High chrome Type Confusion 📄 Reporter bug report 🔧 Commit mapped

Overview

High
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactType Confusion in ANGLE
DescriptionType Confusion in ANGLE
ComponentANGLE
Bug ClassType Confusion
Tracker517575864
Fix commit165fb9fc835f (angle/angle) +68/-2
CISA KEVNot listed
CreditedGoogle
Disclosed2026-07-29

Files Changed

  • src/compiler/translator/ir/src/transform/broadcast_fragcolor.rs
  • src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp
  • src/tests/angle_end2end_tests_expectations.txt
  • src/tests/gl_tests/GLSLTest.cpp
From 165fb9fc835fd7e381c131c995ab7568db1d323a Mon Sep 17 00:00:00 2001
From: Shahbaz Youssefi <[email protected]>
Date: Fri, 29 May 2026 11:07:06 -0400
Subject: [PATCH] GL: Fix `invariant gl_FragColor;` + draw buffers

When GL_EXT_draw_buffers is enabled, gl_FragColor is replaced by
gl_FragData.  If it was globally qualified as `invariant`, the relevant
transformation did not handle it.

Bug: chromium:517575864
Change-Id: I3ec2a6629940a69070e5327abd8ce37c55d0efcd
Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/7883926
Reviewed-by: Geoff Lang <[email protected]>
Commit-Queue: Geoff Lang <[email protected]>
---

diff --git a/src/compiler/translator/ir/src/transform/broadcast_fragcolor.rs b/src/compiler/translator/ir/src/transform/broadcast_fragcolor.rs
index 517946c..0c40534 100644
--- a/src/compiler/translator/ir/src/transform/broadcast_fragcolor.rs
+++ b/src/compiler/translator/ir/src/transform/broadcast_fragcolor.rs
@@ -49,7 +49,8 @@
         let replacement = ir.meta.get_variable_mut(original_id);
         replacement.name = Name::new_temp(name);
         replacement.built_in = None;
-        debug_assert!(replacement.decorations.decorations.is_empty());
+        // The built-in might have decorations such as Invariant
+        let decorations = std::mem::replace(&mut replacement.decorations, Decorations::new_none());
         debug_assert!(replacement.scope == VariableScope::Global);
         debug_assert!(!replacement.is_const);
 
@@ -66,7 +67,9 @@
         let type_id = ir.meta.get_array_type_id(type_id, array_size);
         let (arrayed_built_in_id, arrayed_built_in) =
             ir.meta.declare_built_in_variable(type_id, precision, broadcast_to);
-        ir.meta.get_variable_mut(arrayed_built_in_id).is_static_use = true;
+        let new_built_in = ir.meta.get_variable_mut(arrayed_built_in_id);
+        new_built_in.is_static_use = true;
+        new_built_in.decorations = decorations;
 
         // Since the variable ID is unchanged, the IR does not need further modification.  The
         // transformation only needs to replicate the value of the global variable in each element
diff --git a/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp b/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp
index 99532a4..3100952 100644
--- a/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp
+++ b/src/compiler/translator/tree_ops/EmulateGLFragColorBroadcast.cpp
@@ -51,6 +51,8 @@
     bool isGLSecondaryFragColorUsed() const { return mGLSecondaryFragColorUsed; }
 
   protected:
+    bool visitGlobalQualifierDeclaration(Visit visit,
+                                         TIntermGlobalQualifierDeclaration *node) override;
     void visitSymbol(TIntermSymbol *node) override;
 
     TIntermBinary *constructGLFragDataNode(int index, bool secondary) const;
@@ -84,6 +86,31 @@
     return new TIntermBinary(EOpAssign, fragDataIndex, fragDataZero);
 }
 
+bool GLFragColorBroadcastTraverser::visitGlobalQualifierDeclaration(
+    Visit visit,
+    TIntermGlobalQualifierDeclaration *node)
+{
+    TIntermSymbol *symbol = node->getSymbol();
+    if (symbol->variable().symbolType() == SymbolType::BuiltIn)
+    {
+        if (symbol->getName() == "gl_FragColor")
+        {
+            queueReplacementWithParent(
+                node, node->getSymbol(),
+                ReferenceBuiltInVariable(kGlFragDataString, *mSymbolTable, mShaderVersion),
+                OriginalNode::IS_DROPPED);
+        }
+        else if (symbol->getName() == "gl_SecondaryFragColorEXT")
+        {
+            queueReplacementWithParent(
+                node, node->getSymbol(),
+                ReferenceBuiltInVariable(kGlSecondaryFragDataString, *mSymbolTable, mShaderVersion),
+                OriginalNode::IS_DROPPED);
+        }
+    }
+    return false;
+}
+
 void GLFragColorBroadcastTraverser::visitSymbol(TIntermSymbol *node)
 {
     if (node->variable().symbolType() == SymbolType::BuiltIn)
diff --git a/src/tests/angle_end2end_tests_expectations.txt b/src/tests/angle_end2end_tests_expectations.txt
index 446507c..9f95376 100644
--- a/src/tests/angle_end2end_tests_expectations.txt
+++ b/src/tests/angle_end2end_tests_expectations.txt
@@ -497,6 +497,8 @@
 494341324 MAC OPENGL : MipmapTestES3.MismatchingLevelFormats/* = SKIP
 496604559 MAC METAL : RobustResourceInitTestES3.DrawThenInvalidateThenVerifyDepthStencil/* = SKIP
 515709506 MAC METAL : DrawBaseVertexBaseInstanceTest_ES3.BaseInstanceSmallDivisorClientMemory/* = SKIP
+518849408 MAC OPENGL : GLSLTest.EmulateGLFragColorBroadcastInvariantFragColor/* = SKIP
+518849408 MAC OPENGL : GLSLTest.EmulateGLFragColorBroadcastInvariantFragColorUnused/* = SKIP
 
