Bug 1339256 - Simplify index validation. - r=kvark
authorJeff Gilbert <jgilbert@mozilla.com>
Thu, 09 Feb 2017 20:32:58 -0800
changeset 346680 ddb0bfb55854f50ab2fcb96f4ed7f2ef4f84e99c
parent 346679 3a168a559693192762e15079b5ca267d1e0a0b53
child 346681 79d152f90a492d386975e65a39bcb6161f4df121
push id31474
push usercbook@mozilla.com
push dateThu, 09 Mar 2017 10:23:37 +0000
treeherdermozilla-central@da0ea1c72207 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerskvark
bugs1339256
milestone55.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1339256 - Simplify index validation. - r=kvark MozReview-Commit-ID: 4FALdIyhBP8
dom/canvas/WebGLBuffer.cpp
dom/canvas/WebGLBuffer.h
dom/canvas/WebGLContext.h
dom/canvas/WebGLContextBuffers.cpp
dom/canvas/WebGLContextDraw.cpp
dom/canvas/WebGLElementArrayCache.cpp
dom/canvas/WebGLElementArrayCache.h
dom/canvas/WebGLTypes.h
dom/canvas/gtest/TestWebGLElementArrayCache.cpp
dom/canvas/gtest/moz.build
dom/canvas/moz.build
dom/canvas/test/webgl-conf/generated-mochitest.ini
dom/canvas/test/webgl-conf/mochitest-errata.ini
--- a/dom/canvas/WebGLBuffer.cpp
+++ b/dom/canvas/WebGLBuffer.cpp
@@ -3,17 +3,16 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "WebGLBuffer.h"
 
 #include "GLContext.h"
 #include "mozilla/dom/WebGLRenderingContextBinding.h"
 #include "WebGLContext.h"
-#include "WebGLElementArrayCache.h"
 
 namespace mozilla {
 
 WebGLBuffer::WebGLBuffer(WebGLContext* webgl, GLuint buf)
     : WebGLRefCountedObject(webgl)
     , mGLName(buf)
     , mContent(Kind::Undefined)
     , mUsage(LOCAL_GL_STATIC_DRAW)
@@ -33,19 +32,16 @@ void
 WebGLBuffer::SetContentAfterBind(GLenum target)
 {
     if (mContent != Kind::Undefined)
         return;
 
     switch (target) {
     case LOCAL_GL_ELEMENT_ARRAY_BUFFER:
         mContent = Kind::ElementArray;
-        if (!mCache) {
-            mCache.reset(new WebGLElementArrayCache);
-        }
         break;
 
     case LOCAL_GL_ARRAY_BUFFER:
     case LOCAL_GL_PIXEL_PACK_BUFFER:
     case LOCAL_GL_PIXEL_UNPACK_BUFFER:
     case LOCAL_GL_UNIFORM_BUFFER:
     case LOCAL_GL_TRANSFORM_FEEDBACK_BUFFER:
     case LOCAL_GL_COPY_READ_BUFFER:
@@ -59,17 +55,18 @@ WebGLBuffer::SetContentAfterBind(GLenum 
 }
 
 void
 WebGLBuffer::Delete()
 {
     mContext->MakeContextCurrent();
     mContext->gl->fDeleteBuffers(1, &mGLName);
     mByteLength = 0;
-    mCache = nullptr;
+    mIndexCache = nullptr;
+    mIndexRanges.clear();
     LinkedListElement<WebGLBuffer>::remove(); // remove from mContext->mBuffers
 }
 
 ////////////////////////////////////////
 
 static bool
 ValidateBufferUsageEnum(WebGLContext* webgl, const char* funcName, GLenum usage)
 {
@@ -105,56 +102,107 @@ WebGLBuffer::BufferData(GLenum target, s
     // Careful: data.Length() could conceivably be any uint32_t, but GLsizeiptr
     // is like intptr_t.
     if (!CheckedInt<GLsizeiptr>(size).isValid())
         return mContext->ErrorOutOfMemory("%s: bad size", funcName);
 
     if (!ValidateBufferUsageEnum(mContext, funcName, usage))
         return;
 
-    const auto& gl = mContext->gl;
-    gl->MakeCurrent();
-    const ScopedLazyBind lazyBind(gl, target, this);
-    mContext->InvalidateBufferFetching();
-
 #ifdef XP_MACOSX
     // bug 790879
-    if (gl->WorkAroundDriverBugs() &&
+    if (mContext->gl->WorkAroundDriverBugs() &&
         size > INT32_MAX)
     {
         mContext->ErrorOutOfMemory("%s: Allocation size too large.", funcName);
         return;
     }
 #endif
 
+    const void* uploadData = data;
+
+    UniqueBuffer newIndexCache;
+    if (target == LOCAL_GL_ELEMENT_ARRAY_BUFFER &&
+        mContext->mNeedsIndexValidation)
+    {
+        newIndexCache = malloc(size);
+        if (!newIndexCache) {
+            mContext->ErrorOutOfMemory("%s: Failed to alloc index cache.", funcName);
+            return;
+        }
+        memcpy(newIndexCache.get(), data, size);
+        uploadData = newIndexCache.get();
+    }
+
+    const auto& gl = mContext->gl;
+    gl->MakeCurrent();
+    const ScopedLazyBind lazyBind(gl, target, this);
+
     const bool sizeChanges = (size != ByteLength());
     if (sizeChanges) {
+        mContext->InvalidateBufferFetching();
+
         gl::GLContext::LocalErrorScope errorScope(*gl);
-        gl->fBufferData(target, size, data, usage);
+        gl->fBufferData(target, size, uploadData, usage);
         const auto error = errorScope.GetError();
 
         if (error) {
             MOZ_ASSERT(error == LOCAL_GL_OUT_OF_MEMORY);
             mContext->ErrorOutOfMemory("%s: Error from driver: 0x%04x", funcName, error);
             return;
         }
     } else {
-        gl->fBufferData(target, size, data, usage);
+        gl->fBufferData(target, size, uploadData, usage);
     }
 
     mUsage = usage;
     mByteLength = size;
+    mIndexCache = Move(newIndexCache);
 
-    // Warning: Possibly shared memory.  See bug 1225033.
-    if (!ElementArrayCacheBufferData(data, size)) {
-        mByteLength = 0;
-        mContext->ErrorOutOfMemory("%s: Failed update index buffer cache.", funcName);
+    if (mIndexCache) {
+        if (mIndexRanges.size()) {
+            mContext->GeneratePerfWarning("[%p] Invalidating %u ranges.", this,
+                                          uint32_t(mIndexRanges.size()));
+            mIndexRanges.clear();
+        }
     }
 }
 
+void
+WebGLBuffer::BufferSubData(GLenum target, size_t dstByteOffset, size_t dataLen,
+                           const void* data) const
+{
+    const char funcName[] = "bufferSubData";
+
+    if (!ValidateRange(funcName, dstByteOffset, dataLen))
+        return;
+
+    if (!CheckedInt<GLintptr>(dataLen).isValid())
+        return mContext->ErrorOutOfMemory("%s: Size too large.", funcName);
+
+    ////
+
+    const void* uploadData = data;
+    if (mIndexCache) {
+        const auto cachedDataBegin = (uint8_t*)mIndexCache.get() + dstByteOffset;
+        memcpy(cachedDataBegin, data, dataLen);
+        uploadData = cachedDataBegin;
+
+        InvalidateCacheRange(dstByteOffset, dataLen);
+    }
+
+    ////
+
+    const auto& gl = mContext->gl;
+    gl->MakeCurrent();
+    const ScopedLazyBind lazyBind(gl, target, this);
+
+    gl->fBufferSubData(target, dstByteOffset, dataLen, uploadData);
+}
+
 bool
 WebGLBuffer::ValidateRange(const char* funcName, size_t byteOffset, size_t byteLen) const
 {
     auto availLength = mByteLength;
     if (byteOffset > availLength) {
         mContext->ErrorInvalidValue("%s: Offset passes the end of the buffer.", funcName);
         return false;
     }
@@ -166,64 +214,141 @@ WebGLBuffer::ValidateRange(const char* f
         return false;
     }
 
     return true;
 }
 
 ////////////////////////////////////////
 
-bool
-WebGLBuffer::ElementArrayCacheBufferData(const void* ptr,
-                                         size_t bufferSizeInBytes)
+static uint8_t
+IndexByteSizeByType(GLenum type)
 {
-    if (mContext->IsWebGL2())
-        return true;
-
-    if (mContent == Kind::ElementArray)
-        return mCache->BufferData(ptr, bufferSizeInBytes);
-
-    return true;
+    switch (type) {
+    case LOCAL_GL_UNSIGNED_BYTE:  return 1;
+    case LOCAL_GL_UNSIGNED_SHORT: return 2;
+    case LOCAL_GL_UNSIGNED_INT:   return 4;
+    default:
+        MOZ_CRASH();
+    }
 }
 
 void
-WebGLBuffer::ElementArrayCacheBufferSubData(size_t pos, const void* ptr,
-                                            size_t updateSizeInBytes)
+WebGLBuffer::InvalidateCacheRange(size_t byteOffset, size_t byteLength) const
 {
-    if (mContext->IsWebGL2())
-        return;
+    MOZ_ASSERT(mIndexCache);
 
