commit 7b0bc3d196d480cce121a7aef375eda817e7e7ce Author: Ashley Hale Date: Tue Jun 09 02:49:49 2026 -0700 Cherry-pick another translator fix commit a25624ef5e0ffa6d30956d99fba040de008a1b3f Author: Shahbaz Youssefi Date: Tue Apr 07 15:51:37 2026 -0400 M148: Translator: Fix redeclared built-in type checks When a built-in is redeclared, it's type must match the built-in. A minor exception is that gl_ClipDistance and gl_CullDistance are allowed to have a smaller array size. The checks for various redeclared built-ins are consolidated in this change, which automatically fixes missing validation for gl_LastFragColor/Depth/StencilARM built-ins. Bug: chromium:499131214 Change-Id: I33c3047852f04a11dbf9f880694c4d3ff8c2585e Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7818777 Reviewed-by: Yuxin Hu commit 71efafb2033e86950eb40ba4e455f2034960f6bd Author: Geoff Lang Date: Thu Mar 26 18:05:30 2026 -0500 M146: Optionally validate GL_MAX_*_UNIFORM_BLOCKS at compile time. These were validated at link time but some drivers have compiler crashes when compiling shaders with too many uniform blocks. Bug: chromium:475877320 Change-Id: I4413ce06307b4fe9e27105d85f66f610c235a301 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7568089 Commit-Queue: Geoff Lang Reviewed-by: Shahbaz Youssefi (cherry picked from commit bf6dd974238bceec7a0a27987e2e02e177f2b7f8) Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7653195 commit e3878006704bd7142896fcefa410925a04ad8ee4 Author: teoxoy <28601907+teoxoy@users.noreply.github.com> Date: Mon May 11 11:20:55 2026 +0200 add missing include commit ff1e5e2227563f239be3f537eeae9de05f2effb5 Author: teoxoy <28601907+teoxoy@users.noreply.github.com> Date: Mon May 11 11:16:18 2026 +0200 eliminate `static_cast` commit 99774d7dd4b8719be30921ff32d01cbea999ccbd Author: teoxoy <28601907+teoxoy@users.noreply.github.com> Date: Mon May 11 11:09:56 2026 +0200 use correct framebuffer var commit a1db0642de56a9a0d7754cd068c97a852f54a16b Author: Shrek Shao Date: Thu Apr 02 15:41:06 2026 -0700 D3D11: Fix overflow in compressed 3D texture deferred-init The ANGLE D3D11 backend computed the zero-fill buffer size for block-compressed 3D textures using an unchecked 32-bit multiplication that did not account for block height. This produced a value four times larger than the actual compressed image size and could overflow for sufficiently large textures. This fix: 1. Uses InternalFormat::computeCompressedImageSize to correctly calculate the required buffer size for compressed textures, taking block dimensions into account. 2. Employs angle::CheckedNumeric for uncompressed texture size calculations to prevent potential integer overflows. 3. Adds a regression test DeferredInit3DOverflow that uses large texture dimensions (2048x2048x320) to verify there is no ASAN error. Bug: b/497896137 Fixed: b/501314630 Change-Id: I76f0fb008af34e8ac78870318e608d16ed4ddd93 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7728091 Reviewed-by: Shahbaz Youssefi Commit-Queue: Shahbaz Youssefi Auto-Submit: Shrek Shao (cherry picked from commit 838c9be2bc21df9ab804428d53bf61fa906be4b4) Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7783400 Reviewed-by: Geoff Lang commit 2601573081fe88bf56a13247b74b62313557798d Author: teoxoy <28601907+teoxoy@users.noreply.github.com> Date: Mon May 11 10:45:36 2026 +0200 call `SafeDelete` only if `onDestroy` has not errored commit 07b62327e0b091b4ccbd9e79bc63b5563a4db91e Author: Steven Noonan Date: Wed Apr 29 11:50:10 2026 +0200 handle Qualcomm's mixed vendor IDs This is a weird situation. Up until Qualcomm had a native Vulkan driver for Windows (with the Snapdragon X series chips), the only vendor ID observable on Windows was 0x4D4F4351. This was reported through DXGI, device manager, etc. But with their native Vulkan driver, they now report 0x5143 as well: VkPhysicalDeviceProperties: --------------------------- apiVersion = 1.3.295 (4206887) driverVersion = 0.807.0 (2150789120) vendorID = 0x5143 deviceID = 