This commit is a bulk roll of the bundled ANGLE dependency (Source/ThirdParty/ANGLE/*): angle_commit.h, DEPS, changes.diff and dozens of autogenerated tables are bumped wholesale, and the shown source diff is a mixture of many unrelated upstream changes rather than one isolated security patch. Because the security-relevant change is imported as part of a large dependency update, it is NOT cleanly isolable from the diff, and I will not claim a single definitive corruption mechanism; the following are the security-plausible candidates, explicitly marked as inference.

1. Shader-translator correctness in the Metal backend: EmitMetal.cpp/ProgramPrelude.cpp replace the shared ANGLE_iadd/ANGLE_isub helpers (which were wrongly used for both EOpAdd/EOpSub and their compound-assign forms) with distinct value-returning add/sub and in-place addAssign/subAssign helpers plus dedicated pre/post increment/decrement helpers, all doing arithmetic through unsigned types to avoid signed-integer overflow UB; miscompiling a compound assignment as a by-value expression could corrupt generated MSL and thus GPU-side behavior for crafted WebGL shaders.
2. gl_PerVertex handling: ParseContext.cpp now applies the proper built-in qualifiers (EvqPosition/EvqPointSize/EvqClipDistance/EvqCullDistance) to per-vertex members and tags the block EvqPerVertexIn/Out, CollectVariables.cpp skips per-vertex in/out from variable collection, and TranslatorSPIRV.cpp assigns the reserved input/output PerVertex SPIR-V IDs — mishandling built-in redeclaration is a classic shader-compiler memory-safety area.
3. Reserved-name hardening: Context.cpp now returns -1 from getAttribLocation/getUniformLocation when the name starts with a reserved (gl_) prefix.
4. Buffer contents-observer refactor: Buffer::onContentsChange now takes a Context*, asserts that only texture contents-observers remain, and notifies the context of the buffer binding mask, while State.cpp delegates element-array binding to VertexArray::bindElementBuffer — this is the observer/dirty-tracking machinery that has historically been a source of use-after-free/stale-pointer bugs between Buffer, VertexArray and Texture.
5. Depth clamping: Context::clearBufferfv/clearBufferfi now clamp01 the depth value. The violated invariant and precise fix therefore cannot be pinned from this diff alone; the honest conclusion is that a specific ANGLE-upstream fix (most plausibly in the shader translator or the buffer/vertex-array observer path) rode in with the roll and the surrounding table/enum churn is noise.

Because the fix is delivered inside a bulk ANGLE roll, the strength of the primitive cannot be established from this diff with confidence; the CVE is rated medium with ‘memory corruption from crafted web content’. The most plausible reachable surface is WebGL shader compilation (Metal/SPIR-V translator) or the buffer/vertex-array/texture observer machinery, reached from crafted JS+GLSL. On modern WebKit ANGLE/WebGL runs in the sandboxed GPU process, so a resulting OOB or use-after-free would be confined there and would require a further sandbox escape for full compromise; escalation to code execution is conceivable but not demonstrable from this diff. This assessment is partly inference given the roll cannot be reduced to one mechanism.