From 48a16bd63d2d5ac42b133ff4da511928af02eb97 Mon Sep 17 00:00:00 2001
From: Le Hoang Quyen <lehoangquyen@chromium.org>
Date: Thu, 17 Sep 2026 17:18:13 +0800
Subject: [PATCH] D3D11: Fix InputLayoutCache key for disabled and multiview attributes

In InputLayoutCache::getInputLayout, the divisor recorded in the
cache key did not account for whether the attribute is enabled, nor
did it use the overflow-safe multiview divisor helper:

1. When an attribute is disabled, D3D11 uses current-value data which
is always stored and fetched with divisor 0 (per-vertex). Recording the
binding's non-zero divisor in the cache key caused collisions with
enabled attributes.
2. In multiview rendering, calculating the cache key divisor via
wrapping 32-bit arithmetic could wrap to 0 (e.g. 0x80000000 * 2),
while VertexArray11 clamped to UINT_MAX via
GetMultiviewAdjustedDivisor.

This change uses GetMultiviewAdjustedDivisor and sets the divisor to 0
for disabled attributes in the cache key.

Bug: chromium:560423758
Bug: chromium:556505644
Change-Id: I0e256bb80d8e9588236be20e001271d9d0698b62
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/8425179
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org>
Commit-Queue: Quyen Le <lehoangquyen@google.com>
Auto-Submit: Quyen Le <lehoangquyen@google.com>
---
diff --git a/src/libANGLE/renderer/d3d/d3d11/InputLayoutCache.cpp b/src/libANGLE/renderer/d3d/d3d11/InputLayoutCache.cpp
index 3795eb4..a3607da 100644
--- a/src/libANGLE/renderer/d3d/d3d11/InputLayoutCache.cpp
+++ b/src/libANGLE/renderer/d3d/d3d11/InputLayoutCache.cpp
@@ -24,6 +24,7 @@
 #include "libANGLE/renderer/d3d/d3d11/ShaderExecutable11.h"
 #include "libANGLE/renderer/d3d/d3d11/VertexArray11.h"
 #include "libANGLE/renderer/d3d/d3d11/formatutils11.h"
+#include "libANGLE/renderer/renderer_utils.h"
 
 namespace rx
 {
@@ -127,7 +128,7 @@
     const auto &attribs            = state.getVertexArray()->getVertexAttributes();
     const auto &bindings           = state.getVertexArray()->getVertexBindings();
     const auto &locationToSemantic = executableD3D->getAttribLocationToD3DSemantics();
-    int divisorMultiplier          = executable->usesMultiview() ? executable->getNumViews() : 1;
+    int numViews = executable->usesMultiview() ? executable->getNumViews() : 1;
 
     for (size_t attribIndex : executable->getActiveAttribLocationsMask())
     {
@@ -143,8 +144,13 @@
             state.getVertexAttribCurrentValue(static_cast<unsigned int>(attribIndex));
         angle::FormatID vertexFormatID = gl::GetVertexFormatID(attrib, currentValue.Type);
 
-        layout.addAttributeData(glslElementType, d3dSemantic, vertexFormatID,
-                                binding.getDivisor() * divisorMultiplier);
+        // Disabled attributes use current-value data, which is stored and fetched with divisor 0
+        // (per-vertex). Using divisor 0 here prevents cache key collisions with enabled attributes
+        // whose binding has a non-zero divisor.
+        GLuint divisor =
+            attrib.enabled ? GetMultiviewAdjustedDivisor(numViews, binding.getDivisor()) : 0;
+
+        layout.addAttributeData(glslElementType, d3dSemantic, vertexFormatID, divisor);
     }
 
     if (layout.numAttributes > 0)
diff --git a/src/tests/gl_tests/MultiviewDrawTest.cpp b/src/tests/gl_tests/MultiviewDrawTest.cpp
index df34655..cafb935 100644
--- a/src/tests/gl_tests/MultiviewDrawTest.cpp
+++ b/src/tests/gl_tests/MultiviewDrawTest.cpp
@@ -1622,6 +1622,76 @@
     EXPECT_EQ(GLColor::green, GetViewColor(0, 0, 1));
 }
 
