Commit Graph

454 Commits

Author SHA1 Message Date
Mathias Agopian
547f1f7e32 utils: Secure EntityManager and hide implementation details
Move the `mGens` array and `isAlive()` implementation from `EntityManager`
to `EntityManagerImpl` to hide implementation details and maintain a clean
public header. Make `isAlive()` strictly thread-safe by acquiring the
`mFreeListLock`.

isAlive() was relying on undefined behavior, and the comment about
the memory barrier being provided by the lock was misleading (wrong)
because the lock only provided the "release", but isAlive() didn't
have an "acquire". 

Better safe than sorry, we now have to acquire the lock to test isAlive().
2026-05-01 11:32:59 -07:00
Powei Feng
96b8015fb4 web: rename WEBGL to WASM for cmake (#9941)
This is a more accurate name because it specifies the platform and
not the graphics API.
2026-04-29 22:21:25 +00:00
Mathias Agopian
9c27bfa3e1 utils: Improve StructureOfArrays (#9936)
- Added `copyRange()` to `StructureOfArrays` to efficiently copy a range
  of elements from another SoA of the same type. It uses `std::copy_n`
  which leverages `memcpy` for trivially copyable types.
- Added `operator[]` to `StructureOfArrays` returning `IteratorValueRef`.
- Added `operator=` for `Structure` (tuple) to `IteratorValueRef` to
  allow direct assignment: `soa[i] = tuple`.
- Added unit tests for these new methods in `test_StructureOfArrays.cpp`.
2026-04-29 09:06:26 -07:00
Mathias Agopian
3f58c3b57d Implement batch callback system for scene cache incremental updates. (#9935)
* Implement batch callback system for scene cache incremental updates.

This change adds a batch callback mechanism to track changes in component
managers and the entity manager, avoiding full cache rebuilds in the
future scene cache implementation.

1. SingleInstanceComponentManager:
- Added SingleInstanceComponentManagerBase to handle callbacks without
  template bloat.
- Implemented batch delivery using Slice<const Entity> and a fixed-size
  array of 16 for dirty entities to avoid heap allocations.
- Added compile-time option for sorted insertion (default to linear).

2. Manager Integration:
- RenderableManager: Added notifications to setters.
- LightManager: Added notifications to setters
- TransformManager: Handled transactions by deferring notifications
  until commit, and supported hierarchical updates in children.

3. EntityManager:
- Added a new batching callback API for entity destruction.
- Used std::function for callbacks to allow thread-safe copying of the
  callback list outside the lock.
- Simple accumulation in loop and flush when full, no bypass.

4. Tests:
- Added formal unit tests for all managers and entity manager callbacks.
2026-04-24 17:07:44 -07:00
Mathias Agopian
f7fd6a9eab Implement grid-based world origin snapping in View (#9917)
* Implement grid-based world origin snapping in View

Implement a grid-based world origin snapping system in View to avoid
per-frame transform updates in the future. This will allow to
improve CPU performance and to enable future caching of acceleration
structures like BVH.

The feature is protected by the 'view.enable_grid_based_world_origin'
feature flag. The grid size can be set
manually via View::setGridSize or calculated automatically as 10%
of the camera's far plane distance.

A 50% hysteresis ratio is applied to prevent rapid origin flipping
near grid edges.

Exposed the new API to Java and JavaScript bindings and added
unit tests in filament_test.cpp.

BUGS=[504726278]

* Refine grid-based world origin snapping implementation

Refine the grid-based world origin snapping in View with several
improvements:

1. Support Orthographic Projections:
   Calculate automatic grid size using projection matrix elements,
   working for both perspective and ortho without assuming positive
   near plane.

2. Stable Automatic Grid Size:
   Only update effective grid size when a position snap occurs.
   This prevents instability when frustum scale changes smoothly.

3. Immediate Manual Override:
   Force an immediate snap when user manually changes grid size.

Added test cases for ortho and auto-grid size in filament_test.cpp.
2026-04-23 14:19:44 -07:00
Mathias Agopian
f4a079f663 backend: Propagate backend thread exceptions to the main thread. (#9903)
* Filament Error Handling Remediation and noexcept Cleanup

- Replaced assert_invariant with FILAMENT_CHECK_PRECONDITION in
  Renderer::beginFrame for caller bugs.
- Removed noexcept from Camera::setCustomProjection to allow precondition
  checks to throw.
- Removed noexcept from Texture and InstanceBuffer methods using precondition
  checks.
- Documented silent clamping in View::setBloomOptions.
- Clarified comment in FrameGraphResources regarding preconditions.
- Refined MaterialInstance::commit to split texture loop into check and update
  passes, preventing partial state changes on precondition failure.