-    if (mContent == Kind::ElementArray)
-        mCache->BufferSubData(pos, ptr, updateSizeInBytes);
+    std::vector<IndexRange> invalids;
+    const size_t updateBegin = byteOffset;
+    const size_t updateEnd = updateBegin + byteLength;
+    for (const auto& cur : mIndexRanges) {
+        const auto& range = cur.first;
+        const auto& indexByteSize = IndexByteSizeByType(range.type);
+        const size_t rangeBegin = range.first * indexByteSize;
+        const size_t rangeEnd = rangeBegin + range.count*indexByteSize;
+        if (rangeBegin >= updateEnd || rangeEnd <= updateBegin)
+            continue;
+        invalids.push_back(range);
+    }
+
+    if (invalids.size()) {
+        mContext->GeneratePerfWarning("[%p] Invalidating %u/%u ranges.", this,
+                                      uint32_t(invalids.size()),
+                                      uint32_t(mIndexRanges.size()));
+
+        for (const auto& cur : invalids) {
+            mIndexRanges.erase(cur);
+        }
+    }
 }
 
 size_t
 WebGLBuffer::SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const
 {
-    size_t sizeOfCache = mCache ? mCache->SizeOfIncludingThis(mallocSizeOf)
-                                : 0;
-    return mallocSizeOf(this) + sizeOfCache;
+    size_t size = mallocSizeOf(this);
+    if (mIndexCache) {
+        size += mByteLength;
+    }
+    return size;
 }
 
+template<typename T>
+static size_t
+MaxForRange(const void* data, size_t first, size_t count, const uint32_t ignoredVal)
+{
+    const T ignoredTVal(ignoredVal);
+    T ret = 0;
+
+    auto itr = (const T*)data + first;
+    const auto end = itr + count;
+
+    for (; itr != end; ++itr) {
+        const auto& val = *itr;
+        if (val <= ret)
+            continue;
+
+        if (val == ignoredTVal)
+            continue;
+
+        ret = val;
+    }
+
+    return size_t(ret);
+}
+
+const uint32_t kMaxIndexRanges = 256;
+
 bool
-WebGLBuffer::Validate(GLenum type, uint32_t maxAllowed, size_t first, size_t count) const
+WebGLBuffer::ValidateIndexedFetch(GLenum type, uint32_t numFetchable, size_t first,
+                                  size_t count) const
 {
-    if (mContext->IsWebGL2())
+    if (!mIndexCache)
         return true;
 
-    return mCache->Validate(type, maxAllowed, first, count);
-}
+    if (!count)
+        return true;
+
+    const IndexRange range = { type, first, count };
+    auto res = mIndexRanges.insert({ range, size_t(0) });
+    if (mIndexRanges.size() > kMaxIndexRanges) {
+        mContext->GeneratePerfWarning("[%p] Clearing mIndexRanges after exceeding %u.",
+                                      this, kMaxIndexRanges);
+        mIndexRanges.clear();
+        res = mIndexRanges.insert({ range, size_t(0) });
+    }
+
+    const auto& itr = res.first;
+    const auto& didInsert = res.second;
+
+    auto& maxFetchIndex = itr->second;
+    if (didInsert) {
+        const auto& data = mIndexCache.get();
+        const uint32_t ignoreVal = (mContext->IsWebGL2() ? UINT32_MAX : 0);
 
-bool
-WebGLBuffer::IsElementArrayUsedWithMultipleTypes() const
-{
-    if (mContext->IsWebGL2())
-        return false;
+        switch (type) {
+        case LOCAL_GL_UNSIGNED_BYTE:
+            maxFetchIndex = MaxForRange<uint8_t>(data, first, count, ignoreVal);
+            break;
+        case LOCAL_GL_UNSIGNED_SHORT:
+            maxFetchIndex = MaxForRange<uint16_t>(data, first, count, ignoreVal);
+            break;
+        case LOCAL_GL_UNSIGNED_INT:
+            maxFetchIndex = MaxForRange<uint32_t>(data, first, count, ignoreVal);
+            break;
+        default:
+            MOZ_CRASH();
+        }
 
-    return mCache->BeenUsedWithMultipleTypes();
+        mContext->GeneratePerfWarning("[%p] New range #%u: (0x%04x, %u, %u): %u", this,
+                                      uint32_t(mIndexRanges.size()), type,
+                                      uint32_t(first), uint32_t(count),
+                                      uint32_t(maxFetchIndex));
+    }
+
+    return maxFetchIndex < numFetchable;
 }
 
 ////
 
 bool
 WebGLBuffer::ValidateCanBindToTarget(const char* funcName, GLenum target)
 {
     /* https://www.khronos.org/registry/webgl/specs/latest/2.0/#5.1
--- a/dom/canvas/WebGLBuffer.h
+++ b/dom/canvas/WebGLBuffer.h
@@ -1,28 +1,26 @@
 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef WEBGL_BUFFER_H_
 #define WEBGL_BUFFER_H_
 
+#include <map>
+
 #include "GLDefs.h"
 #include "mozilla/LinkedList.h"
-#include "mozilla/UniquePtr.h"
 #include "nsWrapperCache.h"
-
 #include "WebGLObjectModel.h"
 #include "WebGLTypes.h"
 
 namespace mozilla {
 
-class WebGLElementArrayCache;
-
 class WebGLBuffer final
     : public nsWrapperCache
     , public WebGLRefCountedObject<WebGLBuffer>
     , public LinkedListElement<WebGLBuffer>
 {
     friend class WebGLContext;
     friend class WebGL2Context;
     friend class WebGLTexture;
@@ -41,34 +39,29 @@ public:
 
     void Delete();
 
     size_t SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
 
     GLenum Usage() const { return mUsage; }
     size_t ByteLength() const { return mByteLength; }
 
-    bool ElementArrayCacheBufferData(const void* ptr, size_t bufferSizeInBytes);
-
-    void ElementArrayCacheBufferSubData(size_t pos, const void* ptr,
-                                        size_t updateSizeInBytes);
-
-    bool Validate(GLenum type, uint32_t max_allowed, size_t first, size_t count) const;
+    bool ValidateIndexedFetch(GLenum type, uint32_t max_allowed, size_t first, size_t count) const;
     bool ValidateRange(const char* funcName, size_t byteOffset, size_t byteLen) const;
 
-    bool IsElementArrayUsedWithMultipleTypes() const;
-
     WebGLContext* GetParentObject() const {
         return mContext;
     }
 
     virtual JSObject* WrapObject(JSContext* cx, JS::Handle<JSObject*> givenProto) override;
 
     bool ValidateCanBindToTarget(const char* funcName, GLenum target);
     void BufferData(GLenum target, size_t size, const void* data, GLenum usage);
+    void BufferSubData(GLenum target, size_t dstByteOffset, size_t dataLen,
+                       const void* data) const;
 
     ////
 
     static void AddBindCount(GLenum target, WebGLBuffer* buffer, int8_t addVal) {
         if (!buffer)
             return;
 
         if (target == LOCAL_GL_TRANSFORM_FEEDBACK_BUFFER) {
@@ -97,19 +90,39 @@ public:
     const GLenum mGLName;
 
     NS_INLINE_DECL_CYCLE_COLLECTING_NATIVE_REFCOUNTING(WebGLBuffer)
     NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_NATIVE_CLASS(WebGLBuffer)
 
 protected:
     ~WebGLBuffer();
 
