Move the `mGens` array and `isAlive()` implementation from `EntityManager`
to `EntityManagerImpl` to hide implementation details and maintain a clean
public header. Make `isAlive()` strictly thread-safe by acquiring the
`mFreeListLock`.
isAlive() was relying on undefined behavior, and the comment about
the memory barrier being provided by the lock was misleading (wrong)
because the lock only provided the "release", but isAlive() didn't
have an "acquire".
Better safe than sorry, we now have to acquire the lock to test isAlive().
- Added `copyRange()` to `StructureOfArrays` to efficiently copy a range
of elements from another SoA of the same type. It uses `std::copy_n`
which leverages `memcpy` for trivially copyable types.
- Added `operator[]` to `StructureOfArrays` returning `IteratorValueRef`.
- Added `operator=` for `Structure` (tuple) to `IteratorValueRef` to
allow direct assignment: `soa[i] = tuple`.
- Added unit tests for these new methods in `test_StructureOfArrays.cpp`.
* Implement batch callback system for scene cache incremental updates.
This change adds a batch callback mechanism to track changes in component
managers and the entity manager, avoiding full cache rebuilds in the
future scene cache implementation.
1. SingleInstanceComponentManager:
- Added SingleInstanceComponentManagerBase to handle callbacks without
template bloat.
- Implemented batch delivery using Slice<const Entity> and a fixed-size
array of 16 for dirty entities to avoid heap allocations.
- Added compile-time option for sorted insertion (default to linear).
2. Manager Integration:
- RenderableManager: Added notifications to setters.
- LightManager: Added notifications to setters
- TransformManager: Handled transactions by deferring notifications
until commit, and supported hierarchical updates in children.
3. EntityManager:
- Added a new batching callback API for entity destruction.
- Used std::function for callbacks to allow thread-safe copying of the
callback list outside the lock.
- Simple accumulation in loop and flush when full, no bypass.
4. Tests:
- Added formal unit tests for all managers and entity manager callbacks.
* Implement grid-based world origin snapping in View
Implement a grid-based world origin snapping system in View to avoid
per-frame transform updates in the future. This will allow to
improve CPU performance and to enable future caching of acceleration
structures like BVH.
The feature is protected by the 'view.enable_grid_based_world_origin'
feature flag. The grid size can be set
manually via View::setGridSize or calculated automatically as 10%
of the camera's far plane distance.
A 50% hysteresis ratio is applied to prevent rapid origin flipping
near grid edges.
Exposed the new API to Java and JavaScript bindings and added
unit tests in filament_test.cpp.
BUGS=[504726278]
* Refine grid-based world origin snapping implementation
Refine the grid-based world origin snapping in View with several
improvements:
1. Support Orthographic Projections:
Calculate automatic grid size using projection matrix elements,
working for both perspective and ortho without assuming positive
near plane.
2. Stable Automatic Grid Size:
Only update effective grid size when a position snap occurs.
This prevents instability when frustum scale changes smoothly.
3. Immediate Manual Override:
Force an immediate snap when user manually changes grid size.
Added test cases for ortho and auto-grid size in filament_test.cpp.
Includes the following updates to Filament and Dawn to support the new version:
- CMake Configuration: Enabled OBJC/OBJCXX and set C++ standard to 20 for
Apple targets to support Dawn's Metal backend.
- WebGPU Backend API: Replaced `wgpu::ShaderModuleWGSLDescriptor` with
`wgpu::ShaderSourceWGSL`, updated compilation info callbacks to use
`wgpu::CompilationInfoRequestStatus`, and removed deprecated
`wgpu::TextureFormat::External`.
- Tint Integration (`GLSLPostProcessor.cpp`): Migrated to `ReadIR` and
`WgslFromIR`. Enabled `allow_non_uniform_derivatives` and
`disable_unreachable_code_warning` to bypass strict uniformity analysis on
UBOs, and allowlisted `gl_ClipDistance` for stereoscopic materials.
- Dawn Patches: Manually re-applied and updated
`remove-vk-macos-restriction.patch` to account for upstream refactoring in
`BackendVk.cpp`.
- AppleClang 17 RTTI Workaround: Added
`tint-texture-gather-unwrap-pointer.patch` to conditionally bypass an
AppleClang 17 optimizer bug causing RTTI dynamic cast failures in Tint
(`TINT_ASSERT(tex_ty)`).
Turns out this workaround is necessary for linux clang as well.
