Branch: refs/heads/webkitglib/2.54
Home: https://github.com/WebKit/WebKit
Commit: 37a200263b1c424bb5ef91ffc0d1bb71f78b09eb
https://github.com/WebKit/WebKit/commit/37a200263b1c424bb5ef91ffc0d1bb71f78b09eb
Author: Roberto Rodriguez <[email protected]>
Date: 2026-09-03 (Thu, 03 Sep 2026)
Changed paths:
M Source/ThirdParty/ANGLE/src/libANGLE/es3_format_type_combinations.json
M Source/ThirdParty/ANGLE/src/libANGLE/format_map_autogen.cpp
M Source/ThirdParty/ANGLE/src/tests/gl_tests/DepthStencilFormatsTest.cpp
Log Message:
-----------
Cherry-pick [email protected] (8b1c27595893).
https://bugs.webkit.org/show_bug.cgi?id=315712
[ANGLE] Fix GL_DEPTH_COMPONENT32_OES format validation to reject
GL_UNSIGNED_INT_24_8
https://bugs.webkit.org/show_bug.cgi?id=315712
rdar://176813583
Reviewed by Kimmo Kinnunen.
es3_format_type_combinations.json incorrectly pairs
GL_DEPTH_COMPONENT32_OES with GL_UNSIGNED_INT_24_8,
allowing TexImage2D with internalformat=GL_DEPTH_COMPONENT32_OES,
format=GL_DEPTH_COMPONENT, and
type=GL_UNSIGNED_INT_24_8 to pass ES3 format validation.
GL_UNSIGNED_INT_24_8 is only valid with
GL_DEPTH_STENCIL (per OpenGL ES 3.0.6, Table 3.6). Metal backend's
load-function table has no converter
for this combination and falls through to UnreachableLoadFunction which in
release-mode is a no-op,
causing an uninitialized malloc'd buffer to be uploaded into the GPU
process depth texture.
Change the JSON entry from GL_UNSIGNED_INT_24_8 to GL_UNSIGNED_INT and
regenerate format_map_autogen.cpp.
The invalid combination is now rejected with GL_INVALID_OPERATION before
any buffer allocation occurs.
* Source/ThirdParty/ANGLE/src/libANGLE/es3_format_type_combinations.json:
* Source/ThirdParty/ANGLE/src/libANGLE/format_map_autogen.cpp:
(gl::ValidES3FormatCombination):
* Source/ThirdParty/ANGLE/src/tests/gl_tests/DepthStencilFormatsTest.cpp:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.186@webkitglib/2.54
Commit: e25e25cf6902de2120ae4b45d56c7d93c1d88bda
https://github.com/WebKit/WebKit/commit/e25e25cf6902de2120ae4b45d56c7d93c1d88bda
Author: Roberto Rodriguez <[email protected]>
Date: 2026-09-03 (Thu, 03 Sep 2026)
Changed paths:
M Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj
M Source/ThirdParty/ANGLE/src/compiler/translator/msl/EmitMetal.cpp
M Source/ThirdParty/ANGLE/src/compiler/translator/msl/ProgramPrelude.cpp
M Source/ThirdParty/ANGLE/src/tests/angle_end2end_tests.gni
A Source/ThirdParty/ANGLE/src/tests/gl_tests/IntegerOverflowClampTest.cpp
Log Message:
-----------
Cherry-pick [email protected] (43afeddf1aab).
https://bugs.webkit.org/show_bug.cgi?id=315543
[ANGLE] MSL translator missing integer UB wrappers allow array bounds clamp
elimination
https://bugs.webkit.org/show_bug.cgi?id=315543
rdar://176813852
Reviewed by Kimmo Kinnunen.
The MSL translator uses UB-safe wrapper functions to perform integer
arithmetic via unsigned
operations, preventing Metal's LLVM backend from exploiting undefined
behavior to fold away
the ANGLE_int_clamp array-bounds guard. Three operations are not routed
through these wrappers:
signed unary negate, signed division by -1, and unsigned div/mod. The
resulting UB lets LLVM's
optimizer eliminate the bounds clamp, allowing a WebGL2 page to index
arbitrarily into GPU
device memory.
The fix routes all three operations through UB-safe wrappers: a new
ANGLE_negateInt that negates
via unsigned subtraction, an extended ANGLE_div that guards divisor -1 in
addition to 0, and
routing unsigned div/mod through the existing ANGLE_div/ANGLE_imod whose
unsigned branches already
mask zero divisors.
The new wrappers are tested in IntegerOverflowClampTest.cpp.
* Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj:
* Source/ThirdParty/ANGLE/src/compiler/translator/msl/EmitMetal.cpp:
(GetOperatorString):
* Source/ThirdParty/ANGLE/src/compiler/translator/msl/ProgramPrelude.cpp:
(PROGRAM_PRELUDE_DECLARE):
* Source/ThirdParty/ANGLE/src/tests/angle_end2end_tests.gni:
* Source/ThirdParty/ANGLE/src/tests/gl_tests/IntegerOverflowClampTest.cpp:
Added.
(angle::IntegerOverflowClampTest::IntegerOverflowClampTest):
(angle::IntegerOverflowClampTest::runShader):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/317695.187@webkitglib/2.54
Compare: https://github.com/WebKit/WebKit/compare/37e8b8b7168a...e25e25cf6902
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
