Fix a bug when inline vertex attrib data is copied past its boundary

kakashidinho · Nov 14, 2020 · 9cfbd26 · 9cfbd26
1 parent 388a809
commit 9cfbd26
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/src/libANGLE/renderer/metal/VertexArrayMtl.mm b/src/libANGLE/renderer/metal/VertexArrayMtl.mm
@@ -558,10 +558,15 @@ inline void SetDefaultVertexBufferLayout(mtl::VertexBufferLayoutDesc *layout)
             startElement = 0;
             elementCount = UnsignedCeilDivide(instanceCount, binding.getDivisor());
         }
-        size_t bytesIntendedToUse = (startElement + elementCount) * binding.getStride();
 
+        ASSERT(elementCount);
         const mtl::VertexFormat &format = contextMtl->getVertexFormat(attrib.format->id, false);
-        bool needStreaming              = format.actualFormatId != format.intendedFormatId ||
+
+        // Actual bytes to use: the last element doesn't need to be full stride
+        size_t bytesIntendedToUse = (startElement + elementCount - 1) * binding.getStride() +
+                                    format.actualAngleFormat().pixelBytes;
+
+        bool needStreaming = format.actualFormatId != format.intendedFormatId ||
                              (binding.getStride() % mtl::kVertexAttribBufferStrideAlignment) != 0 ||
                              (binding.getStride() < format.actualAngleFormat().pixelBytes) ||
                              bytesIntendedToUse > mInlineDataMaxSize;