Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 9eeb617afd1d6f309fbf0a9e2c64e318f9f7fa84
https://github.com/WebKit/WebKit/commit/9eeb617afd1d6f309fbf0a9e2c64e318f9f7fa84
Author: Roberto Rodriguez <[email protected]>
Date: 2026-08-24 (Mon, 24 Aug 2026)
Changed paths:
M Source/ThirdParty/ANGLE/src/libANGLE/es3_format_type_combinations.json
M Source/ThirdParty/ANGLE/src/libANGLE/format_map_autogen.cpp
M Source/ThirdParty/ANGLE/src/tests/gl_tests/DepthStencilFormatsTest.cpp
Log Message:
-----------
[ANGLE] Fix GL_DEPTH_COMPONENT32_OES format validation to reject
GL_UNSIGNED_INT_24_8
https://bugs.webkit.org/show_bug.cgi?id=315712
rdar://176813583
Reviewed by Kimmo Kinnunen.
es3_format_type_combinations.json incorrectly pairs GL_DEPTH_COMPONENT32_OES
with GL_UNSIGNED_INT_24_8,
allowing TexImage2D with internalformat=GL_DEPTH_COMPONENT32_OES,
format=GL_DEPTH_COMPONENT, and
type=GL_UNSIGNED_INT_24_8 to pass ES3 format validation. GL_UNSIGNED_INT_24_8
is only valid with
GL_DEPTH_STENCIL (per OpenGL ES 3.0.6, Table 3.6). Metal backend's
load-function table has no converter
for this combination and falls through to UnreachableLoadFunction which in
release-mode is a no-op,
causing an uninitialized malloc'd buffer to be uploaded into the GPU process
depth texture.
Change the JSON entry from GL_UNSIGNED_INT_24_8 to GL_UNSIGNED_INT and
regenerate format_map_autogen.cpp.
The invalid combination is now rejected with GL_INVALID_OPERATION before any
buffer allocation occurs.
* Source/ThirdParty/ANGLE/src/libANGLE/es3_format_type_combinations.json:
* Source/ThirdParty/ANGLE/src/libANGLE/format_map_autogen.cpp:
(gl::ValidES3FormatCombination):
* Source/ThirdParty/ANGLE/src/tests/gl_tests/DepthStencilFormatsTest.cpp:
Originally-landed-as: [email protected] (8b1c27595893).
rdar://185368194
Canonical link: https://commits.webkit.org/319756@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
