Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: 0ee462d32cfe5635fd30e5ab580d80f4076762a0
https://github.com/WebKit/WebKit/commit/0ee462d32cfe5635fd30e5ab580d80f4076762a0
Author: Roberto Rodriguez <[email protected]>
Date: 2026-09-14 (Mon, 14 Sep 2026)
Changed paths:
A
LayoutTests/fast/canvas/webgl/draw-elements-base-vertex-out-of-bounds-expected.txt
A LayoutTests/fast/canvas/webgl/draw-elements-base-vertex-out-of-bounds.html
M LayoutTests/platform/glib/TestExpectations
M LayoutTests/platform/ios/TestExpectations
M Source/ThirdParty/ANGLE/src/libANGLE/ErrorStrings.h
M Source/ThirdParty/ANGLE/src/libANGLE/validationES.cpp
M Source/ThirdParty/ANGLE/src/libANGLE/validationES.h
M Source/ThirdParty/ANGLE/src/libANGLE/validationES2.h
M Source/ThirdParty/ANGLE/src/libANGLE/validationES3.cpp
M Source/ThirdParty/ANGLE/src/libANGLE/validationES32.cpp
M Source/ThirdParty/ANGLE/src/libANGLE/validationESEXT.cpp
M Source/ThirdParty/ANGLE/src/tests/gl_tests/DrawElementsTest.cpp
Log Message:
-----------
Cherry-pick [email protected] (e21200a08a7a).
https://bugs.webkit.org/show_bug.cgi?id=319507
[ANGLE] drawElements*BaseVertex* does not check baseVertex against the
vertex buffer size
https://bugs.webkit.org/show_bug.cgi?id=319507
rdar://177955302
Reviewed by Dan Glastonbury.
When drawing indexed geometry with a base vertex, the GPU reads each vertex
at
(index + baseVertex), but validation only checks the index against the size
of the
bound vertex buffers and ignores baseVertex. A small, in-range index buffer
combined
with a large baseVertex therefore passes validation while the GPU reads
past the end
of the buffer, an out-of-bounds read in the GPU process. This is only
reachable when
the WebGL draft extensions setting is enabled, which is off by default.
Fix by passing baseVertex into the shared draw-elements validation and
checking the
effective range (index + baseVertex), rejecting a draw whose largest
effective index
is past the buffer or whose smallest effective index is negative. Every
base-vertex
entry point now forwards its baseVertex and the others pass 0, so ordinary
draws are
unchanged.
Test: fast/canvas/webgl/draw-elements-base-vertex-out-of-bounds.html
*
LayoutTests/fast/canvas/webgl/draw-elements-base-vertex-out-of-bounds-expected.txt:
Added.
*
LayoutTests/fast/canvas/webgl/draw-elements-base-vertex-out-of-bounds.html:
Added.
* LayoutTests/platform/ios/TestExpectations:
* Source/ThirdParty/ANGLE/src/libANGLE/ErrorStrings.h:
* Source/ThirdParty/ANGLE/src/libANGLE/validationES.cpp:
(gl::ValidateDrawElementsInstancedBase):
(gl::ValidateDrawElementsInstancedANGLE):
(gl::ValidateDrawElementsInstancedEXT):
* Source/ThirdParty/ANGLE/src/libANGLE/validationES.h:
(gl::ValidateDrawElementsCommon):
* Source/ThirdParty/ANGLE/src/libANGLE/validationES2.h:
(gl::ValidateDrawElements):
* Source/ThirdParty/ANGLE/src/libANGLE/validationES3.cpp:
(gl::ValidateDrawRangeElements):
(gl::ValidateDrawElementsInstanced):
(gl::ValidateMultiDrawElementsInstancedANGLE):
(gl::ValidateDrawElementsInstancedBaseVertexBaseInstanceANGLE):
(gl::ValidateMultiDrawElementsInstancedBaseVertexBaseInstanceANGLE):
* Source/ThirdParty/ANGLE/src/libANGLE/validationES32.cpp:
(gl::ValidateDrawElementsBaseVertex):
(gl::ValidateDrawElementsInstancedBaseVertex):
(gl::ValidateDrawRangeElementsBaseVertex):
* Source/ThirdParty/ANGLE/src/libANGLE/validationESEXT.cpp:
(gl::ValidateDrawElementsBaseVertexEXT):
(gl::ValidateDrawElementsInstancedBaseVertexEXT):
(gl::ValidateDrawRangeElementsBaseVertexEXT):
(gl::ValidateDrawElementsInstancedBaseInstanceEXT):
(gl::ValidateDrawElementsInstancedBaseVertexBaseInstanceEXT):
(gl::ValidateDrawElementsBaseVertexOES):
(gl::ValidateDrawElementsInstancedBaseVertexOES):
(gl::ValidateDrawRangeElementsBaseVertexOES):
* Source/ThirdParty/ANGLE/src/tests/gl_tests/DrawElementsTest.cpp:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1179@webkitglib/2.52
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