+    void InvalidateCacheRange(size_t offset, size_t length) const;
+
     Kind mContent;
     GLenum mUsage;
     size_t mByteLength;
-    UniquePtr<WebGLElementArrayCache> mCache;
     size_t mTFBindCount;
     size_t mNonTFBindCount;
+
+    struct IndexRange final {
+        GLenum type;
+        size_t first;
+        size_t count;
+
+        bool operator<(const IndexRange& x) const {
+            if (type != x.type)
+                return type < x.type;
+
+            if (first != x.first)
+                return first < x.first;
+
+            return count < x.count;
+        }
+    };
+
+    UniqueBuffer mIndexCache;
+    mutable std::map<IndexRange, size_t> mIndexRanges;
 };
 
 } // namespace mozilla
 
 #endif // WEBGL_BUFFER_H_
--- a/dom/canvas/WebGLContext.h
+++ b/dom/canvas/WebGLContext.h
@@ -2109,60 +2109,16 @@ bool
 ValidateTexTarget(WebGLContext* webgl, const char* funcName, uint8_t funcDims,
                   GLenum rawTexTarget, TexTarget* const out_texTarget,
                   WebGLTexture** const out_tex);
 bool
 ValidateTexImageTarget(WebGLContext* webgl, const char* funcName, uint8_t funcDims,
                        GLenum rawTexImageTarget, TexImageTarget* const out_texImageTarget,
                        WebGLTexture** const out_tex);
 
-class UniqueBuffer
-{
-    // Like UniquePtr<>, but for void* and malloc/calloc/free.
-    void* mBuffer;
-
-public:
-    UniqueBuffer()
-        : mBuffer(nullptr)
-    { }
-
-    MOZ_IMPLICIT UniqueBuffer(void* buffer)
-        : mBuffer(buffer)
-    { }
-
-    ~UniqueBuffer() {
-        free(mBuffer);
-    }
-
-    UniqueBuffer(UniqueBuffer&& other) {
-        this->mBuffer = other.mBuffer;
-        other.mBuffer = nullptr;
-    }
-
-    UniqueBuffer& operator =(UniqueBuffer&& other) {
-        free(this->mBuffer);
-        this->mBuffer = other.mBuffer;
-        other.mBuffer = nullptr;
-        return *this;
-    }
-
-    UniqueBuffer& operator =(void* newBuffer) {
-        free(this->mBuffer);
-        this->mBuffer = newBuffer;
-        return *this;
-    }
-
-    explicit operator bool() const { return bool(mBuffer); }
-
-    void* get() const { return mBuffer; }
-
-    UniqueBuffer(const UniqueBuffer& other) = delete; // construct using Move()!
-    void operator =(const UniqueBuffer& other) = delete; // assign using Move()!
-};
-
 class ScopedUnpackReset final
     : public gl::ScopedGLWrapper<ScopedUnpackReset>
 {
     friend struct gl::ScopedGLWrapper<ScopedUnpackReset>;
 
 private:
     WebGLContext* const mWebGL;
 
--- a/dom/canvas/WebGLContextBuffers.cpp
+++ b/dom/canvas/WebGLContextBuffers.cpp
@@ -397,36 +397,20 @@ WebGLContext::BufferSubDataImpl(GLenum t
 
     if (!ValidateNonNegative(funcName, "byteOffset", dstByteOffset))
         return;
 
     const auto& buffer = ValidateBufferSelection(funcName, target);
     if (!buffer)
         return;
 
-    if (!buffer->ValidateRange(funcName, dstByteOffset, dataLen))
-        return;
-
-    if (!CheckedInt<GLintptr>(dataLen).isValid()) {
-        ErrorOutOfMemory("%s: Size too large.", funcName);
-        return;
-    }
-    const GLintptr glDataLen(dataLen);
+    buffer->BufferSubData(target, size_t(dstByteOffset), dataLen, data);
+}
 
-    ////
-
-    MakeContextCurrent();
-    const ScopedLazyBind lazyBind(gl, target, buffer);
-
-    // Warning: Possibly shared memory.  See bug 1225033.
-    gl->fBufferSubData(target, dstByteOffset, glDataLen, data);
-
-    // Warning: Possibly shared memory.  See bug 1225033.
-    buffer->ElementArrayCacheBufferSubData(dstByteOffset, data, size_t(glDataLen));
-}
+////
 
 void
 WebGLContext::BufferSubData(GLenum target, WebGLsizeiptr dstByteOffset,
                             const dom::ArrayBuffer& src)
 {
     if (IsContextLost())
         return;
 
--- a/dom/canvas/WebGLContextDraw.cpp
+++ b/dom/canvas/WebGLContextDraw.cpp
@@ -733,33 +733,24 @@ WebGLContext::DrawElements_check(const c
                               funcName);
         return false;
     }
 
     if (!ValidateBufferFetching(funcName))
         return false;
 
     if (!mMaxFetchedVertices ||
-        !elemArrayBuffer.Validate(type, mMaxFetchedVertices - 1, first, vertCount))
+        !elemArrayBuffer.ValidateIndexedFetch(type, mMaxFetchedVertices, first, vertCount))
     {
         ErrorInvalidOperation("%s: bound vertex attribute buffers do not have sufficient "
                               "size for given indices from the bound element array",
                               funcName);
         return false;
     }
 
-    // Bug 1008310 - Check if buffer has been used with a different previous type
-    if (elemArrayBuffer.IsElementArrayUsedWithMultipleTypes()) {
-        nsCString typeName;
-        WebGLContext::EnumName(type, &typeName);
-        GenerateWarning("%s: bound element array buffer previously used with a type other than "
-                        "%s, this will affect performance.",
-                        funcName, typeName.BeginReading());
-    }
-
     return true;
 }
 
 static void
 HandleDrawElementsErrors(WebGLContext* webgl, const char* funcName,
                          gl::GLContext::LocalErrorScope& errorScope)
 {
     const auto err = errorScope.GetError();
@@ -989,18 +980,18 @@ WebGLContext::ValidateBufferFetching(con
         }
 
         size_t availBytes = bufByteLen - vd.ByteOffset();
         if (vd.BytesPerVertex() > availBytes) {
             maxVertices = 0;
             maxInstances = 0;
             break;
         }
-        availBytes -= vd.BytesPerVertex();
-        const size_t vertCapacity = 1 + availBytes / vd.ExplicitStride();
+        availBytes -= vd.BytesPerVertex(); // Snip off the tail.
+        const size_t vertCapacity = availBytes / vd.ExplicitStride() + 1; // Add +1 for the snipped tail.
 
