Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: bb5740819e68ae4a2d5c60613861f559f05e7b4b
https://github.com/WebKit/WebKit/commit/bb5740819e68ae4a2d5c60613861f559f05e7b4b
Author: Roberto Rodriguez <[email protected]>
Date: 2026-08-24 (Mon, 24 Aug 2026)
Changed paths:
A
LayoutTests/fast/canvas/webgl/draw-elements-base-vertex-out-of-bounds-expected.txt
A LayoutTests/fast/canvas/webgl/draw-elements-base-vertex-out-of-bounds.html
M LayoutTests/platform/glib/TestExpectations
M LayoutTests/platform/ios/TestExpectations
M Source/ThirdParty/ANGLE/src/libANGLE/ErrorStrings.h
M Source/ThirdParty/ANGLE/src/libANGLE/validationES.cpp
M Source/ThirdParty/ANGLE/src/libANGLE/validationES.h
M Source/ThirdParty/ANGLE/src/libANGLE/validationES2.h
M Source/ThirdParty/ANGLE/src/libANGLE/validationES3.cpp
M Source/ThirdParty/ANGLE/src/libANGLE/validationES32.cpp
M Source/ThirdParty/ANGLE/src/libANGLE/validationESEXT.cpp
M Source/ThirdParty/ANGLE/src/tests/gl_tests/DrawElementsTest.cpp
Log Message:
-----------
[ANGLE] drawElements*BaseVertex* does not check baseVertex against the vertex
buffer size
https://bugs.webkit.org/show_bug.cgi?id=319507
rdar://177955302
Reviewed by Dan Glastonbury.
When drawing indexed geometry with a base vertex, the GPU reads each vertex at
(index + baseVertex), but validation only checks the index against the size of
the
bound vertex buffers and ignores baseVertex. A small, in-range index buffer
combined
with a large baseVertex therefore passes validation while the GPU reads past
the end
of the buffer, an out-of-bounds read in the GPU process. This is only reachable
when
the WebGL draft extensions setting is enabled, which is off by default.
Fix by passing baseVertex into the shared draw-elements validation and checking
the
effective range (index + baseVertex), rejecting a draw whose largest effective
index
is past the buffer or whose smallest effective index is negative. Every
base-vertex
entry point now forwards its baseVertex and the others pass 0, so ordinary
draws are
unchanged.
Test: fast/canvas/webgl/draw-elements-base-vertex-out-of-bounds.html
*
LayoutTests/fast/canvas/webgl/draw-elements-base-vertex-out-of-bounds-expected.txt:
Added.
* LayoutTests/fast/canvas/webgl/draw-elements-base-vertex-out-of-bounds.html:
Added.
* LayoutTests/platform/ios/TestExpectations:
* Source/ThirdParty/ANGLE/src/libANGLE/ErrorStrings.h:
* Source/ThirdParty/ANGLE/src/libANGLE/validationES.cpp:
(gl::ValidateDrawElementsInstancedBase):
(gl::ValidateDrawElementsInstancedANGLE):
(gl::ValidateDrawElementsInstancedEXT):
* Source/ThirdParty/ANGLE/src/libANGLE/validationES.h:
(gl::ValidateDrawElementsCommon):
* Source/ThirdParty/ANGLE/src/libANGLE/validationES2.h:
(gl::ValidateDrawElements):
* Source/ThirdParty/ANGLE/src/libANGLE/validationES3.cpp:
(gl::ValidateDrawRangeElements):
(gl::ValidateDrawElementsInstanced):
(gl::ValidateMultiDrawElementsInstancedANGLE):
(gl::ValidateDrawElementsInstancedBaseVertexBaseInstanceANGLE):
(gl::ValidateMultiDrawElementsInstancedBaseVertexBaseInstanceANGLE):
* Source/ThirdParty/ANGLE/src/libANGLE/validationES32.cpp:
(gl::ValidateDrawElementsBaseVertex):
(gl::ValidateDrawElementsInstancedBaseVertex):
(gl::ValidateDrawRangeElementsBaseVertex):
* Source/ThirdParty/ANGLE/src/libANGLE/validationESEXT.cpp:
(gl::ValidateDrawElementsBaseVertexEXT):
(gl::ValidateDrawElementsInstancedBaseVertexEXT):
(gl::ValidateDrawRangeElementsBaseVertexEXT):
(gl::ValidateDrawElementsInstancedBaseInstanceEXT):
(gl::ValidateDrawElementsInstancedBaseVertexBaseInstanceEXT):
(gl::ValidateDrawElementsBaseVertexOES):
(gl::ValidateDrawElementsInstancedBaseVertexOES):
(gl::ValidateDrawRangeElementsBaseVertexOES):
* Source/ThirdParty/ANGLE/src/tests/gl_tests/DrawElementsTest.cpp:
Originally-landed-as: [email protected] (e21200a08a7a).
rdar://185366919
Canonical link: https://commits.webkit.org/319735@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