* backend: Propagate backend thread exceptions to the main thread.

Introduce a mechanism to catch exceptions thrown on the backend thread and
rethrow them on the main thread. This prevents deadlocks and allows the
application to handle fatal backend failures gracefully.

- Consolidate synchronization primitives in DriverBase.
- Add mHasUnrecoverableError flag to interrupt blocked fence waits.
- Optimize waitForFence to avoid extra atomic reads in common paths.
- Propagate FenceStatus::ERROR across all backends.
- CommandBufferQueue now stores a std::exception_ptr when the backend fails.
- The backend enters a "zombie" state on failure, skipping further command
  execution but allowing clean shutdown.
- Public APIs in Renderer and Engine now check for stored exceptions and
  rethrow them, documented with @throws.
- Guarded by __EXCEPTIONS to ensure no overhead when exceptions are disabled.
- Add unit test for fence interruption and document new APIs.

BUGS=[407545700]

* feat: harden backend exceptions and add hasUnrecoverableFailure API

- Update Renderer::beginFrame() and Renderer::shouldRenderFrame() to
  return false early if an unrecoverable backend exception has been
  delivered to the main thread.
- Document the new return behavior for beginFrame() and
  shouldRenderFrame() in Renderer.h.
- Add Engine::hasUnrecoverableFailure() to the public API to allow
  apps to check for fatal errors without relying on exceptions.
- Implement hasUnrecoverableFailure() in FEngine by delegating to
  CommandBufferQueue.
- Expose Engine::hasUnrecoverableFailure() to Java bindings
  (Engine.java and JNI).
- Expose Engine::hasUnrecoverableFailure() to JavaScript bindings
  (jsbindings.cpp).

* java: propagate C++ Panics & exceptions to JAVA
2026-04-22 10:56:09 -07:00
Mathias Agopian
eb3d592d18 expose EntityManager::getIndex() publicly
This can be needed for interactions with an outside entity system.
Use with caution.
2026-04-15 09:19:00 -07:00
Mathias Agopian
bc0a547701 Support Engine::compile overload to generate view-dependent variants (#9857)
* a new tribool type in libutils (header only)

* Support `Engine::compile` overload to generate view-dependent variants

Implemented an `Engine::compile()` method to infer and generate shader 
permutations directly based on feature states from a provided `View` 
alongside `tribool` settings (skinning, shadowReceiver). 

- Added a new `Material::compile()` overload that directly accepts 
  a precalculated `FixedCapacityVector<Variant>`, decoupling the 
  Material compilation process from specific feature flag checks.

FIXES=[468058969]
2026-04-01 17:08:11 -07:00
Mathias Agopian
face013e86 utils: Enforce geometric resize bounds limits in ostream to prevent massive out-of-bounds heap operations 2026-03-31 11:17:03 -07:00
Mathias Agopian
8f11927aae utils: Truncate oversized CString allocations rather than overflowing internal length logic 2026-03-31 11:17:03 -07:00
Mathias Agopian
2cdff4b521 utils: Protect InternPool references from overflowing to 0 and triggering heap UAF 2026-03-31 11:17:03 -07:00
Mathias Agopian
d1192544ca utils: Protect JobSystem from 8-bit ref-count overflow and UAF cascades 2026-03-31 11:17:03 -07:00
Mathias Agopian
8df899b111 utils: Protect CString routines against integer overflow heap corruption 2026-03-31 11:17:03 -07:00
Mathias Agopian
f8337c42cb utils: Prevent Win32 FindFirstFile handle leaks during exception unwinding in Path::listContents 2026-03-31 11:17:03 -07:00
Mathias Agopian
cb552def6c utils: Enforce format string boundaries to prevent stack injection during Panic events 2026-03-31 11:17:03 -07:00
Mathias Agopian
883f5bae4e utils: Prevent stack buffer leaks by safely trapping snprintf error bounds in Systrace 2026-03-31 11:17:03 -07:00
Mathias Agopian
6713c68791 utils: Enforce 64-bit boundaries and gracefully intercept 0 length in partition_point 2026-03-31 11:17:03 -07:00
Mathias Agopian
bdef97d52c utils: Prevent capacity overflow in StructureOfArrays scaling logic 2026-03-31 11:17:03 -07:00
Mathias Agopian
0016c0808b utils: Fix functional capture move-assignment leaks in Invocable wrappers 2026-03-31 11:17:03 -07:00
Mathias Agopian
c96edc2972 utils: Implement UTILS_MUL_OVERFLOW safely protecting allocators from multiplication overflows 2026-03-31 11:17:03 -07:00
Mathias Agopian
5c5c3b5bb1 utils: Implement generation counter to resolve CyclicBarrier Deadlocks 2026-03-31 11:17:03 -07:00
Mathias Agopian
8ac45bb391 utils: Safely handle NULL pointers returned by dladdr 2026-03-31 11:17:03 -07:00
Mathias Agopian
b351086bc4 utils: Fix integer underflow in generic vector ostream operator 2026-03-31 11:17:03 -07:00
Mathias Agopian
f0108247d1 Fix various overflow, truncation, and NEON alignment bugs in bitset.h (#9843)
- Fix constant wrap-around: Define `BIT_COUNT`, `BITS_PER_WORD`, and 
  `WORD_COUNT` (fixed typo from `WORLD_COUNT`) as `size_t` rather than 
  `T` to prevent silent overflows on large bitsets using small integer 
  types.