0x36334330 deviceType = PHYSICAL_DEVICE_TYPE_INTEGRATED_GPU deviceName = Qualcomm(R) Adreno(TM) X1-85 GPU pipelineCacheUUID = 0eba4509-4351-0000-0000-010c05430000 And yet, DXGI still reports 0x4D4F4351. Cool, huh? Let's teach IsQualcomm to understand both vendor IDs to ensure the device is correctly detected as a tile-based renderer in the Vulkan backend. Bug: angleproject:390866623 Change-Id: I9170c30262ace269498f066e922a279c7e981de6 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/6183621 Reviewed-by: Geoff Lang Reviewed-by: Shahbaz Youssefi Commit-Queue: Geoff Lang Auto-Submit: Steven Noonan commit c75106cebae93b7c103ff1e63b274c3047b520ff Author: Shrek Shao Date: Tue Mar 17 14:04:32 2026 -0700 Fix D3D11 integer overflows in streaming vertex buffer path The D3D11 backend's streaming vertex buffer path had several integer arithmetic errors that could lead to under-reservation or out-of-bounds memory access when using large base instance values. Key changes: - mathutil.h: Added UnsignedCeilDivide64 to handle 64-bit values safely. - Renderer11/Renderer9: Updated getVertexSpaceRequired to use size_t and CheckedNumeric for instance calculations, preventing 32-bit truncation. - VertexBuffer: Updated storeDynamicAttribute to use CheckedNumeric when calculating adjustedCount for instanced attributes with a base instance. - VertexDataManager: Changed firstVertexIndex from GLint to size_t to prevent negative index wrapping and added overflow checks for vertex buffer size validation. - Added a regression test (D3D11OverflowTest.cpp) to verify that large baseInstance values do not cause crashes in the D3D11 backend. This is a Gemini generated CL with manual modifications. Bug: chromium:489791424 Change-Id: I86d13594ee6da6238d8c6583c5268b4bd2ee2658 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7675790 Auto-Submit: Shrek Shao Commit-Queue: Shahbaz Youssefi Reviewed-by: Geoff Lang Reviewed-by: Shahbaz Youssefi commit c194cd0c42e86451d1499c57397e7ef8eefa135c Author: Antonio Maiorano Date: Tue Apr 07 16:03:19 2026 -0400 D3D11: Fix potential OOB read in StoreStaticAttrib Bug: b/489369089 Change-Id: Ieda5e911ed0b122af49af15f52eb938787346143 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7736785 Reviewed-by: Geoff Lang Commit-Queue: Antonio Maiorano commit d941ceb42e6066d57561ba5d6054a5dedfa63055 Author: teoxoy <28601907+teoxoy@users.noreply.github.com> Date: Mon Apr 27 14:27:19 2026 +0200 improve `EmulatedIndexedStorage::getBuffer` commit c276b24aa48b75d454cc496bdcf6d170eed5cff3 Author: Geoff Lang Date: Mon Mar 23 17:32:05 2026 -0400 D3D11: Protect against overflows for texture staging buffers When TextureStorage11 needs to calculate sizes of intermediate buffers for data conversion, do the math in 64-bit using CheckedNumerics. Validate that the results fit into 32 bits. Bug: chromium:491760376 Change-Id: Ie5942291fe7790c229cb1070fa9a2325fa40ac2f Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7695232 Reviewed-by: Shahbaz Youssefi Commit-Queue: Geoff Lang commit 9efddc5cfb20ac0028690bdfc5304a6a7c86dd39 Author: teoxoy <28601907+teoxoy@users.noreply.github.com> Date: Wed Apr 22 18:57:59 2026 +0200 break out of loop early commit 1640bca09e9ab1cd44c0d2d5b2ee3baafff426fe Author: Teodor Tanasoaia <28601907+teoxoy@users.noreply.github.com> Date: Thu Apr 09 17:44:53 2026 +0200 Add return statement for empty bodies commit d4d97ea4f918c6d702d62cde4b76d2d6c4723777 Author: Stephen White Date: Wed Mar 04 15:44:30 2026 -0500 M146: D3D11: fix overflow in line loop and triangle fan If an index buffer is created of element type less than 32bit (e.g., GL_UNSIGNED_BYTE) and used in a line loop or triangle fan, D3D11 must widen it to 32-bit. This can cause an overflow if the widened size in bytes is greater than INT_MAX. The fix is to detect the overflow and abort. Bug: chromium:487977696 Change-Id: I57b1dcc9b3d968da88282164a5f92386500c6205 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7637780 Reviewed-by: Geoff Lang Commit-Queue: Stephen White (cherry picked from commit 4b7aace914924f634c4148c41e6fc87198867fa5) Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7657185 commit b0098a1ebdb0400b515ff7a662685bda111e9e87 Author: Emilio Cobos Álvarez Date: Thu Apr 09 15:03:30 2026 +0200 Add a missing change to 7918168436578718b234bfd56da152e34a85af1d that is in Gecko. commit 442302a3b7ae7cca7f85524e6bb3d774a10b6fbc Author: Shahbaz Youssefi Date: Mon Mar 27 13:05:36 2023 -0400 Translator: Initialize out arguments too for WebGL Local variables were initialized for WebGL, but not `out` arguments. However, `out` arguments completely overwrite the passed-in variable at call site, so they should also be zeroed out. Bug: chromium:1425685 Change-Id: Ib2f61a962eea74c4933aafa4d5ad377189cec578 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/4375137 Reviewed-by: Geoff Lang Reviewed-by: Kenneth Russell Commit-Queue: Shahbaz Youssefi commit 4f5c3dbc01f70efbaaed41743893ed2c8a7653cd Author: Emilio Cobos Álvarez Date: Thu Apr 09 13:40:10 2026 +0200 Add missing codegen from #27. commit be5a7593658365659dfc6384a95c44406e4e5d9e Author: Kimmo Kinnunen Date: Thu Oct 24 11:46:54 2024 +0300 Disallow discarded uniform block references Uniform block instances cannot be used by themselves, as there is no way to refer to their type. Disallow the only typeless access pattern, discarding via expression statement: uniform MyBlock { int x; } b; void main() { b; 0, b; } Explained as disallowed in newer GLSL 300: https://github.com/KhronosGroup/WebGL/issues/3644 The comma expression form would ASSERT in CollectVariables. Bug: angleproject:42267026 Change-Id: I6c8b835482fd551bd97576c1bd24f005874da6af Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5961498 Reviewed-by: Alexey Knyazev Reviewed-by: Geoff Lang Reviewed-by: Shahbaz Youssefi Commit-Queue: Kimmo Kinnunen Auto-Submit: Kimmo Kinnunen commit 329044148ea14623910a1b33a4f1fd81445fd21e Author: Scott Marcy Date: Thu May 30 11:36:58 2024 -0600 Fix stack overflow crash by traversing a too-deep AST This simply moves the check for a too-deep AST before the first attempts to traverse the AST (i.e., `validateAST()`). Bug: angleproject:343505104 Change-Id: Iafb658a30f74a666beab8c69745ca53d17d70dd3 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5585186 Reviewed-by: Shahbaz Youssefi Reviewed-by: Kimmo Kinnunen Commit-Queue: Kimmo Kinnunen Auto-Submit: Scott M commit 28669be7c0129fa7ed117f730484db302a39bcb2 Author: Nisha Jain Date: Thu Mar 07 14:19:58 2024 +0200 Avoid asserts when const folding binary ops on void variables Fix asserts for example with / and % during constant folding when the operands might be voids. Bug: angleproject:8592 Change-Id: I22275642dbcdf9066940d3a94114e8daa5cbbe41 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5416376 Auto-Submit: Kimmo Kinnunen Commit-Queue: Geoff Lang Reviewed-by: Geoff Lang Reviewed-by: Kimmo Kinnunen commit ebaab5cd66b66183175f8c5d5f72210afcba38ca Author: Kimmo Kinnunen Date: Fri Mar 08 14:26:56 2024 +0200 Check array index against unsigned array size Fix an assert during GLSL parsing when a very large array (~1U) type is indexed. Bug: angleproject:8596 Change-Id: I219ac5c8f3fa58aa4c7d679eade6f32b59eb1103 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5352653 Auto-Submit: Kimmo Kinnunen Reviewed-by: Shahbaz Youssefi Commit-Queue: Kimmo Kinnunen commit 5a3f53d8bff0709e94e9b5c2a97684c9a012f6f6 Author: Erica Li Date: Fri Mar 08 12:40:09 2024 +0200 Avoid assert with multiple memory qualifiers Add missing qualifier strings. Bug: angleproject:8593 Change-Id: I484571c33effd85d52712b4876f6a3a5c73d8fde Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5352255 Reviewed-by: Shahbaz Youssefi Auto-Submit: Kimmo Kinnunen Commit-Queue: Shahbaz Youssefi commit f95d411e7d0c5cfb4b0dfef2ecadb952cc92b06a Author: Kimmo Kinnunen Date: Tue Mar 05 21:42:32 2024 +0200 Ensure unary math op parse to an node on error Return the error node for ops like radians(). The math op parse can fail in multiple ways. Fixed: angleproject:8583 Change-Id: Ief7e150dffefe711f567d95c62d1023fc7fa1c91 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5344716 Reviewed-by: Kenneth Russell Auto-Submit: Kimmo Kinnunen Commit-Queue: Kenneth Russell commit 386e3783a143a5268df86bdf93cd10892419f395 Author: Kimmo Kinnunen Date: Mon Mar 04 14:43:10 2024 +0200 Fix layout(index=) parse assert on es 100 shaders Remove invalid assert about layout index qualifier being present only if EXT_blend_func_extended is present. The layout qualifier gets parsed to support EXT_shader_framebuffer_fetch in ES 100 shaders to support "layout(incoherent) mediump vec4 gl_FragData[gl_MaxDrawBuffers]" Fixed: angleproject:8570 Change-Id: I0d0d99bcc882a0befd97c2510dec4a8ccf1690bd Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5340249 Reviewed-by: Kenneth Russell Commit-Queue: Kenneth Russell Auto-Submit: Kimmo Kinnunen commit abe9de5edc89a3db4188c8ddf52e61f6820ecebd Author: Kimmo Kinnunen Date: Fri Feb 16 22:28:18 2024 +0200 Fix ASSERT in non-global precise var decls Precise was treated as invariant. Precise can be declared for non-global variables. Bug: angleproject:8550 Change-Id: Ia0d00d67d0d1504b78294ee2256785fe3da3e399 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5300976 Commit-Queue: Shahbaz Youssefi Auto-Submit: Kimmo Kinnunen Reviewed-by: Shahbaz Youssefi Reviewed-by: Kenneth Russell commit 718164d445a82bd24da61ff670deb5f1702fbfc3 Author: Kimmo Kinnunen Date: Tue Feb 13 17:54:12 2024 +0200 Uniform block reference in constuctors crash Passing uniform block instance name to a built-in constructor would cause type confusion. Block this by failing to parse. Bug: angleproject:8533 Change-Id: I5a676b41e2f3d766ece4ed472debc1c874753293 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5290897 Commit-Queue: Shahbaz Youssefi Reviewed-by: Shahbaz Youssefi Commit-Queue: Kimmo Kinnunen Auto-Submit: Kimmo Kinnunen commit a7ce496eaa3ac8f108190ca544e00024edead840 Author: Kimmo Kinnunen Date: Wed Feb 07 14:25:32 2024 +0200 Fix an assert on multidim array constructors Fail early instead of asserting when trying to parse a multidimensional array constructor call with unsized argument array argument. int A[]; int B[int[][](A)]; Bug: angleproject:8519 Change-Id: Iee2c70318eebd2def57ffab8db709d1076692922 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5272434 Reviewed-by: Shahbaz Youssefi Auto-Submit: Kimmo Kinnunen Commit-Queue: Kimmo Kinnunen Commit-Queue: Shahbaz Youssefi commit 7918168436578718b234bfd56da152e34a85af1d Author: Kelsey Gilbert Date: Tue Jun 04 15:37:29 2024 -0700 Add GLSL variable byte size limits to ShBuiltInResources. commit 31c0a5bff1330706aff3c4594c8166745814a45b Author: Shahbaz Youssefi Date: Wed May 03 13:41:36 2023 -0400 WebGL: Limit total size of private data ... not just individual arrays. Bug: chromium:1431761 Change-Id: I721e29aeceeaf12c3f6a67b668abffb8dfbc89b0 Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/4503753 Reviewed-by: Kenneth Russell Commit-Queue: Shahbaz Youssefi commit ddaf44ac75d5d0390873c2af193e02159ecbe672 Author: Geoff Lang Date: Fri Dec 08 13:20:36 2023 -0500 Validate Uniform variable limits with each iteration VariablePacker would loop over all variables and sum up the total row counts before validating. Each variable can take hundreds of rows so it is possible to overflow the counters before validating them. Validate the limits with each iteration and early-out when the limits are exceeded. https://bugzilla.mozilla.org/show_bug.cgi?id=1864587 Bug: chromium:1864587 Change-Id: Ic235ada1516a0d5a9948d82b22f6316a037c09ca Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5106408 Reviewed-by: Shahbaz Youssefi Auto-Submit: Geoff Lang Commit-Queue: Shahbaz Youssefi commit 6784271c1c6273a1be0b6a2dad9ac7b921521ad8 Author: Shahbaz Youssefi Date: Tue Mar 28 11:43:23 2023 -0400 Translator: Limit the size of private variables in WebGL shaders As a follow up to https://chromium-review.googlesource.com/c/angle/angle/+/3023033, the