Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f05fd6d8b3bee9719437f45a7cb1d1d7ee9c3151
https://github.com/WebKit/WebKit/commit/f05fd6d8b3bee9719437f45a7cb1d1d7ee9c3151
Author: Roberto Rodriguez <[email protected]>
Date: 2026-08-25 (Tue, 25 Aug 2026)
Changed paths:
M Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj
M Source/ThirdParty/ANGLE/src/compiler/translator/msl/EmitMetal.cpp
M Source/ThirdParty/ANGLE/src/compiler/translator/msl/ProgramPrelude.cpp
M Source/ThirdParty/ANGLE/src/tests/angle_end2end_tests.gni
A Source/ThirdParty/ANGLE/src/tests/gl_tests/IntegerOverflowClampTest.cpp
Log Message:
-----------
[ANGLE] MSL translator missing integer UB wrappers allow array bounds clamp
elimination
https://bugs.webkit.org/show_bug.cgi?id=315543
rdar://176813852
Reviewed by Kimmo Kinnunen.
The MSL translator uses UB-safe wrapper functions to perform integer arithmetic
via unsigned
operations, preventing Metal's LLVM backend from exploiting undefined behavior
to fold away
the ANGLE_int_clamp array-bounds guard. Three operations are not routed through
these wrappers:
signed unary negate, signed division by -1, and unsigned div/mod. The resulting
UB lets LLVM's
optimizer eliminate the bounds clamp, allowing a WebGL2 page to index
arbitrarily into GPU
device memory.
The fix routes all three operations through UB-safe wrappers: a new
ANGLE_negateInt that negates
via unsigned subtraction, an extended ANGLE_div that guards divisor -1 in
addition to 0, and
routing unsigned div/mod through the existing ANGLE_div/ANGLE_imod whose
unsigned branches already
mask zero divisors.
The new wrappers are tested in IntegerOverflowClampTest.cpp.
* Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj:
* Source/ThirdParty/ANGLE/src/compiler/translator/msl/EmitMetal.cpp:
(GetOperatorString):
* Source/ThirdParty/ANGLE/src/compiler/translator/msl/ProgramPrelude.cpp:
(PROGRAM_PRELUDE_DECLARE):
* Source/ThirdParty/ANGLE/src/tests/angle_end2end_tests.gni:
* Source/ThirdParty/ANGLE/src/tests/gl_tests/IntegerOverflowClampTest.cpp:
Added.
(angle::IntegerOverflowClampTest::IntegerOverflowClampTest):
(angle::IntegerOverflowClampTest::runShader):
Originally-landed-as: [email protected] (43afeddf1aab).
rdar://185368065
Canonical link: https://commits.webkit.org/319823@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