+// The test verifies that using a large attribute divisor does not cause an internal integer
+// overflow when drawing with multiview after a prior draw with divisor 0.
+TEST_P(MultiviewRenderTest, LargeAttribDivisorWithPriorDraw)
+{
+    ANGLE_SKIP_TEST_IF(!requestMultiviewExtension(isMultisampled()));
+
+    updateFBOs(1, 1, 2);
+
+    const std::string nonMultiviewVS = R"(#version 300 es
+layout(location = 0) in float val;
+out vec4 color;
+void main() {
+  gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+  gl_PointSize = 1.0;
+  color = (val == 0.0) ? vec4(0.0, 1.0, 0.0, 1.0) : vec4(1.0, 0.0, 0.0, 1.0);
+})";
+
+    const std::string multiviewVS = R"(#version 300 es
+#extension )" + extensionName() +
+                                    R"( : require
+layout(num_views = 2) in;
+layout(location = 0) in float val;
+out vec4 color;
+void main() {
+  gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+  gl_PointSize = 1.0;
+  color = (val == 0.0) ? vec4(0.0, 1.0, 0.0, 1.0) : vec4(1.0, 0.0, 0.0, 1.0);
+})";
+
+    constexpr char kFS[] = R"(#version 300 es
+precision mediump float;
+in vec4 color;
+out vec4 outColor;
+void main() { outColor = color; })";
+
+    ANGLE_GL_PROGRAM(nonMultiviewProgram, nonMultiviewVS.c_str(), kFS);
+    ANGLE_GL_PROGRAM(multiviewProgram, multiviewVS.c_str(), kFS);
+
+    // Buffer with 2 floats: index 0 is 0.0f (green); index 1 is 1.0f (red).
+    const float kData[2] = {0.0f, 1.0f};
+    GLBuffer buffer;
+    glBindBuffer(GL_ARRAY_BUFFER, buffer);
+    glBufferData(GL_ARRAY_BUFFER, sizeof(kData), kData, GL_STATIC_DRAW);
+
+    glVertexAttribPointer(0, 1, GL_FLOAT, GL_FALSE, 0, nullptr);
+    glEnableVertexAttribArray(0);
+
+    // Initial draw with single-view program and divisor 0.
+    glBindFramebuffer(GL_DRAW_FRAMEBUFFER, 0);
+    glVertexAttribDivisor(0, 0);
+    glUseProgram(nonMultiviewProgram);
+    glDrawArrays(GL_POINTS, 0, 1);
+    ASSERT_GL_NO_ERROR();
+
+    // Subsequent draw with 2-view multiview program and large divisor.
+    bindMemberDrawFramebuffer();
+    glViewport(0, 0, 1, 1);
+    glClearColor(0, 0, 0, 1);
+    glClear(GL_COLOR_BUFFER_BIT);
+
+    glVertexAttribDivisor(0, 0x80000000u);
+    glUseProgram(multiviewProgram);
+    glDrawArraysInstanced(GL_POINTS, 0, 2, 1);
+    ASSERT_GL_NO_ERROR();
+
+    resolveMultisampledFBO();
+    EXPECT_EQ(GLColor::green, GetViewColor(0, 0, 0));
+    EXPECT_EQ(GLColor::green, GetViewColor(0, 0, 1));
+}
+
 // Test that different sequences of vertexAttribDivisor, useProgram and bindVertexArray in a
 // multi-view context propagate the correct divisor to the driver.
 TEST_P(MultiviewRenderTest, DivisorOrderOfOperation)
diff --git a/src/tests/gl_tests/TransformFeedbackTest.cpp b/src/tests/gl_tests/TransformFeedbackTest.cpp
index 3a74bc3..e71f68b 100644
--- a/src/tests/gl_tests/TransformFeedbackTest.cpp
+++ b/src/tests/gl_tests/TransformFeedbackTest.cpp
@@ -5473,6 +5473,72 @@
     EXPECT_EQ(6u, primitivesWritten);
 }
 