limit to shader-private variables (locals and globals) is further reduced to 1MB. A variable that large will not fit in GPU registers and will spill to memory, killing performance. Bug: chromium:1427865 Change-Id: I77314d4b891c591cd9a83ad2aebb77d7256f3ada Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/4377639 Reviewed-by: Kenneth Russell commit 23347851217a581f3b9d877af203a0dcc4b7b6e9 Author: Kelsey Gilbert Date: Wed Mar 29 16:13:39 2023 -0700 Add ShCompileOptions.initGLPointSize. Change-Id: I1d998867f3e829ed0dc8181fa76be5fe701dde70 commit aa3a569c8ddc1122d55663749a6db63e48b3033c Author: Ashley Hale Date: Wed Mar 01 18:03:04 2023 -0800 Disable ClearView with scissor on Skylake iGPU because of observed bugs with edge corruption. (#27) commit d93c05cd2d786f2c624fbf8f4465238b38a771a1 Author: Kelsey Gilbert Date: Thu Sep 08 17:10:21 2022 -0700 Import in SymbolTable_ESSL_autogen.cpp. Fixes Snap builds of Firefox. Change-Id: I8d71d230d5e4a5a042e6afd4e31342da9a085bed Co-authored-by: Erich Gubler commit 0bf5781fddeb50d02b703dd89cc77b2c5f07e334 Author: Erich Gubler Date: Thu Jan 19 00:20:06 2023 -0500 build(linux): disable `PoolAlloc` to work around `asan` failures We noticed this causing problems in [Firefox CI][failing-ci]. [failing-ci]: https://treeherder.mozilla.org/jobs?repo=autoland&author=egubler%40mozilla.com&selectedTaskRun=e6KdZgnNTCOE9weaOnTjVQ.0 commit ea4d354f6cfc83c31446a855f3fd5603737eae76 Author: Erich Gubler Date: Wed Nov 16 20:54:23 2022 -0500 fix(windows,pre-c++20): use default ctors for `std::atomic` commit 9bcfaed62b60e210004217fd5e79c25f3e2b3760 Author: Jeff Gilbert Date: Thu Jul 15 15:56:45 2021 -0700 Add missing header to build config. commit 16baec7195df362b9d615ccb7e5d51673501e10e Author: Jeff Gilbert Date: Thu Feb 11 17:34:00 2021 -0800 Don't assert for non-sampleable non-ms sources in blitRenderbufferRect if we can CopySubResource. In Firefox, we can have a source from DirectComposition without D3D11_BIND_SHADER_RESOURCE. This is fine so long as our formats etc match enough to hit the CopySubResource path. Firefox bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1692355 commit 43e9d9a7c95b509869a774fab62bf42d6d15b745 Author: Jeff Muizelaar Date: Wed May 06 14:04:42 2020 -0400 Don't use ClearView if we previously used dual source blending on Intel gen6. (#22) Doing a ClearView after a dual source blend seems to cause a TDR on Intel SandyBridge. Presumeably this is because the ClearView is implemented as a regular draw and the driver doesn't properly set up the state. If we detect that this is going to happen we fall back to the manual draw call path. This lets us use ClearView most of the time still. commit b16ebaa05424354c06c2ccdccc36df2c7c1b191e Author: Erich Gubler Date: Wed Nov 09 21:12:44 2022 -0500 Fix broken build from `-Wexit-time-destructors` on Windows x64 commit 4c3a473aec4e09ffacd0466817cb851529087767 Author: Dzmitry Malyshau Date: Thu Dec 05 13:02:14 2019 -0500 Restrict the slow texture upload workaround to 128bit formats. (#21) The workaround is slow for having a CPU-visible mirror of the texture, but that mirror is not properly recycled with regards to GPU usage, thus causing a CPU stall on update. Original reports were related to WebRender vertex texture updates that are RGBA32F and RGBA32U formats. Limiting the workaround to these formats would allow the affected platforms to upload regular texture data faster without stalls. Co-authored-by: Erich Gubler Above: cherries picked ================================================================================ Below: merge base from: origin/chromium/5359 commit ceec659ac60b0c8ee9d9c602ca1a878ec1d3a88f Author: Shahbaz Youssefi Date: Mon Oct 31 10:29:45 2022 -0400 M108: Vulkan: Disable logicOp dynamic state on Intel/Mesa Hits a stack overflow inside the driver. Bug: chromium:1379201 Change-Id: I790d7ef0333ba17eedbe91e4fc9c3a2b94563bff Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/4004440 Reviewed-by: Yuxin Hu