Branch: refs/heads/webkitglib/2.52
Home: https://github.com/WebKit/WebKit
Commit: d945f9ea601f4a2fc3e89e1233f5002115b46fac
https://github.com/WebKit/WebKit/commit/d945f9ea601f4a2fc3e89e1233f5002115b46fac
Author: Roberto Rodriguez <[email protected]>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Source/ThirdParty/ANGLE/src/libANGLE/es3_format_type_combinations.json
M Source/ThirdParty/ANGLE/src/libANGLE/format_map_autogen.cpp
M Source/ThirdParty/ANGLE/src/tests/gl_tests/DepthStencilFormatsTest.cpp
Log Message:
-----------
Cherry-pick [email protected] (8b1c27595893).
https://bugs.webkit.org/show_bug.cgi?id=315712
[ANGLE] Fix GL_DEPTH_COMPONENT32_OES format validation to reject
GL_UNSIGNED_INT_24_8
https://bugs.webkit.org/show_bug.cgi?id=315712
rdar://176813583
Reviewed by Kimmo Kinnunen.
es3_format_type_combinations.json incorrectly pairs
GL_DEPTH_COMPONENT32_OES with GL_UNSIGNED_INT_24_8,
allowing TexImage2D with internalformat=GL_DEPTH_COMPONENT32_OES,
format=GL_DEPTH_COMPONENT, and
type=GL_UNSIGNED_INT_24_8 to pass ES3 format validation.
GL_UNSIGNED_INT_24_8 is only valid with
GL_DEPTH_STENCIL (per OpenGL ES 3.0.6, Table 3.6). Metal backend's
load-function table has no converter
for this combination and falls through to UnreachableLoadFunction which in
release-mode is a no-op,
causing an uninitialized malloc'd buffer to be uploaded into the GPU
process depth texture.
Change the JSON entry from GL_UNSIGNED_INT_24_8 to GL_UNSIGNED_INT and
regenerate format_map_autogen.cpp.
The invalid combination is now rejected with GL_INVALID_OPERATION before
any buffer allocation occurs.
* Source/ThirdParty/ANGLE/src/libANGLE/es3_format_type_combinations.json:
* Source/ThirdParty/ANGLE/src/libANGLE/format_map_autogen.cpp:
(gl::ValidES3FormatCombination):
* Source/ThirdParty/ANGLE/src/tests/gl_tests/DepthStencilFormatsTest.cpp:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1117@webkitglib/2.52
Commit: b2139ded406227ebf18951dd3e4ffdf8c7ae05f3
https://github.com/WebKit/WebKit/commit/b2139ded406227ebf18951dd3e4ffdf8c7ae05f3
Author: Roberto Rodriguez <[email protected]>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj
M Source/ThirdParty/ANGLE/src/compiler/translator/msl/EmitMetal.cpp
M Source/ThirdParty/ANGLE/src/compiler/translator/msl/ProgramPrelude.cpp
M Source/ThirdParty/ANGLE/src/tests/angle_end2end_tests.gni
A Source/ThirdParty/ANGLE/src/tests/gl_tests/IntegerOverflowClampTest.cpp
Log Message:
-----------
Cherry-pick [email protected] (43afeddf1aab).
https://bugs.webkit.org/show_bug.cgi?id=315543
[ANGLE] MSL translator missing integer UB wrappers allow array bounds clamp
elimination
https://bugs.webkit.org/show_bug.cgi?id=315543
rdar://176813852
Reviewed by Kimmo Kinnunen.
The MSL translator uses UB-safe wrapper functions to perform integer
arithmetic via unsigned
operations, preventing Metal's LLVM backend from exploiting undefined
behavior to fold away
the ANGLE_int_clamp array-bounds guard. Three operations are not routed
through these wrappers:
signed unary negate, signed division by -1, and unsigned div/mod. The
resulting UB lets LLVM's
optimizer eliminate the bounds clamp, allowing a WebGL2 page to index
arbitrarily into GPU
device memory.
The fix routes all three operations through UB-safe wrappers: a new
ANGLE_negateInt that negates
via unsigned subtraction, an extended ANGLE_div that guards divisor -1 in
addition to 0, and
routing unsigned div/mod through the existing ANGLE_div/ANGLE_imod whose
unsigned branches already
mask zero divisors.
The new wrappers are tested in IntegerOverflowClampTest.cpp.
* Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj:
* Source/ThirdParty/ANGLE/src/compiler/translator/msl/EmitMetal.cpp:
(GetOperatorString):
* Source/ThirdParty/ANGLE/src/compiler/translator/msl/ProgramPrelude.cpp:
(PROGRAM_PRELUDE_DECLARE):
* Source/ThirdParty/ANGLE/src/tests/angle_end2end_tests.gni:
* Source/ThirdParty/ANGLE/src/tests/gl_tests/IntegerOverflowClampTest.cpp:
Added.