+// Test that an instanced attribute with a non-zero divisor produces the expected value across
+// all vertices of an instance, even after an intervening draw where the attribute was disabled.
+TEST_P(TransformFeedbackTest, InstancedAttributeAfterDisabledAttribDraw)
+{
+    constexpr char kVS[] = R"(#version 300 es
+layout(location=0) in vec4 value;
+out vec4 captured;
+void main() {
+  captured = value;
+  gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+  gl_PointSize = 1.0;
+})";
+
+    constexpr char kFS[] = R"(#version 300 es
+precision highp float;
+out vec4 color;
+void main() {
+  color = vec4(0.0);
+})";
+
+    std::vector<std::string> tfVaryings = {"captured"};
+    ANGLE_GL_PROGRAM_TRANSFORM_FEEDBACK(program, kVS, kFS, tfVaryings, GL_INTERLEAVED_ATTRIBS);
+    glUseProgram(program);
+
+    constexpr std::array<float, 4> kMarker = {11.25f, 22.5f, 33.75f, 44.125f};
+    GLBuffer source;
+    glBindBuffer(GL_ARRAY_BUFFER, source);
+    glBufferData(GL_ARRAY_BUFFER, sizeof(kMarker), kMarker.data(), GL_DYNAMIC_DRAW);
+    glVertexAttribPointer(0, 4, GL_FLOAT, GL_FALSE, 16, nullptr);
+    glVertexAttribDivisor(0, 0xffffffffu);
+
+    // Initial draw with attribute 0 disabled.
+    glDisableVertexAttribArray(0);
+    glVertexAttrib4fv(0, kMarker.data());
+    glDrawArraysInstanced(GL_POINTS, 0, 1, 1);
+    glFinish();
+
+    // Re-enable attribute 0 and capture vertices via transform feedback in an instanced draw.
+    glEnableVertexAttribArray(0);
+    constexpr GLsizei kCount = 64;
+    GLBuffer destination;
+    glBindBuffer(GL_TRANSFORM_FEEDBACK_BUFFER, destination);
+    glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, kCount * sizeof(kMarker), nullptr, GL_DYNAMIC_READ);
+    glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, destination);
+
+    glEnable(GL_RASTERIZER_DISCARD);
+    glBeginTransformFeedback(GL_POINTS);
+    glDrawArraysInstanced(GL_POINTS, 0, kCount, 1);
+    glEndTransformFeedback();
+    glDisable(GL_RASTERIZER_DISCARD);
+    glFinish();
+    ASSERT_GL_NO_ERROR();
+
+    const float *captured = static_cast<const float *>(glMapBufferRange(
+        GL_TRANSFORM_FEEDBACK_BUFFER, 0, kCount * sizeof(kMarker), GL_MAP_READ_BIT));
+    ASSERT_NE(nullptr, captured);
+    for (GLsizei vertex = 0; vertex < kCount; ++vertex)
+    {
+        EXPECT_EQ(kMarker[0], captured[vertex * 4 + 0]) << "vertex " << vertex;
+        EXPECT_EQ(kMarker[1], captured[vertex * 4 + 1]) << "vertex " << vertex;
+        EXPECT_EQ(kMarker[2], captured[vertex * 4 + 2]) << "vertex " << vertex;
+        EXPECT_EQ(kMarker[3], captured[vertex * 4 + 3]) << "vertex " << vertex;
+    }
+    glUnmapBuffer(GL_TRANSFORM_FEEDBACK_BUFFER);
+}
+
 class HardenedTransformFeedbackTest : public TransformFeedbackTest
 {
   public:

diff --git a/src/tests/gl_tests/MultiviewDrawTest.cpp b/src/tests/gl_tests/MultiviewDrawTest.cpp
index df34655..cafb935 100644
--- a/src/tests/gl_tests/MultiviewDrawTest.cpp
+++ b/src/tests/gl_tests/MultiviewDrawTest.cpp
@@ -1622,6 +1622,76 @@
     EXPECT_EQ(GLColor::green, GetViewColor(0, 0, 1));
 }
 