- Fix NEON `all()` truncation: Remove the generic `T` cast to correctly
  evaluate bounds across the full 64-bit vector lanes.

- Fix non-NEON `count()` overflow: Use a `size_t` accumulator rather 
  than `T` to prevent overflow when counting >255 bits on `uint8_t` 
  parameters.

- Fix NEON strict alignment UB: Enforce unconditional `alignas(16)` on 
  `storage` when `BIT_COUNT` satisfies 128-bit vector multiples, adding 
  a compile-time `static_assert` to ensure ABI expectations match NEON 
  load intrinsics.

- Remove dead masking code inside `firstSetBit()`.
2026-03-27 12:51:40 -07:00
Mathias Agopian
052092f553 remove the remaining instances of std::string (#9802)
libfilament (including libutils and libmath) are 100% std::string
free.

std::string is pulled in the .so (on android) through libc++ for 
exception handling, even if we're not using them. There is not much
we can do here, but at least, it's not because of us!

utils::ostream still references it but only as an inline function,
so if the inline is not called, std::string won't be pulled in.

It's also referenced from Path.cpp, but that's not included in
libfilament.
2026-03-17 15:27:12 -07:00
Powei Feng
749b03ed2a utils: refactor getopt into utils namespace (#9796)
On certain linux, macOS environment, there is already a system
getopt. This often creates conflict when compiling filament.
Here we alias utils::getopt to either the system getopt (if
present) or third_party/getopt.

Fixes #7551
2026-03-13 17:22:44 -07:00
Eliza
8a3c48fef1 utils: add LRU cache to RefCountedMap (#9730)
* utils: add LRU cache to RefCountedMap

This change introduces a new data structure LruCache and uses it in
RefCountedMap to keep a fixed number of cache entries alive after their
reference count has dropped to zero in the main map.

* utils: address LRU cache comments
2026-03-05 06:04:16 +00:00
Siyu
52b0b553b4 Marshall the name size when setting thread name with pthread_setname_np (#9753)
* Marshall the name size when setting thread name with pthread_setname_np.

[pthread_setname_np](https://source.corp.google.com/piper///depot/google3/third_party/android/ndk/stable/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/include/pthread.h;l=330-341) requires the caller to keep the name within 16 bytes.

After this change, Filament threads like `OpenGLTimerQuer`, `CompilerThreadP`, `CompilerThreadP`, `Filament Choreo`, `FrameInfoGpuCom` would be displayed correctly in the trace.

* Use constexpr MAX_PTHREAD_NAME_LEN

---------

Co-authored-by: Powei Feng <powei@google.com>
Co-authored-by: Mathias Agopian <mathias@google.com>
2026-02-26 10:43:53 -08:00
Sungun Park
73c343635e Turn off UBO batching (#9736)
BUGS=[486200381]
2026-02-20 20:04:05 +00:00
Andrew Wilson
58f6d77e78 Add build testing checks for all the tests (#9684) 2026-02-11 12:53:40 -08:00
Doris Wu
b06b6b5c42 flip ubobatching flag to true (#9631) 2026-02-03 13:32:20 -08:00
Mathias Agopian
3af28968ed enable skip_frame_when_cpu_ahead_of_display (#9636)
skip_frame_when_cpu_ahead_of_display is now enabled by default.

