Fix a bug with count on commands that take a count

and add some more DCHECKs

Some commands should never have a negative count 
since the count refers to how much memory to access.
So, made those commands check for negative count on the client
side and kill the GPU process if they are negative on the
service side.

Note: Someone (me?) checked in a version of build_gles2_cmd_buffer.py
that generates a Finish handler that actually calls glFinish but
didn't check in the generated code.

Should I put that back to glFlush?

TEST=ran unit tests and opengl es 2.0 conformance tests
BUG=none

Review URL: http://codereview.chromium.org/4461001

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@65063 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 16 insertions, 9 deletions

diff --git a/gpu/command_buffer/service/program_manager.cc b/gpu/command_buffer/service/program_manager.cc
index c19806a..c94bd9b 100644
--- a/gpu/command_buffer/service/program_manager.cc
+++ b/gpu/command_buffer/service/program_manager.cc
@@ -64,10 +64,13 @@ void ProgramManager::ProgramInfo::Reset() {
 }
 
 void ProgramManager::ProgramInfo::UpdateLogInfo() {
+  GLint max_len = 0;
+  glGetProgramiv(service_id_, GL_INFO_LOG_LENGTH, &max_len);
+  scoped_array<char> temp(new char[max_len]);
   GLint len = 0;
-  glGetProgramiv(service_id_, GL_INFO_LOG_LENGTH, &len);
-  scoped_array<char> temp(new char[len]);
-  glGetProgramInfoLog(service_id_, len, &len, temp.get());
+  glGetProgramInfoLog(service_id_, max_len, &len, temp.get());
+  DCHECK(max_len == 0 || len < max_len);
+  DCHECK(len == 0 || temp[len] == '\0');
   set_log_info(std::string(temp.get(), len));
 }
 
@@ -81,11 +84,13 @@ void ProgramManager::ProgramInfo::Update() {
   // TODO(gman): Should we check for error?
   scoped_array<char> name_buffer(new char[max_len]);
   for (GLint ii = 0; ii < num_attribs; ++ii) {
-    GLsizei length;
-    GLsizei size;
-    GLenum type;
+    GLsizei length = 0;
+    GLsizei size = 0;
+    GLenum type = 0;
     glGetActiveAttrib(
         service_id_, ii, max_len, &length, &size, &type, name_buffer.get());
+    DCHECK(max_len == 0 || length < max_len);
+    DCHECK(length == 0 || name_buffer[length] == '\0');
     if (!IsInvalidPrefix(name_buffer.get(), length)) {
       // TODO(gman): Should we check for error?
       GLint location = glGetAttribLocation(service_id_, name_buffer.get());
@@ -116,11 +121,13 @@ void ProgramManager::ProgramInfo::Update() {
   max_location = -1;
   int index = 0;  // this index tracks valid uniforms.
   for (GLint ii = 0; ii < num_uniforms; ++ii) {
-    GLsizei length;
-    GLsizei size;
-    GLenum type;
+    GLsizei length = 0;
+    GLsizei size = 0;
+    GLenum type = 0;
     glGetActiveUniform(
         service_id_, ii, max_len, &length, &size, &type, name_buffer.get());
+    DCHECK(max_len == 0 || length < max_len);
+    DCHECK(length == 0 || name_buffer[length] == '\0');
     // TODO(gman): Should we check for error?
     if (!IsInvalidPrefix(name_buffer.get(), length)) {
       GLint location =  glGetUniformLocation(service_id_, name_buffer.get());