+// The test verifies that using a large attribute divisor does not cause an internal integer
+// overflow when drawing with multiview after a prior draw with divisor 0.
+TEST_P(MultiviewRenderTest, LargeAttribDivisorWithPriorDraw)
+{
+    ANGLE_SKIP_TEST_IF(!requestMultiviewExtension(isMultisampled()));
+
+    updateFBOs(1, 1, 2);
+
+    const std::string nonMultiviewVS = R"(#version 300 es
+layout(location = 0) in float val;
+out vec4 color;
+void main() {
+  gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+  gl_PointSize = 1.0;
+  color = (val == 0.0) ? vec4(0.0, 1.0, 0.0, 1.0) : vec4(1.0, 0.0, 0.0, 1.0);
+})";
+
+    const std::string multiviewVS = R"(#version 300 es
+#extension )" + extensionName() +
+                                    R"( : require
+layout(num_views = 2) in;
+layout(location = 0) in float val;
+out vec4 color;
+void main() {
+  gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+  gl_PointSize = 1.0;
+  color = (val == 0.0) ? vec4(0.0, 1.0, 0.0, 1.0) : vec4(1.0, 0.0, 0.0, 1.0);
+})";
+
+    constexpr char kFS[] = R"(#version 300 es
+precision mediump float;
+in vec4 color;
+out vec4 outColor;
+void main() { outColor = color; })";
+
+    ANGLE_GL_PROGRAM(nonMultiviewProgram, nonMultiviewVS.c_str(), kFS);
+    ANGLE_GL_PROGRAM(multiviewProgram, multiviewVS.c_str(), kFS);
+
+    // Buffer with 2 floats: index 0 is 0.0f (green); index 1 is 1.0f (red).
+    const float kData[2] = {0.0f, 1.0f};
+    GLBuffer buffer;
+    glBindBuffer(GL_ARRAY_BUFFER, buffer);
+    glBufferData(GL_ARRAY_BUFFER, sizeof(kData), kData, GL_STATIC_DRAW);
+
+    glVertexAttribPointer(0, 1, GL_FLOAT, GL_FALSE, 0, nullptr);
+    glEnableVertexAttribArray(0);
+
+    // Initial draw with single-view program and divisor 0.
+    glBindFramebuffer(GL_DRAW_FRAMEBUFFER, 0);
+    glVertexAttribDivisor(0, 0);
+    glUseProgram(nonMultiviewProgram);
+    glDrawArrays(GL_POINTS, 0, 1);
+    ASSERT_GL_NO_ERROR();
+
+    // Subsequent draw with 2-view multiview program and large divisor.
+    bindMemberDrawFramebuffer();
+    glViewport(0, 0, 1, 1);
+    glClearColor(0, 0, 0, 1);
+    glClear(GL_COLOR_BUFFER_BIT);
+
+    glVertexAttribDivisor(0, 0x80000000u);
+    glUseProgram(multiviewProgram);
+    glDrawArraysInstanced(GL_POINTS, 0, 2, 1);
+    ASSERT_GL_NO_ERROR();
+
+    resolveMultisampledFBO();
+    EXPECT_EQ(GLColor::green, GetViewColor(0, 0, 0));
+    EXPECT_EQ(GLColor::green, GetViewColor(0, 0, 1));
+}
+
 // Test that different sequences of vertexAttribDivisor, useProgram and bindVertexArray in a
 // multi-view context propagate the correct divisor to the driver.
 TEST_P(MultiviewRenderTest, DivisorOrderOfOperation)
diff --git a/src/tests/gl_tests/TransformFeedbackTest.cpp b/src/tests/gl_tests/TransformFeedbackTest.cpp
index 3a74bc3..e71f68b 100644
--- a/src/tests/gl_tests/TransformFeedbackTest.cpp
+++ b/src/tests/gl_tests/TransformFeedbackTest.cpp
@@ -5473,6 +5473,72 @@
     EXPECT_EQ(6u, primitivesWritten);
 }
 