         if (vd.mDivisor == 0) {
             if (vertCapacity < maxVertices) {
                 maxVertices = vertCapacity;
             }
             hasPerVertex = true;
         } else {
             const auto curMaxInstances = CheckedInt<size_t>(vertCapacity) * vd.mDivisor;
deleted file mode 100644
--- a/dom/canvas/WebGLElementArrayCache.cpp
+++ /dev/null
@@ -1,622 +0,0 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "WebGLElementArrayCache.h"
-
-#include <algorithm>
-#include <cstdlib>
-#include <cstring>
-#include <limits>
-#include "mozilla/Assertions.h"
-#include "mozilla/MathAlgorithms.h"
-#include "mozilla/MemoryReporting.h"
-
-namespace mozilla {
-
-/* WebGLElementArrayCacheTree contains most of the implementation of
- * WebGLElementArrayCache, which performs WebGL element array buffer validation
- * for drawElements.
- *
- * Attention: Here lie nontrivial data structures, bug-prone algorithms, and
- * non-canonical tweaks! Whence the explanatory comments, and compiled unit
- * test.
- *
- * *** What problem are we solving here? ***
- *
- * WebGL::DrawElements has to validate that the elements are in range wrt the
- * current vertex attribs. This boils down to the problem, given an array of
- * integers, of computing the maximum in an arbitrary sub-array. The naive
- * algorithm has linear complexity; this has been a major performance problem,
- * see bug 569431. In that bug, we took the approach of caching the max for the
- * whole array, which does cover most cases (DrawElements typically consumes the
- * whole element array buffer) but doesn't help in other use cases:
- *  - when doing "partial DrawElements" i.e. consuming only part of the element
- *    array buffer
- *  - when doing frequent "partial buffer updates" i.e. bufferSubData calls
- *    updating parts of the element array buffer
- *
- * *** The solution: A binary tree ***
- *
- * The solution implemented here is to use a binary tree as the cache data
- * structure. Each tree node contains the max of its two children nodes. In this
- * way, finding the maximum in any contiguous sub-array has log complexity
- * instead of linear complexity.
- *
- * Simplistically, if the element array is:
- *
- *    [1   4   3   2]
- *
- * then the corresponding tree is:
- *
- *           4
- *         _/ \_
- *       4       3
- *      / \     / \
- *     1   4   3   2
- *
- * In practice, the bottom-most levels of the tree are both the largest to store
- * (because they have more nodes), and the least useful performance-wise
- * (because each node in the bottom levels concerns only few entries in the
- * elements array buffer, it is cheap to compute).
- *
- * For this reason, we stop the tree a few levels above, so that each tree leaf
- * actually corresponds to more than one element array entry.
- *
- * The number of levels that we "drop" is |kSkippedBottomTreeLevels| and the
- * number of element array entries that each leaf corresponds to, is
- * |kElementsPerLeaf|. This being a binary tree, we have:
- *
- *   kElementsPerLeaf = 2 ^ kSkippedBottomTreeLevels.
- *
- * *** Storage layout of the binary tree ***
- *
- * We take advantage of the specifics of the situation to avoid generalist tree
- * storage and instead store the tree entries in a vector, mTreeData.
- *
- * TreeData is always a vector of length:
- *
- *    2 * (number of leaves).
- *
- * Its data layout is as follows: mTreeData[0] is unused, mTreeData[1] is the
- * root node, then at offsets 2..3 is the tree level immediately below the root
- * node, then at offsets 4..7 is the tree level below that, etc.
- *
- * The figure below illustrates this by writing at each tree node the offset
- * into mTreeData at which it is stored:
- *
- *           1
- *         _/ \_
- *       2       3
- *      / \     / \
- *     4   5   6   7
- *    ...
- *
- * Thus, under the convention that the root level is level 0, we see that level
- * N is stored at offsets:
- *
- *    [ 2^n .. 2^(n+1) - 1 ]
- *
- * in mTreeData. Likewise, all the usual tree operations have simple
- * mathematical expressions in terms of mTreeData offsets, see all the methods
- * such as ParentNode, LeftChildNode, etc.
- *
- * *** Design constraint: Element types aren't known at buffer-update time ***
- *
- * Note that a key constraint that we're operating under, is that we don't know
- * the types of the elements by the time WebGL bufferData/bufferSubData methods
- * are called. The type of elements is only specified in the drawElements call.
- * This means that we may potentially have to store caches for multiple element
- * types, for the same element array buffer. Since we don't know yet how many
- * element types we'll eventually support (extensions add more), the concern
- * about memory usage is serious. This is addressed by kSkippedBottomTreeLevels
- * as explained above. Of course, in the typical case where each element array
- * buffer is only ever used with one type, this is also addressed by having
- * WebGLElementArrayCache lazily create trees for each type only upon first use.
- *
- * Another consequence of this constraint is that when updating the trees, we
- * have to update all existing trees. So if trees for types uint8_t, uint16_t
- * and uint32_t have ever been constructed for this buffer, every subsequent
- * update will have to update all trees even if one of the types is never used
- * again. That's inefficient, but content should not put indices of different
- * types in the same element array buffer anyways. Different index types can
- * only be consumed in separate drawElements calls, so nothing particular is
- * to be achieved by lumping them in the same buffer object.
- */
-template<typename T>
-struct WebGLElementArrayCacheTree
-{
-    /* A too-high kSkippedBottomTreeLevels would harm the performance of small
-     * drawElements calls. A too-low kSkippedBottomTreeLevels would cause undue
-     * memory usage. The current value has been validated by some benchmarking.
-     * See bug 732660.
-     */
-    static const size_t kSkippedBottomTreeLevels = 3;
-    static const size_t kElementsPerLeaf = 1 << kSkippedBottomTreeLevels;
-    // Since kElementsPerLeaf is POT:
-    static const size_t kElementsPerLeafMask = kElementsPerLeaf - 1;
-
-private:
-    // The WebGLElementArrayCache that owns this tree:
-    WebGLElementArrayCache& mParent;
-
-    // The tree's internal data storage. Its length is 2 * (number of leaves)
-    // because of its data layout explained in the above class comment.
-    FallibleTArray<T> mTreeData;
-
-public:
-    // Constructor. Takes a reference to the WebGLElementArrayCache that is to be
-    // the parent. Does not initialize the tree. Should be followed by a call
-    // to Update() to attempt initializing the tree.
-    explicit WebGLElementArrayCacheTree(WebGLElementArrayCache& value)
-        : mParent(value)
-    {
-    }
-
-    T GlobalMaximum() const {
-        return mTreeData[1];
-    }
-
-    // returns the index of the parent node; if treeIndex=1 (the root node),
-    // the return value is 0.
-    static size_t ParentNode(size_t treeIndex) {
-        MOZ_ASSERT(treeIndex > 1);
-        return treeIndex >> 1;
-    }
-
-    static bool IsRightNode(size_t treeIndex) {
-        MOZ_ASSERT(treeIndex > 1);
-        return treeIndex & 1;
-    }
-
-    static bool IsLeftNode(size_t treeIndex) {
-        MOZ_ASSERT(treeIndex > 1);
-        return !IsRightNode(treeIndex);
-    }
-
-    static size_t SiblingNode(size_t treeIndex) {
-        MOZ_ASSERT(treeIndex > 1);
-        return treeIndex ^ 1;
-    }
-
-    static size_t LeftChildNode(size_t treeIndex) {
-        MOZ_ASSERT(treeIndex);
-        return treeIndex << 1;
-    }
-
-    static size_t RightChildNode(size_t treeIndex) {
-        MOZ_ASSERT(treeIndex);
-        return SiblingNode(LeftChildNode(treeIndex));
-    }
-
-    static size_t LeftNeighborNode(size_t treeIndex, size_t distance = 1) {
-        MOZ_ASSERT(treeIndex > 1);
-        return treeIndex - distance;
-    }
-
-    static size_t RightNeighborNode(size_t treeIndex, size_t distance = 1) {
-        MOZ_ASSERT(treeIndex > 1);
-        return treeIndex + distance;
-    }
-
-    size_t NumLeaves() const {
-        // See class comment for why we the tree storage size is 2 * numLeaves.
-        return mTreeData.Length() >> 1;
-    }
-
-    size_t LeafForElement(size_t element) const {
-        size_t leaf = element / kElementsPerLeaf;
-        MOZ_ASSERT(leaf < NumLeaves());
-        return leaf;
-    }
-
-    size_t LeafForByte(size_t byte) const {
-        return LeafForElement(byte / sizeof(T));
-    }
-
-    // Returns the index, into the tree storage, where a given leaf is stored.
-    size_t TreeIndexForLeaf(size_t leaf) const {
-        // See above class comment. The tree storage is an array of length
-        // 2 * numLeaves. The leaves are stored in its second half.
-        return leaf + NumLeaves();
-    }
-
-    static size_t LastElementUnderSameLeaf(size_t element) {
-        return element | kElementsPerLeafMask;
-    }
-
-    static size_t FirstElementUnderSameLeaf(size_t element) {
-        return element & ~kElementsPerLeafMask;
-    }
-
-    static size_t NextMultipleOfElementsPerLeaf(size_t numElements) {
-        MOZ_ASSERT(numElements >= 1);
-        return ((numElements - 1) | kElementsPerLeafMask) + 1;
-    }
-
-    bool Validate(T maxAllowed, size_t firstLeaf, size_t lastLeaf)
-    {
-        size_t firstTreeIndex = TreeIndexForLeaf(firstLeaf);
-        size_t lastTreeIndex  = TreeIndexForLeaf(lastLeaf);
-
-        while (true) {
-            // Given that we tweak these values in nontrivial ways, it doesn't
-            // hurt to do this sanity check.
-            MOZ_ASSERT(firstTreeIndex <= lastTreeIndex);
-
-            // Final case where there is only one node to validate at the
-            // current tree level:
-            if (lastTreeIndex == firstTreeIndex) {
-                const T& curData = mTreeData[firstTreeIndex];
-                return curData <= maxAllowed;
-            }
-
-            // If the first node at current tree level is a right node, handle
-            // it individually and replace it with its right neighbor, which is
-            // a left node.
-            if (IsRightNode(firstTreeIndex)) {
-                const T& curData = mTreeData[firstTreeIndex];
-                if (curData > maxAllowed)
-                  return false;
-
-                firstTreeIndex = RightNeighborNode(firstTreeIndex);
-            }
-
-            // If the last node at current tree level is a left node, handle it
-            // individually and replace it with its left neighbor, which is a
-            // right node.
-            if (IsLeftNode(lastTreeIndex)) {
-                const T& curData = mTreeData[lastTreeIndex];
-                if (curData > maxAllowed)
-                    return false;
-
-                lastTreeIndex = LeftNeighborNode(lastTreeIndex);
-            }
-
-            /* At this point it can happen that firstTreeIndex and lastTreeIndex
-             * "crossed" eachother. That happens if firstTreeIndex was a right
-             * node and lastTreeIndex was its right neighor: In that case, both
-             * above tweaks happened and as a result, they ended up being
-             * swapped: LastTreeIndex is now the _left_ neighbor of
-             * firstTreeIndex. When that happens, there is nothing left to
-             * validate.
-             */
-            if (lastTreeIndex == LeftNeighborNode(firstTreeIndex))
-                return true;
-
-            // Walk up one level.
-            firstTreeIndex = ParentNode(firstTreeIndex);
-            lastTreeIndex = ParentNode(lastTreeIndex);
-        }
-    }
-
-    // Updates the tree from the parent's buffer contents. Fallible, as it
-    // may have to resize the tree storage.
-    bool Update(size_t firstByte, size_t lastByte);
-
-    size_t SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const
-    {
-        return mallocSizeOf(this) +
-               mTreeData.ShallowSizeOfExcludingThis(mallocSizeOf);
-    }
-};
-
-// TreeForType: just a template helper to select the right tree object for a given
-// element type.
-template<typename T>
-struct TreeForType {};
-
-template<>
-struct TreeForType<uint8_t>
-{
-    static UniquePtr<WebGLElementArrayCacheTree<uint8_t>>&
-    Value(WebGLElementArrayCache* b) {
-        return b->mUint8Tree;
-    }
-};
-
-template<>
-struct TreeForType<uint16_t>
-{
-    static UniquePtr<WebGLElementArrayCacheTree<uint16_t>>&
-    Value(WebGLElementArrayCache* b) {
-        return b->mUint16Tree;
-    }
-};
-
-template<>
-struct TreeForType<uint32_t>
-{
-    static UniquePtr<WebGLElementArrayCacheTree<uint32_t>>&
-    Value(WebGLElementArrayCache* b) {
-        return b->mUint32Tree;
-    }
-};
-
-// Calling this method will 1) update the leaves in this interval
-// from the raw buffer data, and 2) propagate this update up the tree.
-template<typename T>
-bool
-WebGLElementArrayCacheTree<T>::Update(size_t firstByte, size_t lastByte)
-{
-    MOZ_ASSERT(firstByte <= lastByte);
-    MOZ_ASSERT(lastByte < mParent.mBytes.Length());
-
-    size_t numberOfElements = mParent.mBytes.Length() / sizeof(T);
-    size_t requiredNumLeaves = 0;
-    if (numberOfElements > 0) {