BUGS=[474599530]
2026-01-30 12:59:04 -08:00
Mathias Agopian
2f36ab71c9 wip: fog for opaques in applied as a post-process effect (#9645)
Instead of computing the fog "inline", in the forward pass, we can
instead compute it as post-process pass that is applied with a
simple fullscreen quad blending.  On tilers, the operation entirely
stays in the tile, on desktop GPU it is a blending operation.

This works only for opaque materials.

The benefit is that fog will become immune to overdraw, and the forward
pass shader will be simplified, hopefully leading to less register
pressure. Overall performance should be improved.

Another benefit is that it will allow us to free the "fog" texture
slot from all opaque materials.

Transparent materials are unchanged.

This feature is currently DISABLED, and still work in progress; but it
should be mostly functional.

To test it:

```
env material.enable_fog_as_postprocess=true ./out/samples/gltf_viewer
```

This change refactor the fog code, but shouldn't have any impact on the
current behavior.
2026-01-30 12:57:25 -08:00
Eliza
2f1266f7dd engine: add program cache (#9297)
* engine: add program cache

This is another chunky change.

The core of this change is to cache programs in MaterialCache according to a
"specialization" (ProgramSpecialization) which is defined as the program cache
ID (the same key used for the OpenGL binary blob cache), the variant, and the
set of spec constants.

As part of this change, a lot of the implementation details of shader
compilation were refactored from Material to MaterialDefinition. The resulting
flow is a lot cleaner and easier to reason about, since shader compilation is
now a pure function of the MaterialDefinition + ProgramSpecialization.

Since the global cache program lookups might take a bit of time to compute
hashes, etc, I left the set of cached programs in Material as well, which kind
of acts like an L1 cache. The effect is that prepareProgram() and getProgram()
should be no slower than HEAD, even with the more complex caching requirements.

I'm planning on writing a document about this (and all changes up until this
point), but I'm being asked to work on higher priority things and I wanted to
have this PR out for review in the meantime so it doesn't bitrot.

* engine: fix unit tests

* engine: fix spec constants intern pool memory leak

* engine: address program cache comments

* engine: address more program cache comments

* engine: matdbg support for program cache

* engine: reinstate descriptorLayout calls

* engine: address bitrot

* engine: add feature flag to disable program cache

* engine: use material CRC32 for program cache

The "cache ID" of a material is supposed to uniquely identify a shader program
and all its variants. This is true to a certain extent, but does not account for
the code generation that happens at runtime. Two materials may have "identical"
shader programs, but due to each material's differing unique metadata, the final
compiled programs may end up very different. Unfortunately, this means we cannot
rely on the "cache ID" alone to determine a shader program's reusability.

Ideally, we should hash this "cache ID" with the exact set of changes to each
shader program so that we could reuse programs across materials. Instead, as a
stopgap solution, use the material's CRC32 instead.

* engine: fix double-free in program cache

* engine: address comments

* engine: assert_invariant empty material cache
2026-01-27 13:09:42 -08:00
Doris Wu
adcdbb45f9 fix typo (#9625) 2026-01-22 14:49:38 -08:00
Mathias Agopian
cff958587d initialize VirtualMachineEnv on the right thread (#9624)
PerformanceHint manager needs a java thread during initialization,
so we need to attach a jvm to the thread that's going to be used.
That thread is the filament backend thread, not necessarily the thread 
the platform is created on.

So we make sure to do that from the backend thread.


FIXES=[427945768]
2026-01-22 10:24:39 -08:00
Powei Feng
390acec928 vk: add feature flag for acquiring swapchain in makeCurrent (#9610)
Removing this behavior in #9541 caused a breakage in one of our
clients. We use a feature flag to enable the old behavior.

BUGS=476144715
2026-01-15 22:48:12 +00:00
Mathias Agopian
f1ffb783d8 feat(engine): Add automatic frame skipping to manage CPU/GPU latency (#9595)
* feat(engine): Add automatic frame skipping to manage CPU/GPU latency

Introduces a new feature, disabled by default, that allows the engine to automatically skip frames when the CPU gets too far ahead of the display's refresh rate. This helps to reduce overall latency by preventing a backlog of frames from building up in the driver queue.

The feature can be enabled with the "engine.skip_frame_when_cpu_ahead_of_display" property.

To implement this, the compositor timing mechanism has been refactored. Instead of reporting an absolute `expectedPresentTime`, the backend now provides an `expectedPresentLatency` relative to vsync. This is more robust against synchronization issues with platform callbacks (like Android's Choreographer), as the latency is generally a constant value.