+// Test that an instanced attribute with a non-zero divisor produces the expected value across
+// all vertices of an instance, even after an intervening draw where the attribute was disabled.
+TEST_P(TransformFeedbackTest, InstancedAttributeAfterDisabledAttribDraw)
+{
+    constexpr char kVS[] = R"(#version 300 es
+layout(location=0) in vec4 value;
+out vec4 captured;
+void main() {
+  captured = value;
+  gl_Position = vec4(0.0, 0.0, 0.0, 1.0);
+  gl_PointSize = 1.0;
+})";
+
+    constexpr char kFS[] = R"(#version 300 es
+precision highp float;
+out vec4 color;
+void main() {
+  color = vec4(0.0);
+})";
+
+    std::vector<std::string> tfVaryings = {"captured"};
+    ANGLE_GL_PROGRAM_TRANSFORM_FEEDBACK(program, kVS, kFS, tfVaryings, GL_INTERLEAVED_ATTRIBS);
+    glUseProgram(program);
+
+    constexpr std::array<float, 4> kMarker = {11.25f, 22.5f, 33.75f, 44.125f};
+    GLBuffer source;
+    glBindBuffer(GL_ARRAY_BUFFER, source);
+    glBufferData(GL_ARRAY_BUFFER, sizeof(kMarker), kMarker.data(), GL_DYNAMIC_DRAW);
+    glVertexAttribPointer(0, 4, GL_FLOAT, GL_FALSE, 16, nullptr);
+    glVertexAttribDivisor(0, 0xffffffffu);
+
+    // Initial draw with attribute 0 disabled.
+    glDisableVertexAttribArray(0);
+    glVertexAttrib4fv(0, kMarker.data());
+    glDrawArraysInstanced(GL_POINTS, 0, 1, 1);
+    glFinish();
+
+    // Re-enable attribute 0 and capture vertices via transform feedback in an instanced draw.
+    glEnableVertexAttribArray(0);
+    constexpr GLsizei kCount = 64;
+    GLBuffer destination;
+    glBindBuffer(GL_TRANSFORM_FEEDBACK_BUFFER, destination);
+    glBufferData(GL_TRANSFORM_FEEDBACK_BUFFER, kCount * sizeof(kMarker), nullptr, GL_DYNAMIC_READ);
+    glBindBufferBase(GL_TRANSFORM_FEEDBACK_BUFFER, 0, destination);
+
+    glEnable(GL_RASTERIZER_DISCARD);
+    glBeginTransformFeedback(GL_POINTS);
+    glDrawArraysInstanced(GL_POINTS, 0, kCount, 1);
+    glEndTransformFeedback();
+    glDisable(GL_RASTERIZER_DISCARD);
+    glFinish();
+    ASSERT_GL_NO_ERROR();
+
+    const float *captured = static_cast<const float *>(glMapBufferRange(
+        GL_TRANSFORM_FEEDBACK_BUFFER, 0, kCount * sizeof(kMarker), GL_MAP_READ_BIT));
+    ASSERT_NE(nullptr, captured);
+    for (GLsizei vertex = 0; vertex < kCount; ++vertex)
+    {
+        EXPECT_EQ(kMarker[0], captured[vertex * 4 + 0]) << "vertex " << vertex;
+        EXPECT_EQ(kMarker[1], captured[vertex * 4 + 1]) << "vertex " << vertex;
+        EXPECT_EQ(kMarker[2], captured[vertex * 4 + 2]) << "vertex " << vertex;
+        EXPECT_EQ(kMarker[3], captured[vertex * 4 + 3]) << "vertex " << vertex;
+    }
+    glUnmapBuffer(GL_TRANSFORM_FEEDBACK_BUFFER);
+}
+
 class HardenedTransformFeedbackTest : public TransformFeedbackTest
 {
   public: