Cherry-pick 5a66ef38bf19. rdar://128873925

    Fix array OOB due to a bug in comma expression processing.
    https://bugs.webkit.org/show_bug.cgi?id=xxxxx
    rdar://128873925

    Reviewed by Dan Glastonbury.

    A pre-pass of the ANGLE compiler separates compound expressions into single
    expressions with temporary values. (i.e. x=A+B+C can become tmp1 = b+C,
    x=A+tmp1;). When creating a temporary variable, we previously would copy
    the entire type. However, the type constructor also lead to copying
    qualifiers, such as 'uniform' and 'interface block' markers: Qualifiers
    that can belong to an original type, but shouldn't ever be applied to
    temporary variables. (Fix and explanation by Kyle Piddington.)

    * Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/msl/SeparateCompoundExpressions.cpp:
    (sh::Separator::pushBinding):

    Canonical link: https://commits.webkit.org/272448.1110@safari-7618-branch

Canonical link: https://commits.webkit.org/272448.1118@safari-7618.3.11.11-branch

Author: mscottapple

Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/msl/SeparateCompoundExpressions.cpp

@@ -262,8 +262,10 @@ class Separator : public TIntermRebuild
         }
         auto &bindingMap = getCurrBindingMap();
         const Name name  = mIdGen.createNewName();
-        auto *var =
-            new TVariable(&mSymbolTable, name.rawName(), &newExpr.getType(), name.symbolType());
+        TType *newType   = new TType(newExpr.getType());
+        newType->setQualifier(EvqTemporary);
+        newType->setInterfaceBlock(nullptr);
+        auto *var  = new TVariable(&mSymbolTable, name.rawName(), newType, name.symbolType());
         auto *decl = new TIntermDeclaration(var, &newExpr);
         pushStmt(*decl);
         mExprMap[&oldExpr] = new TIntermSymbol(var);