* Filament Error Handling Remediation and noexcept Cleanup
- Replaced assert_invariant with FILAMENT_CHECK_PRECONDITION in
Renderer::beginFrame for caller bugs.
- Removed noexcept from Camera::setCustomProjection to allow precondition
checks to throw.
- Removed noexcept from Texture and InstanceBuffer methods using precondition
checks.
- Documented silent clamping in View::setBloomOptions.
- Clarified comment in FrameGraphResources regarding preconditions.
- Refined MaterialInstance::commit to split texture loop into check and update
passes, preventing partial state changes on precondition failure.
* backend: Propagate backend thread exceptions to the main thread.
Introduce a mechanism to catch exceptions thrown on the backend thread and
rethrow them on the main thread. This prevents deadlocks and allows the
application to handle fatal backend failures gracefully.
- Consolidate synchronization primitives in DriverBase.
- Add mHasUnrecoverableError flag to interrupt blocked fence waits.
- Optimize waitForFence to avoid extra atomic reads in common paths.
- Propagate FenceStatus::ERROR across all backends.
- CommandBufferQueue now stores a std::exception_ptr when the backend fails.
- The backend enters a "zombie" state on failure, skipping further command
execution but allowing clean shutdown.
- Public APIs in Renderer and Engine now check for stored exceptions and
rethrow them, documented with @throws.
- Guarded by __EXCEPTIONS to ensure no overhead when exceptions are disabled.
- Add unit test for fence interruption and document new APIs.
BUGS=[407545700]
* feat: harden backend exceptions and add hasUnrecoverableFailure API
- Update Renderer::beginFrame() and Renderer::shouldRenderFrame() to
return false early if an unrecoverable backend exception has been
delivered to the main thread.
- Document the new return behavior for beginFrame() and
shouldRenderFrame() in Renderer.h.
- Add Engine::hasUnrecoverableFailure() to the public API to allow
apps to check for fatal errors without relying on exceptions.
- Implement hasUnrecoverableFailure() in FEngine by delegating to
CommandBufferQueue.
- Expose Engine::hasUnrecoverableFailure() to Java bindings
(Engine.java and JNI).
- Expose Engine::hasUnrecoverableFailure() to JavaScript bindings
(jsbindings.cpp).
* java: propagate C++ Panics & exceptions to JAVA
* Intermediate Buffer Visualization: Enabled live monitoring of internal
`FrameGraph` render targets directly in the `fgviewer` web UI.
* HTTP Polling Architecture: Switched from WebSocket binary pushes to native
`<img>` polling (`/api/image`)
* Robust Resource Tracking: Replaced string-based lookups with
`(ViewId, ResourceId)` composite keys to prevent cross-view collisions and
ensure accurate reads.
* Format Post-Processing: Extracted readback conversions (HDR tonemapping,
depth normalization, MSAA downsampling, single-channel expansion) into
`DebugServer`.
* UI Polish: Added a live-updating full-screen image modal and explicitly
filtered internal debug passes from the Graphviz/JSON exports to prevent
DOM thrashing.
* WIP: Currently Unsupported:
* GL backend: failed with:
OpenGL framebuffer error 0x8cd6 (GL_FRAMEBUFFER_INCOMPLETE_ATTACHMENT) in "readTexture" at line 4198
* Mipmaps & Subresources: Reading specific mip levels or array layers is
explicitly skipped.
* Shadowmaps: Variance Shadow Maps (VSM) will physically evaluate to `0.0`
and appear completely empty/black in scenes without active shadow
casters (due to inverted-Z).
* Stencil: Resolving and reading stencil buffer data is not supported by
the backend.
* WIP: Untested outside of MacOS+metal/vk
- PSDDecoder: Add dimension limits (max 30,000) to prevent integer
overflows during LinearImage allocation.
- Add checks for stream failure during pixel decoding to handle truncated
files safely.
- Follow existing pattern in this file by using std::runtime_error for
these checks, which are caught and handled by resetting the stream and
returning an empty image.
- Add comment that LinearImage allocation cannot overflow with the new
limits.
- MaterialChunk: Return false in getTextShader when shaderSize is 0 to
prevent out-of-bounds write of null terminator.
- Ktx1Bundle: In 3-argument constructor, check if total blobs calculation
overflows uint32_t.
- Instead of aborting with FILAMENT_CHECK_POSTCONDITION, log a warning and
set the object to a safe empty state (dimensions set to 0).
- Implement fixes inspired by PR #9853 to make convertOffsetsToPointers
size-aware and prevent OOB reads and writes.
- Change function signature to return bool instead of void, allowing graceful
error propagation instead of runtime aborts.
- Replace FILAMENT_CHECK_PRECONDITION with explicit checks that log errors
and return false.
- Update ArchiveCache in gltfio and main in tools/uberz to handle failure.
- Add unit tests to verify rejection of invalid offsets.
- Implement PR #9878 to add bounds checking in normalizeSkinningWeights,
preventing heap OOB write by clamping the count to available buffer size.
- Fix 3 similar vulnerabilities in uploadBuffers where accessor->count was
trusted for malloc allocation before cgltf_accessor_unpack_floats.
- Add overflow checks for allocation sizes in uploadBuffers.
- Clamp accessor count based on available buffer bytes in uploadBuffers to
prevent OOB read.
- Implement PR #9842 to fix integer overflows in transcodeImageLevel.
- Fix potential division by zero in transcodeImageLevel if bytesPerPix is 0.
- Fix memory leaks in transcodeImageLevel by freeing allocated buffers on
failure.
- Fix memory leak in Ktx2Reader::load by deleting PixelBufferDescriptor after
use.
- Fix potential division by zero in decodeMeshoptCompression when stride is 0.
- Fix ignored errors in release builds for meshopt decoding by returning bool
and checking the result in ResourceLoader.cpp.
- Fix potential integer underflow in computeBindingSize when count is 0 by
returning 0.
- Update ResourceLoader.cpp to skip buffer upload when computeBindingSize
returns 0, preventing potential OOM or OOB reads.
Implemented the custom 3D LUT feature in the ColorGrading API, allowing
users to specify a custom LUT for final color mapping.
To test this feature, added a "Custom LUT" option to the color grading
settings in the gltf_viewer sample. This includes several procedurally
generated LUTs for testing purposes:
- Negative
- Grayscale
- Sepia
- Teal and Orange
Updated settings serialization (Settings.cpp) and the viewer UI
(ViewerGui.cpp) to support these options.
FIXES=[362596936]
- Added a bounds check in the DICTIONARY_NUMERIC_FLAG case to prevent a
heap buffer overflow when writing decoded numeric literals.
- Tightened the existing bounds check for dictionary strings to use `>=`
instead of `>`, preventing a potential off-by-one overflow when
writing the null terminator.
- Fixed the `MaterialChunkHeapOverflow` and `MaterialChunkOOBReadText`
unit tests in `test_filaflat.cpp` by adding missing header fields to
the mock payloads so they correctly pass initialization.
Fixes#9871
* a new tribool type in libutils (header only)
* Support `Engine::compile` overload to generate view-dependent variants
Implemented an `Engine::compile()` method to infer and generate shader
permutations directly based on feature states from a provided `View`
alongside `tribool` settings (skinning, shadowReceiver).
- Added a new `Material::compile()` overload that directly accepts
a precalculated `FixedCapacityVector<Variant>`, decoupling the
Material compilation process from specific feature flag checks.
FIXES=[468058969]
- Move the renderer options to be applied before others before view
and camera options.
- Add "render" field to the output of the json description of
the settings (this was missing).
- This fixes the Scene->Background Color setting for
Android's gltf_viewer
- Fix constant wrap-around: Define `BIT_COUNT`, `BITS_PER_WORD`, and
`WORD_COUNT` (fixed typo from `WORLD_COUNT`) as `size_t` rather than
`T` to prevent silent overflows on large bitsets using small integer
types.
- Fix NEON `all()` truncation: Remove the generic `T` cast to correctly
evaluate bounds across the full 64-bit vector lanes.
- Fix non-NEON `count()` overflow: Use a `size_t` accumulator rather
than `T` to prevent overflow when counting >255 bits on `uint8_t`
parameters.
- Fix NEON strict alignment UB: Enforce unconditional `alignas(16)` on
`storage` when `BIT_COUNT` satisfies 128-bit vector multiples, adding
a compile-time `static_assert` to ensure ABI expectations match NEON
load intrinsics.
- Remove dead masking code inside `firstSetBit()`.
Missing the castShadows=true caused the shadows to be missing
on mobile (using the remote settings page).
Update README.md (this will trigger an update to the remote
page's filament.js)
Mathias Agopian
Powei Feng
Èric Bitriá Ribes
Ben Doherty
Jocelin Cailloux