-        /* If we didn't require the number of leaves to be a power of two, then
-         * it would just be equal to
-         *
-         *    ceil(numberOfElements / kElementsPerLeaf)
-         *
-         * The way we implement this (division+ceil) operation in integer
-         * arithmetic
-         * is as follows:
-         */
-        size_t numLeavesNonPOT = (numberOfElements + kElementsPerLeaf - 1) / kElementsPerLeaf;
-        // It only remains to round that up to the next power of two:
-        requiredNumLeaves = RoundUpPow2(numLeavesNonPOT);
-    }
-
-    // Step #0: If needed, resize our tree data storage.
-    if (requiredNumLeaves != NumLeaves()) {
-        // See class comment for why we the tree storage size is 2 * numLeaves.
-        if (!mTreeData.SetLength(2 * requiredNumLeaves, fallible)) {
-            mTreeData.Clear();
-            return false;
-        }
-        MOZ_ASSERT(NumLeaves() == requiredNumLeaves);
-
-        if (NumLeaves()) {
-            // When resizing, update the whole tree, not just the subset
-            // corresponding to the part of the buffer being updated.
-            memset(mTreeData.Elements(), 0, mTreeData.Length() * sizeof(T));
-            firstByte = 0;
-            lastByte = mParent.mBytes.Length() - 1;
-        }
-    }
-
-    if (NumLeaves() == 0)
-        return true;
-
-    lastByte = std::min(lastByte, NumLeaves() * kElementsPerLeaf * sizeof(T) - 1);
-    if (firstByte > lastByte)
-        return true;
-
-    size_t firstLeaf = LeafForByte(firstByte);
-    size_t lastLeaf = LeafForByte(lastByte);
-
-    MOZ_ASSERT(firstLeaf <= lastLeaf && lastLeaf < NumLeaves());
-
-    size_t firstTreeIndex = TreeIndexForLeaf(firstLeaf);
-    size_t lastTreeIndex = TreeIndexForLeaf(lastLeaf);
-
-    // Step #1: Initialize the tree leaves from plain buffer data.
-    // That is, each tree leaf must be set to the max of the |kElementsPerLeaf|
-    // corresponding buffer entries.
-
-    // Condition-less scope to prevent leaking this scope's variables into the
-    // code below:
-    {
-        // TreeIndex is the index of the tree leaf we're writing, i.e. the
-        // destination index.
-        size_t treeIndex = firstTreeIndex;
-        // srcIndex is the index in the source buffer.
-        size_t srcIndex = firstLeaf * kElementsPerLeaf;
-        while (treeIndex <= lastTreeIndex) {
-            T m = 0;
-            size_t a = srcIndex;
-            size_t srcIndexNextLeaf = std::min(a + kElementsPerLeaf, numberOfElements);
-            for (; srcIndex < srcIndexNextLeaf; srcIndex++) {
-                m = std::max(m, mParent.Element<T>(srcIndex));
-            }
-            mTreeData[treeIndex] = m;
-            treeIndex++;
-        }
-    }
-
-    // Step #2: Propagate the values up the tree. This is simply a matter of
-    // walking up the tree and setting each node to the max of its two children.
-    while (firstTreeIndex > 1) {
-        // Move up one level.
-        firstTreeIndex = ParentNode(firstTreeIndex);
-        lastTreeIndex = ParentNode(lastTreeIndex);
-
-        // Fast-exit case where only one node is updated at the current level.
-        if (firstTreeIndex == lastTreeIndex) {
-            mTreeData[firstTreeIndex] = std::max(mTreeData[LeftChildNode(firstTreeIndex)], mTreeData[RightChildNode(firstTreeIndex)]);
-            continue;
-        }
-
-        size_t child = LeftChildNode(firstTreeIndex);
-        size_t parent = firstTreeIndex;
-        while (parent <= lastTreeIndex) {
-            T a = mTreeData[child];
-            child = RightNeighborNode(child);
-            T b = mTreeData[child];
-            child = RightNeighborNode(child);
-            mTreeData[parent] = std::max(a, b);
-            parent = RightNeighborNode(parent);
-        }
-    }
-
-    return true;
-}
-
-WebGLElementArrayCache::WebGLElementArrayCache()
-{
-}
-
-WebGLElementArrayCache::~WebGLElementArrayCache()
-{
-}
-
-bool
-WebGLElementArrayCache::BufferData(const void* ptr, size_t byteLength)
-{
-    if (mBytes.Length() != byteLength) {
-        if (!mBytes.SetLength(byteLength, fallible)) {
-            mBytes.Clear();
-            return false;
-        }
-    }
-    MOZ_ASSERT(mBytes.Length() == byteLength);
-    return BufferSubData(0, ptr, byteLength);
-}
-
-bool
-WebGLElementArrayCache::BufferSubData(size_t pos, const void* ptr,
-                                      size_t updateByteLength)
-{
-    MOZ_ASSERT(pos + updateByteLength <= mBytes.Length());
-    if (!updateByteLength)
-        return true;
-
-    // Note, using memcpy on shared racy data is not well-defined, this
-    // will need to use safe-for-races operations when those become available.
-    // See bug 1225033.
-    if (ptr)
-        memcpy(mBytes.Elements() + pos, ptr, updateByteLength);
-    else
-        memset(mBytes.Elements() + pos, 0, updateByteLength);
-    return UpdateTrees(pos, pos + updateByteLength - 1);
-}
-
-bool
-WebGLElementArrayCache::UpdateTrees(size_t firstByte, size_t lastByte)
-{
-    bool result = true;
-    if (mUint8Tree)
-        result &= mUint8Tree->Update(firstByte, lastByte);
-    if (mUint16Tree)
-        result &= mUint16Tree->Update(firstByte, lastByte);
-    if (mUint32Tree)
-        result &= mUint32Tree->Update(firstByte, lastByte);
-    return result;
-}
-
-template<typename T>
-bool
-WebGLElementArrayCache::Validate(uint32_t maxAllowed, size_t firstElement,
-                                 size_t countElements)
-{
-    // If maxAllowed is >= the max T value, then there is no way that a T index
-    // could be invalid.
-    uint32_t maxTSize = std::numeric_limits<T>::max();
-    if (maxAllowed >= maxTSize)
-        return true;
-
-    T maxAllowedT(maxAllowed);
-
-    // Integer overflow must have been handled earlier, so we assert that
-    // maxAllowedT is exactly the max allowed value.
-    MOZ_ASSERT(uint32_t(maxAllowedT) == maxAllowed);
-
-    if (!mBytes.Length() || !countElements)
-      return true;
-
-    UniquePtr<WebGLElementArrayCacheTree<T>>& tree = TreeForType<T>::Value(this);
-    if (!tree) {
-        tree = MakeUnique<WebGLElementArrayCacheTree<T>>(*this);
-        if (mBytes.Length()) {
-            bool valid = tree->Update(0, mBytes.Length() - 1);
-            if (!valid) {
-                // Do not assert here. This case would happen if an allocation
-                // failed. We've already settled on fallible allocations around
-                // here.
-                tree = nullptr;
-                return false;
-            }
-        }
-    }
-
-    size_t lastElement = firstElement + countElements - 1;
-
-    // Fast-exit path when the global maximum for the whole element array buffer
-    // falls in the allowed range:
-    T globalMax = tree->GlobalMaximum();
-    if (globalMax <= maxAllowedT)
-        return true;
-
-    const T* elements = Elements<T>();
-
-    // Before calling tree->Validate, we have to validate ourselves the
-    // boundaries of the elements span, to round them to the nearest multiple of
-    // kElementsPerLeaf.
-    size_t firstElementAdjustmentEnd = std::min(lastElement,
-                                                tree->LastElementUnderSameLeaf(firstElement));
-    while (firstElement <= firstElementAdjustmentEnd) {
-        const T& curData = elements[firstElement];
-        if (curData > maxAllowedT)
-            return false;
-
-        firstElement++;
-    }
-    size_t lastElementAdjustmentEnd = std::max(firstElement,
-                                               tree->FirstElementUnderSameLeaf(lastElement));
-    while (lastElement >= lastElementAdjustmentEnd) {
-        const T& curData = elements[lastElement];
-        if (curData > maxAllowedT)
-            return false;
-
-        lastElement--;
-    }
-
-    // at this point, for many tiny validations, we're already done.
-    if (firstElement > lastElement)
-        return true;
-
-    // general case
-    return tree->Validate(maxAllowedT, tree->LeafForElement(firstElement),
-                          tree->LeafForElement(lastElement));
-}
-
-bool
-WebGLElementArrayCache::Validate(GLenum type, uint32_t maxAllowed,
-                                 size_t firstElement, size_t countElements)
-{
-    if (type == LOCAL_GL_UNSIGNED_BYTE)
-        return Validate<uint8_t>(maxAllowed, firstElement, countElements);
-    if (type == LOCAL_GL_UNSIGNED_SHORT)
-        return Validate<uint16_t>(maxAllowed, firstElement, countElements);
-    if (type == LOCAL_GL_UNSIGNED_INT)
-        return Validate<uint32_t>(maxAllowed, firstElement, countElements);
-
-    MOZ_ASSERT(false, "Invalid type.");
-    return false;
-}
-
-template<typename T>
-static size_t
-SizeOfNullable(mozilla::MallocSizeOf mallocSizeOf, const T& obj)
-{
-    if (!obj)
-        return 0;
-    return obj->SizeOfIncludingThis(mallocSizeOf);
-}
-
-size_t
-WebGLElementArrayCache::SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const
-{
-    return mallocSizeOf(this) +
-           mBytes.ShallowSizeOfExcludingThis(mallocSizeOf) +
-           SizeOfNullable(mallocSizeOf, mUint8Tree) +
-           SizeOfNullable(mallocSizeOf, mUint16Tree) +
-           SizeOfNullable(mallocSizeOf, mUint32Tree);
-}
-
-bool
-WebGLElementArrayCache::BeenUsedWithMultipleTypes() const
-{
-  // C++ Standard ($4.7)
-  // "If the source type is bool, the value false is converted to zero and
-  //  the value true is converted to one."
-  const int num_types_used = (mUint8Tree  != nullptr) +
-                             (mUint16Tree != nullptr) +
-                             (mUint32Tree != nullptr);
-  return num_types_used > 1;
-}
-
-} // end namespace mozilla
deleted file mode 100644
--- a/dom/canvas/WebGLElementArrayCache.h
+++ /dev/null
@@ -1,101 +0,0 @@
-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef WEBGL_ELEMENT_ARRAY_CACHE_H
-#define WEBGL_ELEMENT_ARRAY_CACHE_H
-
-#include "GLDefs.h"
-#include "mozilla/MemoryReporting.h"
-#include "mozilla/UniquePtr.h"
-#include "nscore.h"
-#include "nsTArray.h"
-#include <stdint.h>
-
-namespace mozilla {
-
-template<typename T>
-struct WebGLElementArrayCacheTree;
-
-/* WebGLElementArrayCache implements WebGL element array buffer validation for
- * drawElements.
- *
- * Its exposes methods meant to be called by WebGL method implementations:
- *
- * - Validate, to be called by WebGLContext::DrawElements, is where we use the
- *   cache.
- *
- * - BufferData and BufferSubData, to be called by eponymous WebGL methods, are
- *   how data is fed into the cache.
- *
- * Most of the implementation is hidden in the auxilary class template,
- * WebGLElementArrayCacheTree. Refer to its code for design comments.
- */
-class WebGLElementArrayCache {
-public:
-    bool BufferData(const void* ptr, size_t byteLength);
-    bool BufferSubData(size_t pos, const void* ptr, size_t updateByteSize);
-
-    bool Validate(GLenum type, uint32_t maxAllowed, size_t first, size_t count);
-
-    template<typename T>
-    T Element(size_t i) const { return Elements<T>()[i]; }
-
-    WebGLElementArrayCache();
-    ~WebGLElementArrayCache();
-
-    size_t SizeOfIncludingThis(mozilla::MallocSizeOf mallocSizeOf) const;
-    bool BeenUsedWithMultipleTypes() const;
-
-private:
-    /* Returns true if a drawElements call with the given parameters should
-     * succeed, false otherwise.
-     *
-     * In other words, this returns true if all entries in the element array at
-     * positions:
-     *
-     *    first .. first+count-1
-     *
-     * are less than or equal to maxAllowed.
-     *
-     * Input parameters:
-     *   maxAllowed: Maximum value to be allowed in the specificied portion of
-     *               the element array.
-     *   first: Start of the portion of the element array to consume.
-     *   count: Number of entries from the element array to consume.
-     *
-     * Output parameter:
-     *   out_upperBound: Upon success, is set to the actual maximum value in the
-     *                   specified range, which is then guaranteed to be less
-     *                   than or equal to maxAllowed. upon failure, is set to
-     *                   the first value in the specified range, that is greater
-     *                   than maxAllowed.
-     */
-    template<typename T>
-    bool Validate(uint32_t maxAllowed, size_t first, size_t count);
-
-    template<typename T>
-    const T* Elements() const {
-        return reinterpret_cast<const T*>(mBytes.Elements());
-    }
-
-    template<typename T>
-    T* Elements() { return reinterpret_cast<T*>(mBytes.Elements()); }
-
-    bool UpdateTrees(size_t firstByte, size_t lastByte);
-
-    template<typename T>
-    friend struct WebGLElementArrayCacheTree;
-    template<typename T>
-    friend struct TreeForType;
-
-    FallibleTArray<uint8_t> mBytes;
-    UniquePtr<WebGLElementArrayCacheTree<uint8_t>> mUint8Tree;
-    UniquePtr<WebGLElementArrayCacheTree<uint16_t>> mUint16Tree;
-    UniquePtr<WebGLElementArrayCacheTree<uint32_t>> mUint32Tree;
-};
-
-} // end namespace mozilla
-
-#endif // WEBGL_ELEMENT_ARRAY_CACHE_H
--- a/dom/canvas/WebGLTypes.h
+++ b/dom/canvas/WebGLTypes.h
@@ -168,11 +168,55 @@ enum class WebGLExtensionID : uint8_t {
     WEBGL_debug_shaders,
     WEBGL_depth_texture,
     WEBGL_draw_buffers,
     WEBGL_lose_context,
     Max,
     Unknown
 };
 
+class UniqueBuffer
+{
+    // Like UniquePtr<>, but for void* and malloc/calloc/free.
+    void* mBuffer;
+
+public:
+    UniqueBuffer()
+        : mBuffer(nullptr)
+    { }
+
+    MOZ_IMPLICIT UniqueBuffer(void* buffer)
+        : mBuffer(buffer)
+    { }
+
+    ~UniqueBuffer() {
+        free(mBuffer);
+    }
+
+    UniqueBuffer(UniqueBuffer&& other) {
+        this->mBuffer = other.mBuffer;
+        other.mBuffer = nullptr;
+    }
+
+    UniqueBuffer& operator =(UniqueBuffer&& other) {
+        free(this->mBuffer);
+        this->mBuffer = other.mBuffer;
+        other.mBuffer = nullptr;
+        return *this;
+    }
+
+    UniqueBuffer& operator =(void* newBuffer) {
+        free(this->mBuffer);
+        this->mBuffer = newBuffer;
+        return *this;
+    }
+
+    explicit operator bool() const { return bool(mBuffer); }
+
+    void* get() const { return mBuffer; }
+
+    UniqueBuffer(const UniqueBuffer& other) = delete; // construct using Move()!
+    void operator =(const UniqueBuffer& other) = delete; // assign using Move()!
+};
+
 } // namespace mozilla
 
 #endif
deleted file mode 100644
--- a/dom/canvas/gtest/TestWebGLElementArrayCache.cpp
+++ /dev/null
@@ -1,206 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* vim: set ts=8 sts=2 et sw=2 tw=80: */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "mozilla/Assertions.h"
-
-#include "WebGLElementArrayCache.h"
-
-#include <cstdio>
-#include <cstdlib>
-#include "nscore.h"
-#include "nsTArray.h"
-
-void
-MakeRandomVector(nsTArray<uint8_t>& a, size_t size)
-{
-  a.SetLength(size);
-  // only the most-significant bits of rand() are reasonably random.
-  // RAND_MAX can be as low as 0x7fff, and we need 8 bits for the result, so we can only
-  // ignore the 7 least significant bits.
-  for (size_t i = 0; i < size; i++)
-    a[i] = static_cast<uint8_t>((unsigned int)(rand()) >> 7);
-}
-
-template<typename T>
-T
-RandomInteger(T a, T b)
-{
-  T result(a + rand() % (b - a + 1));
-  return result;
-}
-
-template<typename T>
-GLenum
-GLType()
-{
-  switch (sizeof(T)) {
-  case 4:  return LOCAL_GL_UNSIGNED_INT;
-  case 2:  return LOCAL_GL_UNSIGNED_SHORT;
-  case 1:  return LOCAL_GL_UNSIGNED_BYTE;
-  default:
-    MOZ_RELEASE_ASSERT(false);
-    return 0;
-  }
-}
-
-void
-CheckValidate(bool expectSuccess, mozilla::WebGLElementArrayCache& c, GLenum type,
-              uint32_t maxAllowed, size_t first, size_t count)
-{
-  const bool success = c.Validate(type, maxAllowed, first, count);
-  ASSERT_TRUE(success == expectSuccess);
-}
-
-template<typename T>
-void
-CheckValidateOneTypeVariousBounds(mozilla::WebGLElementArrayCache& c, size_t firstByte,
-                                  size_t countBytes)
-{
-  size_t first = firstByte / sizeof(T);
-  size_t count = countBytes / sizeof(T);
-
-  GLenum type = GLType<T>();
-
-  T max = 0;
-  for (size_t i = 0; i < count; i++)
-    if (c.Element<T>(first + i) > max)
-      max = c.Element<T>(first + i);
-
-  CheckValidate(true, c, type, max, first, count);
-  CheckValidate(true, c, type, T(-1), first, count);
-  if (T(max + 1)) CheckValidate(true, c, type, T(max + 1), first, count);
-  if (max > 0) {
-    CheckValidate(false, c, type, max - 1, first, count);
-    CheckValidate(false, c, type, 0, first, count);
-  }
-}
-
-void CheckValidateAllTypes(mozilla::WebGLElementArrayCache& c, size_t firstByte,
-                           size_t countBytes)
-{
-  CheckValidateOneTypeVariousBounds<uint8_t>(c, firstByte, countBytes);
-  CheckValidateOneTypeVariousBounds<uint16_t>(c, firstByte, countBytes);
-  CheckValidateOneTypeVariousBounds<uint32_t>(c, firstByte, countBytes);
-}
-
-template<typename T>
-void
-CheckSanity()
-{
-  const size_t numElems = 64; // should be significantly larger than tree leaf size to
-                        // ensure we exercise some nontrivial tree-walking
-  T data[numElems] = {1,0,3,1,2,6,5,4}; // intentionally specify only 8 elements for now
-  size_t numBytes = numElems * sizeof(T);
-  ASSERT_TRUE(numBytes == sizeof(data));
-
-  GLenum type = GLType<T>();
-
-  mozilla::WebGLElementArrayCache c;
-  c.BufferData(data, numBytes);
-  CheckValidate(true,  c, type, 6, 0, 8);
-  CheckValidate(false, c, type, 5, 0, 8);
-  CheckValidate(true,  c, type, 3, 0, 3);
-  CheckValidate(false, c, type, 2, 0, 3);
-  CheckValidate(true,  c, type, 6, 2, 4);
-  CheckValidate(false, c, type, 5, 2, 4);
-
-  c.BufferSubData(5*sizeof(T), data, sizeof(T));
-  CheckValidate(true,  c, type, 5, 0, 8);
-  CheckValidate(false, c, type, 4, 0, 8);
-
-  // now test a somewhat larger size to ensure we exceed the size of a tree leaf
-  for(size_t i = 0; i < numElems; i++)
-    data[i] = numElems - i;
-  c.BufferData(data, numBytes);
-  CheckValidate(true,  c, type, numElems,     0, numElems);
-  CheckValidate(false, c, type, numElems - 1, 0, numElems);
-
-  ASSERT_TRUE(numElems > 10);
-  CheckValidate(true,  c, type, numElems - 10, 10, numElems - 10);
-  CheckValidate(false, c, type, numElems - 11, 10, numElems - 10);
-}
-
-template<typename T>
-void
-CheckUintOverflow()
-{
-  // This test is only for integer types smaller than uint32_t
-  static_assert(sizeof(T) < sizeof(uint32_t), "This test is only for integer types \
-                smaller than uint32_t");
-
-  const size_t numElems = 64; // should be significantly larger than tree leaf size to
-                              // ensure we exercise some nontrivial tree-walking
-  T data[numElems];
-  size_t numBytes = numElems * sizeof(T);
-  ASSERT_TRUE(numBytes == sizeof(data));
-
-  GLenum type = GLType<T>();
-
-  mozilla::WebGLElementArrayCache c;
-
-  for(size_t i = 0; i < numElems; i++)
-    data[i] = numElems - i;
-  c.BufferData(data, numBytes);
-
-  // bug 825205
-  uint32_t bigValWrappingToZero = uint32_t(T(-1)) + 1;
-  CheckValidate(true,  c, type, bigValWrappingToZero,     0, numElems);
-  CheckValidate(true,  c, type, bigValWrappingToZero - 1, 0, numElems);
-  CheckValidate(false, c, type,                        0, 0, numElems);
-}
-
-TEST(WebGLElementArrayCache, Test)
-{
-  srand(0); // do not want a random seed here.
-
-  CheckSanity<uint8_t>();
-  CheckSanity<uint16_t>();
-  CheckSanity<uint32_t>();
-
-  CheckUintOverflow<uint8_t>();
-  CheckUintOverflow<uint16_t>();
-
-  nsTArray<uint8_t> v, vsub;
-  mozilla::WebGLElementArrayCache b;
-
-  for (int maxBufferSize = 1; maxBufferSize <= 4096; maxBufferSize *= 2) {
-    // See bug 800612. We originally had | repeat = min(maxBufferSize, 20) |
-    // and a real bug was only caught on Windows and not on Linux due to rand()
-    // producing different values. In that case, the minimum value by which to replace
-    // this 20 to reproduce the bug on Linux, was 25. Replacing it with 64 should give
-    // us some comfort margin.
-    int repeat = std::min(maxBufferSize, 64);
-    for (int i = 0; i < repeat; i++) {
-      size_t size = RandomInteger<size_t>(0, maxBufferSize);
-      MakeRandomVector(v, size);
-      b.BufferData(v.Elements(), size);
-      CheckValidateAllTypes(b, 0, size);
-
-      for (int j = 0; j < 16; j++) {
-        for (int bufferSubDataCalls = 1; bufferSubDataCalls <= 8; bufferSubDataCalls *= 2) {
-          for (int validateCalls = 1; validateCalls <= 8; validateCalls *= 2) {
-
-            size_t offset = 0, subsize = 0;
-
-            for (int k = 0; k < bufferSubDataCalls; k++) {
-              offset = RandomInteger<size_t>(0, size);
-              subsize = RandomInteger<size_t>(0, size - offset);
-              MakeRandomVector(vsub, subsize);
-              b.BufferSubData(offset, vsub.Elements(), subsize);
-            }
-
-            for (int k = 0; k < validateCalls; k++) {
-              offset = RandomInteger<size_t>(0, size);
-              subsize = RandomInteger<size_t>(0, size - offset);
-              CheckValidateAllTypes(b, offset, subsize);
-            }
-          } // validateCalls
-        } // bufferSubDataCalls
-      } // j
-    } // i
-  } // maxBufferSize
-}
-
--- a/dom/canvas/gtest/moz.build
+++ b/dom/canvas/gtest/moz.build
@@ -2,22 +2,18 @@
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files('**'):
     BUG_COMPONENT = ('Core', 'Canvas: 2D')
 
-with Files('*WebGL*'):
-    BUG_COMPONENT = ('Core', 'Canvas: WebGL')
-
 UNIFIED_SOURCES += [
     'TestImageBitmapColorUtils.cpp',
-    'TestWebGLElementArrayCache.cpp',
 ]
 
 LOCAL_INCLUDES += [
     '/dom/canvas',
     '/media/libyuv/libyuv/include'
 ]
 
 FINAL_LIBRARY = 'xul-gtest'
--- a/dom/canvas/moz.build
+++ b/dom/canvas/moz.build
@@ -120,17 +120,16 @@ UNIFIED_SOURCES += [
     'WebGLContextLossHandler.cpp',
     'WebGLContextState.cpp',
     'WebGLContextTextures.cpp',
     'WebGLContextUnchecked.cpp',
     'WebGLContextUtils.cpp',
     'WebGLContextValidate.cpp',
     'WebGLContextVertexArray.cpp',
     'WebGLContextVertices.cpp',
-    'WebGLElementArrayCache.cpp',
     'WebGLExtensionBase.cpp',
     'WebGLExtensionBlendMinMax.cpp',
     'WebGLExtensionColorBufferFloat.cpp',
     'WebGLExtensionColorBufferHalfFloat.cpp',
     'WebGLExtensionCompressedTextureASTC.cpp',
     'WebGLExtensionCompressedTextureATC.cpp',
     'WebGLExtensionCompressedTextureES3.cpp',
     'WebGLExtensionCompressedTextureETC1.cpp',
--- a/dom/canvas/test/webgl-conf/generated-mochitest.ini
+++ b/dom/canvas/test/webgl-conf/generated-mochitest.ini
@@ -4953,17 +4953,16 @@ fail-if = (os == 'mac') || (os == 'win')
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance2__rendering__clear-srgb-color-buffer.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance2__rendering__clipping-wide-points.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance2__rendering__draw-buffers.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance2__rendering__element-index-uint.html]
-fail-if = (os != 'win')
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance2__rendering__framebuffer-completeness-unaffected.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance2__rendering__framebuffer-unsupported.html]
 fail-if = (os == 'mac')
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance2__rendering__fs-color-type-mismatch-color-buffer-type.html]
 fail-if = (os == 'mac') || (os == 'win')
@@ -6120,29 +6119,26 @@ skip-if = (os == 'android' || os == 'lin
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__buffers__buffer-data-array-buffer-delete.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__buffers__buffer-uninitialized.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__buffers__element-array-buffer-delete-recreate.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__buffers__index-validation-copies-indices.html]
-fail-if = (os != 'win')
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__buffers__index-validation-crash-with-buffer-sub-data.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__buffers__index-validation-large-buffer.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__buffers__index-validation-verifies-too-many-indices.html]
-fail-if = (os != 'win')
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__buffers__index-validation-with-resized-buffer.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__buffers__index-validation.html]
-fail-if = (os != 'win')
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__canvas__buffer-offscreen-test.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__canvas__buffer-preserve-test.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__canvas__canvas-test.html]
 skip-if = (os == 'win') || (os == 'android' || os == 'linux')
 [generated/test_2_conformance__canvas__canvas-zero-size.html]
@@ -7254,17 +7250,16 @@ skip-if = (os == 'android' || os == 'lin
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__rendering__culling.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__rendering__default-texture-draw-bug.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__rendering__draw-arrays-out-of-bounds.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__rendering__draw-elements-out-of-bounds.html]
-fail-if = (os != 'win')
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__rendering__draw-with-changing-start-vertex-bug.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__rendering__framebuffer-switch.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__rendering__framebuffer-texture-switch.html]
 skip-if = (os == 'android' || os == 'linux')
 [generated/test_2_conformance__rendering__gl-clear.html]
--- a/dom/canvas/test/webgl-conf/mochitest-errata.ini
+++ b/dom/canvas/test/webgl-conf/mochitest-errata.ini
@@ -66,30 +66,16 @@ skip-if = 1
 # Timing out
 [generated/test_conformance__uniforms__uniform-default-values.html]
 # Timeout on Windows, crash on Android/Linux.
 skip-if = (os == 'android') || (os == 'linux') || (os == 'win')
 [generated/test_conformance__ogles__GL__mat3__mat3_001_to_006.html]
 # Timeout on D3D11
 skip-if = (os == 'win')
 
-####################
-# Tests expect conservative index validation, which we skip on WebGL 2.
-# ANGLE still provides it though, so they pass on windows.
-[generated/test_2_conformance__rendering__draw-elements-out-of-bounds.html]
-fail-if = (os != 'win')
-[generated/test_2_conformance__buffers__index-validation-copies-indices.html]
-fail-if = (os != 'win')
-[generated/test_2_conformance__buffers__index-validation.html]
-fail-if = (os != 'win')
-[generated/test_2_conformance__buffers__index-validation-verifies-too-many-indices.html]
-fail-if = (os != 'win')
-[generated/test_2_conformance2__rendering__element-index-uint.html]
-fail-if = (os != 'win')
-
 ########################################################################
 # Complicated
 
 [generated/test_conformance__context__context-attributes-alpha-depth-stencil-antialias.html]
 fail-if = (os == 'mac' && os_version == '10.6')
 # Asserts on 'B2G ICS Emulator Debug' and linux debug. Crashes on Android.
 skip-if = (os == 'b2g') || (os == 'linux') || (os == 'android')