ASSERT(!toType.isArray()) failure in sh::CoerceSimple due to vector a…

…rray dereference https://bugs.webkit.org/show_bug.cgi?id=225864 Source/ThirdParty/ANGLE: <rdar://77968214> Reviewed by Dean Jackson. Fixed program translation error, additional issues with transform feedback shaders * src/compiler/translator/TranslatorMetalDirect/AddExplicitTypeCasts.cpp: * src/libANGLE/renderer/metal/ProgramMtl.mm: (rx::ProgramMtl::reset): LayoutTests: <rdar://77968214> Reviewed by Dean Jackson. Fixed program translation error, additional issues with preloaded transform feedback shaders * fast/canvas/webgl/shader-vec-array-deref-no-crash-expected.txt: Added. * fast/canvas/webgl/shader-vec-array-deref-no-crash.html: Added. Canonical link: https://commits.webkit.org/237919@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@277749 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · May 19, 2021 · fed34d53b79323079f3430134008cb562a337935 · fed34d5
1 parent 9c008cd
commit fed34d53b79323079f3430134008cb562a337935
Showing 6 changed files with 53 additions and 4 deletions.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,16 @@
+2021-05-19  Kyle Piddington <kpiddington@apple.com> 
+
+        ASSERT(!toType.isArray()) failure in sh::CoerceSimple due to vector array dereference
+        https://bugs.webkit.org/show_bug.cgi?id=225864
+        <rdar://77968214>
+
+        Reviewed by Dean Jackson.
+
+        Fixed program translation error, additional issues with preloaded transform feedback shaders
+
+        * fast/canvas/webgl/shader-vec-array-deref-no-crash-expected.txt: Added.
+        * fast/canvas/webgl/shader-vec-array-deref-no-crash.html: Added.
+
 2021-05-19  Kyle Piddington  <kpiddington@apple.com>
 
         [ANGLE Metal] Support provoking vertex emulation, pass fragmentOutput tests

diff --git a/LayoutTests/fast/canvas/webgl/shader-vec-array-deref-no-crash-expected.txt b/LayoutTests/fast/canvas/webgl/shader-vec-array-deref-no-crash-expected.txt
@@ -0,0 +1 @@
+PASS, no crash.
diff --git a/LayoutTests/fast/canvas/webgl/shader-vec-array-deref-no-crash.html b/LayoutTests/fast/canvas/webgl/shader-vec-array-deref-no-crash.html
@@ -0,0 +1,16 @@
+<body>
+<script>
+if (window.testRunner)
+  testRunner.dumpAsText();
+let c = document.createElement("canvas");
+let gl = c.getContext("webgl2");
+let vs = gl.createShader(gl.VERTEX_SHADER);
+gl.shaderSource(vs, "#version 300 es\nvoid main(){vec2 S[1];S;}");
+gl.compileShader(vs);
+if (!gl.getShaderParameter(vs, gl.COMPILE_STATUS) ) {
+    let info = gl.getShaderInfoLog(vs);
+    throw 'Could not compile WebGL program. Info:' + info;
+}
+document.body.innerHTML += "PASS, no crash."
+</script>
+</body>
diff --git a/Source/ThirdParty/ANGLE/ChangeLog b/Source/ThirdParty/ANGLE/ChangeLog
@@ -1,3 +1,17 @@
+2021-05-19  Kyle Piddington  <kpiddington@apple.com>
+
+        ASSERT(!toType.isArray()) failure in sh::CoerceSimple due to vector array dereference
+        https://bugs.webkit.org/show_bug.cgi?id=225864
+        <rdar://77968214> 
+
+        Reviewed by Dean Jackson.
+
+        Fixed program translation error, additional issues with transform feedback shaders
+
+        * src/compiler/translator/TranslatorMetalDirect/AddExplicitTypeCasts.cpp:
+        * src/libANGLE/renderer/metal/ProgramMtl.mm:
+        (rx::ProgramMtl::reset):
+
 2021-05-19  Kyle Piddington  <kpiddington@apple.com>
 
         [ANGLE Metal] Support Provoking Vertex Emulation, Pass Fragment Output test suite.

diff --git a/...e/ThirdParty/ANGLE/src/compiler/translator/TranslatorMetalDirect/AddExplicitTypeCasts.cpp b/...e/ThirdParty/ANGLE/src/compiler/translator/TranslatorMetalDirect/AddExplicitTypeCasts.cpp
@@ -44,7 +44,8 @@ class Rewriter : public TIntermRebuild
             }
             else if (retType.isVector())
             {
-                if (argCount == 1)
+                //1 element arrays need to be accounted for.
+                if (argCount == 1 && !retType.isArray())
                 {
                     TIntermTyped &arg   = GetArg(callNode, 0);
                     const TType argType = arg.getType();

diff --git a/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ProgramMtl.mm b/Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/ProgramMtl.mm
@@ -247,6 +247,7 @@ void InitArgumentBufferEncoder(mtl::Context *context,
     for (gl::ShaderType shaderType : gl::AllShaderTypes())
     {
         mMslShaderTranslateInfo[shaderType].reset();
+        mCurrentShaderVariants[shaderType] = nullptr;
     }
     mMslXfbOnlyVertexShaderInfo.reset();
 
@@ -1164,6 +1165,7 @@ void InitArgumentBufferEncoder(mtl::Context *context,
             pipelineDesc.rasterizationEnabled()
                 ? &mFragmentShaderVariants[pipelineDesc.emulateCoverageMask]
                 : nullptr;
+
     }
 
     ANGLE_TRY(commitUniforms(context, cmdEncoder));
@@ -1257,8 +1259,7 @@ void InitArgumentBufferEncoder(mtl::Context *context,
         }
 
         const mtl::TranslatedShaderInfo &shaderInfo =
-            *mCurrentShaderVariants[shaderType]->translatedSrcInfo;
-
+            mCurrentShaderVariants[shaderType]->translatedSrcInfo ? *mCurrentShaderVariants[shaderType]->translatedSrcInfo : mMslShaderTranslateInfo[shaderType];
         bool hasDepthSampler = false;
 
         for (uint32_t textureIndex = 0; textureIndex < mState.getSamplerBindings().size();
@@ -1334,7 +1335,9 @@ void InitArgumentBufferEncoder(mtl::Context *context,
 
     for (gl::ShaderType shaderType : gl::AllGLES2ShaderTypes())
     {
-        if (mCurrentShaderVariants[shaderType]->translatedSrcInfo->hasUBOArgumentBuffer)
+        const mtl::TranslatedShaderInfo &shaderInfo =
+            mCurrentShaderVariants[shaderType]->translatedSrcInfo ? *mCurrentShaderVariants[shaderType]->translatedSrcInfo : mMslShaderTranslateInfo[shaderType];
+        if (shaderInfo.hasUBOArgumentBuffer)
         {
             ANGLE_TRY(
                 encodeUniformBuffersInfoArgumentBuffer(context, cmdEncoder, blocks, shaderType));
@@ -1470,6 +1473,7 @@ void InitArgumentBufferEncoder(mtl::Context *context,
     gl::ShaderType shaderType)
 {
     const gl::State &glState = context->getState();
+    ASSERT(mCurrentShaderVariants[shaderType]->translatedSrcInfo);
     const mtl::TranslatedShaderInfo &shaderInfo =
         *mCurrentShaderVariants[shaderType]->translatedSrcInfo;