(angle::IntegerOverflowClampTest::IntegerOverflowClampTest):
(angle::IntegerOverflowClampTest::runShader):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1118@webkitglib/2.52
Commit: c8ab82498cbe84c9990f847a1b053597bc639c97
https://github.com/WebKit/WebKit/commit/c8ab82498cbe84c9990f847a1b053597bc639c97
Author: Kimmo Kinnunen <[email protected]>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Source/ThirdParty/ANGLE/src/libANGLE/VertexArray.cpp
M Source/ThirdParty/ANGLE/src/tests/gl_tests/VertexAttributeTest.cpp
Log Message:
-----------
Cherry-pick [email protected] (3320c0a36383).
https://bugs.webkit.org/show_bug.cgi?id=317294
ANGLE: Element limit not updated after format only VertexAttribPointer
change
https://bugs.webkit.org/show_bug.cgi?id=317294
rdar://176813568
Reviewed by Dan Glastonbury.
Before, changing the type of a vertex attrib would not cause recomputation
of how many elements can be drawn. The type size affects this, as
last attrib of the buffer accesses only the type size amount of data, not
the stride amount of data.
Example buffer size == 32:
- type size == 1, stride == 28 --> buffer fits 2 elements.
- type size == 16, stride == 28 --> buffer fits 1 element.
Fix by recomputing the element count also in case the type changes.
* Source/ThirdParty/ANGLE/src/libANGLE/VertexArray.cpp:
(gl::VertexArray::bindVertexBufferImpl):
(gl::VertexArray::bindVertexBuffer):
(gl::VertexArray::setVertexAttribPointerImpl):
* Source/ThirdParty/ANGLE/src/tests/gl_tests/VertexAttributeTest.cpp:
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1119@webkitglib/2.52
Commit: 4de8bc28e5cfff734ac8c65ac943af91e75c4712
https://github.com/WebKit/WebKit/commit/4de8bc28e5cfff734ac8c65ac943af91e75c4712
Author: Kimmo Kinnunen <[email protected]>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
A
LayoutTests/ipc/set-fill-pattern-image-buffer-cross-backend-race-expected.txt
A LayoutTests/ipc/set-fill-pattern-image-buffer-cross-backend-race.html
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
Log Message:
-----------
Cherry-pick [email protected] (d5c5da3f748b).
https://bugs.webkit.org/show_bug.cgi?id=317295
SerializedImageBuffer leaks cross-RemoteRenderingBackend data through
GraphicsContext
https://bugs.webkit.org/show_bug.cgi?id=317295
rdar://175520296
Reviewed by Dan Glastonbury.
ImageBuffer context state might leak non-thread-safe
cross-RemoteRenderingBackend instances through GraphicsContext state.
Release the GraphicsContext when transfering the ImageBuffer to
different RRB.
*
LayoutTests/ipc/set-fill-pattern-image-buffer-cross-backend-race-expected.txt:
Added.
* LayoutTests/ipc/set-fill-pattern-image-buffer-cross-backend-race.html:
Added.
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::RemoteRenderingBackend::moveToSerializedBuffer):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1120@webkitglib/2.52
Commit: 418b3e661af8865550df72bf272be4913a08f6ee
https://github.com/WebKit/WebKit/commit/418b3e661af8865550df72bf272be4913a08f6ee
Author: Said Abou-Hallawa <[email protected]>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp
Log Message:
-----------
Cherry-pick [email protected] (33120ad29238).
https://bugs.webkit.org/show_bug.cgi?id=316439
RemoteRenderingBackend can still allocateImageBuffer() with
RenderingMode::DisplayList
https://bugs.webkit.org/show_bug.cgi?id=316439
rdar://176382472
Reviewed by Simon Fraser.
RemoteRenderingBackend::allocateImageBuffer() is called from
1. RemoteRenderingBackend::createImageBuffer()
2. RemoteImageBufferSet::ensureBufferForDisplay().
In 311931@main, which fixes bug 307843, a MESSAGE_CHECK() was added in
RemoteRenderingBackend::allocateImageBuffer() to prevent creating a remote
ImageBufferDisplayListBackend. But this change left the call from
RemoteImageBufferSet::ensureBufferForDisplay().
The fix is to move the MESSAGE_CHECK from
RemoteRenderingBackend::createImageBuffer()
to RemoteRenderingBackend::allocateImageBuffer().
* Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp:
(WebKit::RemoteRenderingBackend::allocateImageBuffer):
(WebKit::RemoteRenderingBackend::createImageBuffer):
Identifier: [email protected]
Canonical link: https://commits.webkit.org/305877.1121@webkitglib/2.52
Compare: https://github.com/WebKit/WebKit/compare/d532453033db...418b3e661af8
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
