Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ff7b5ea1d73520cf1c823858d553ff1cf1b477d4
https://github.com/WebKit/WebKit/commit/ff7b5ea1d73520cf1c823858d553ff1cf1b477d4
Author: Jon Butler <[email protected]>
Date: 2026-09-16 (Wed, 16 Sep 2026)
Changed paths:
M Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/RewriteDfdy.cpp
M Source/ThirdParty/ANGLE/src/tests/gl_tests/GLSLTest.cpp
Log Message:
-----------
[ANGLE] Nested dFdx/dFdy calls reaches an ASSERT during derivative rewriting
https://bugs.webkit.org/show_bug.cgi?id=321288
rdar://181803233
Reviewed by Kimmo Kinnunen.
In debug builds, compiling a fragment shader in which one dFdx/dFdy call is the
immediate argument of another, such as dFdy(dFdy(u)), hits ASSERT(replaced) in
TIntermTraverser::updateTree().
RewriteDfdy replaces each call with the sum of dFdx(operand) and dFdy(operand)
scaled by the rotation and flip multipliers, queueing
the replacement with
OriginalNode::IS_DROPPED, and keeps traversing into the operand. A derivative
operand then queues its own replacement with the outer call as parent. The
updater retargets that parent to the replacement expression, where the operand
is
not an immediate child, so the replacement cannot be applied.
Fix by not traversing into a dFdx/dFdy operand. The derivatives under it are
then
left unrotated and unflipped, which only affects the value of a derivative of a
derivative.
* Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/RewriteDfdy.cpp:
* Source/ThirdParty/ANGLE/src/tests/gl_tests/GLSLTest.cpp:
Canonical link:
https://flagged.apple.com:443/proxy?t2=Da8Q0E0EL4&o=aHR0cHM6Ly9jb21taXRzLndlYmtpdC5vcmcvMzIxMjQxQG1haW4=&emid=fd94c1f4-7a9b-4fe4-8d57-06297b6627fd&c=11
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
