDrawInstanced)
diff --git a/src/tests/gl_tests/WebGLCompatibilityTest.cpp b/src/tests/gl_tests/WebGLCompatibilityTest.cpp
index 653e8ea..1d89a15 100644
--- a/src/tests/gl_tests/WebGLCompatibilityTest.cpp
+++ b/src/tests/gl_tests/WebGLCompatibilityTest.cpp
@@ -6249,6 +6249,49 @@
     EXPECT_GL_ERROR(GL_INVALID_OPERATION);
 }
 
+// Modifying a buffer that is part of an active transform feedback object (even when that transform
+// feedback is paused and not current) is invalid.
+TEST_P(WebGL2CompatibilityTest, TransformFeedbackBufferModificationWhileNotCurrent)
+{
+    constexpr char kVS[] = R"(attribute float a; varying float b; void main() { b = a; })";
+    constexpr char kFS[] = R"(void main(){})";
+    ANGLE_GL_PROGRAM(program, kVS, kFS);
+    static const char *varyings[] = {"b"};
+    glTransformFeedbackVaryings(program, 1, varyings, GL_SEPARATE_ATTRIBS);
+    glLinkProgram(program);
+    glUseProgram(program);
+    ASSERT_GL_NO_ERROR();
+
+    // Bind the transform feedback varyings to non-overlapping regions of the same buffer.
+    GLTransformFeedback tf1;
+    glBindTransformFeedback(GL_TRANSFORM_FEEDBACK, tf1);
+
+    GLBuffer buffer;
+    glBindBufferRange(GL_TRANSFORM_FEEDBACK_BUFFER, 0, buffer, 0, 4);
+    glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, 8, nullptr, GL_STATIC_DRAW);
+    glBeginTransformFeedback(GL_POINTS);
+    ASSERT_GL_NO_ERROR();
+
+    glPauseTransformFeedback();
+
+    GLTransformFeedback tf2;
+    glBindTransformFeedback(GL_TRANSFORM_FEEDBACK, tf2);
+    ASSERT_GL_NO_ERROR();
+
+    glBindBuffer(GL_ARRAY_BUFFER, buffer);
+    ASSERT_GL_NO_ERROR();
+
+    glBufferData(GL_ARRAY_BUFFER, 8, nullptr, GL_STATIC_DRAW);
+    EXPECT_GL_ERROR(GL_INVALID_OPERATION);
+
+    constexpr uint8_t data[8] = {0};
+    glBufferSubData(GL_ARRAY_BUFFER, 0, 8, data);
+    EXPECT_GL_ERROR(GL_INVALID_OPERATION);
+
+    glMapBufferRange(GL_ARRAY_BUFFER, 0, 8, GL_MAP_READ_BIT);
+    EXPECT_GL_ERROR(GL_INVALID_OPERATION);
+}
+
 // Check the return type of a given parameter upon getting the active uniforms.
 TEST_P(WebGL2CompatibilityTest, UniformVariablesReturnTypes)
 {