BUGS=[474599530]
2026-01-15 09:50:56 -08:00
HanYunChenLuo
f88d757d06 Add glibc check to support build filament on Linux musl-based distrib… (#9592) 2026-01-14 23:22:07 +00:00
Mathias Agopian
ba819bcfca Docs: Improve documentation in public headers (#9603)
This commit clarifies and corrects documentation in several public header
files. The changes include fixing typos, improving wording, and adding
missing details to make the API easier to understand and use.

No functional changes are included in this commit.
2026-01-12 14:31:42 -08:00
Mathias Agopian
6ccb6c4cce split FeatureFlagManager out of FEngine (#9596)
* split FeatureFlagManager out of FEngine

- Separate the Feature flags management from FEngine.
- Make FeatureFlagManager available to backends through DriverConfig
- add a way to override a feature flag value at runtime using
  environment variables or system properties (on Android).

e.g.:

```
env "feature.name=true" gltf_viewer
```
or 
```
adb shell setprop debug.feature.name true
```

Co-authored-by: Powei Feng <powei@google.com>
2026-01-12 09:31:51 -08:00
Mathias Agopian
408b2371f0 allow FILAMENT_TRACING_CALL to take extra parameters (#9593) 2026-01-09 15:08:27 -08:00
Sungun Park
2c5842f908 Implement asynchronous resource management (#9508)
This commit introduces async methods and functions across both the
public and backend APIs, enabling non-blocking creation and updates for
Texture, VertexBuffer, and IndexBuffer resources.

Asynchronous resource management is disabled by default. Users should
enable this to use the feature.

Java bindings and a C++ code sample will follow in subsequent PRs.

BUGS=[442921995]
2025-12-19 21:18:32 -08:00
Sungun Park
05f24516dd Fix Build.builder.feature() for Java bindings (#9517)
The "const char*" used for the string literal parameter of the `feature`
method becomes invalid once it passes outside the Java binding scope,
leading to invalid data access. This fix ensures the string is safely
stored.

Add support for heterogeneous lookup in associative containers that
use CString keys. Add conversion operators for std::string_view and
raw string literals to CString.
2025-12-15 21:04:36 +00:00
Mathias Agopian
ee64322d76 improve the memcpy benchmark (#9490)
- remove the multi-threaded tests, they added too much noise
- added a memset test
- make sure we allocate the buffer aligned to 16KB
2025-12-08 21:23:51 -08:00
Mathias Agopian
f90de26bc2 fix disable_gpu_frame_complete_metric flag (#9473)
- set the flag to true (metrics disabled) until downstream is ready
- make sure to exit the JobQueue thread before destroying it

BUGS=[464370498]
2025-12-02 15:02:52 -08:00
Sungun Park
a4f4dc617e Support null initialization for Invocable (#9466)
This allows for code like:

Invocable<void()> inv = []() { /*do something*/ };
inv = nullptr;
2025-12-02 21:29:14 +00:00
Mathias Agopian
ef18030e1a frameId must be monotonic in the SwapChain (#9447)
The frameId coming from a Renderer must be monotonic when seen from
a SwapChain (Specifically a ANativeWindow on Android), if it's not
the case, we must clear that part of the history.

This can happen if a SwapChain is used with two different Renderer; at
this point that SwapChain's history is no longer connected to that
Renderer.
2025-11-20 13:23:58 -08:00
Mathias Agopian
209d3f7550 Fix a race condition when tearing down FrameInfo (#9413)
* HandleAllocator::deallocate() was unsafe

It needs to know the concrete type to call the proper destructor, so
if it was given a base type handle (e.g. Handle<HwFoo>) it would not
destroy it properly.

* add AsyncJobQueue::cancelAll()

* Fix a race condition when tearing down FrameInfo

It is actually invalid to destroy a Handle<HwFence> while inside
fenceWait().

Updated the HwFence implementations so that they don't pretend they can
handle being destroyed during fenceWait(), they can't.

FrameInfo now cancels all the pending callbacks and waits for the 
currently executing one to terminate, *before* destroying the
handles.

Reenable the gpuFrameComplete metric, as it should be working now.
2025-11-06 16:50:08 -08:00
Powei Feng
cb3933b349 Guard MonotonicRingMap.MonotonicityDeathTest with GTEST_HAS_DEATH_TEST (#9388) 2025-10-31 20:45:32 +00:00