 // The workaround is not intended to be enabled in this configuration so
 // skip it as the failure is likely a driver bug.
diff --git a/src/tests/gl_tests/GLSLTest.cpp b/src/tests/gl_tests/GLSLTest.cpp
index 519ac59..79ed94c 100644
--- a/src/tests/gl_tests/GLSLTest.cpp
+++ b/src/tests/gl_tests/GLSLTest.cpp
@@ -24164,6 +24164,40 @@
     // (Note: 565 with no alpha, glReadPixels will pad alpha to 255).
     EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::white);
 }
+
+// Make sure gl_FragColor can be marked invariant in presence of GL_EXT_draw_buffers.
+TEST_P(GLSLTest, EmulateGLFragColorBroadcastInvariantFragColor)
+{
+    ANGLE_SKIP_TEST_IF(!EnsureGLExtensionEnabled("GL_EXT_draw_buffers"));
+
+    constexpr char kFS[] = R"(#extension GL_EXT_draw_buffers : require
+        invariant gl_FragColor;
+        void main() {
+            gl_FragColor = vec4(1.0, 0.0, 0.0, 1.0);
+        }
+    )";
+
+    ANGLE_GL_PROGRAM(program, essl1_shaders::vs::Simple(), kFS);
+    drawQuad(program, essl3_shaders::PositionAttrib(), 0.5f);
+    EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::red);
+}
+
+// Make sure gl_FragColor can be marked invariant in presence of GL_EXT_draw_buffers, even if
+// gl_FragColor is unused.
+TEST_P(GLSLTest, EmulateGLFragColorBroadcastInvariantFragColorUnused)
+{
+    ANGLE_SKIP_TEST_IF(!EnsureGLExtensionEnabled("GL_EXT_draw_buffers"));
+
+    constexpr char kFS[] = R"(#extension GL_EXT_draw_buffers : require
+        invariant gl_FragColor;
+        void main() {
+            // gl_FragColor is unused
+        }
+    )";
+
+    // Verify compilation only, as output is not written to.
+    ANGLE_GL_PROGRAM(program, essl1_shaders::vs::Simple(), kFS);
+}
 }  // anonymous namespace
 
 ANGLE_INSTANTIATE_TEST_ES2_AND_ES3_AND_ES31_AND_ES32(
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/src/tests/angle_end2end_tests_expectations.txt b/src/tests/angle_end2end_tests_expectations.txt
index 446507c..9f95376 100644
--- a/src/tests/angle_end2end_tests_expectations.txt
+++ b/src/tests/angle_end2end_tests_expectations.txt
@@ -497,6 +497,8 @@
 494341324 MAC OPENGL : MipmapTestES3.MismatchingLevelFormats/* = SKIP
 496604559 MAC METAL : RobustResourceInitTestES3.DrawThenInvalidateThenVerifyDepthStencil/* = SKIP
 515709506 MAC METAL : DrawBaseVertexBaseInstanceTest_ES3.BaseInstanceSmallDivisorClientMemory/* = SKIP
+518849408 MAC OPENGL : GLSLTest.EmulateGLFragColorBroadcastInvariantFragColor/* = SKIP
+518849408 MAC OPENGL : GLSLTest.EmulateGLFragColorBroadcastInvariantFragColorUnused/* = SKIP
 
 // The workaround is not intended to be enabled in this configuration so
 // skip it as the failure is likely a driver bug.
diff --git a/src/tests/gl_tests/GLSLTest.cpp b/src/tests/gl_tests/GLSLTest.cpp
index 519ac59..79ed94c 100644
--- a/src/tests/gl_tests/GLSLTest.cpp
+++ b/src/tests/gl_tests/GLSLTest.cpp
@@ -24164,6 +24164,40 @@
     // (Note: 565 with no alpha, glReadPixels will pad alpha to 255).
     EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::white);
 }
+
+// Make sure gl_FragColor can be marked invariant in presence of GL_EXT_draw_buffers.
+TEST_P(GLSLTest, EmulateGLFragColorBroadcastInvariantFragColor)
+{
+    ANGLE_SKIP_TEST_IF(!EnsureGLExtensionEnabled("GL_EXT_draw_buffers"));
+
+    constexpr char kFS[] = R"(#extension GL_EXT_draw_buffers : require
+        invariant gl_FragColor;
+        void main() {
+            gl_FragColor = vec4(1.0, 0.0, 0.0, 1.0);
+        }
+    )";
+
+    ANGLE_GL_PROGRAM(program, essl1_shaders::vs::Simple(), kFS);
+    drawQuad(program, essl3_shaders::PositionAttrib(), 0.5f);
+    EXPECT_PIXEL_COLOR_EQ(0, 0, GLColor::red);
+}
+
+// Make sure gl_FragColor can be marked invariant in presence of GL_EXT_draw_buffers, even if
+// gl_FragColor is unused.
+TEST_P(GLSLTest, EmulateGLFragColorBroadcastInvariantFragColorUnused)
+{
+    ANGLE_SKIP_TEST_IF(!EnsureGLExtensionEnabled("GL_EXT_draw_buffers"));
+
+    constexpr char kFS[] = R"(#extension GL_EXT_draw_buffers : require
+        invariant gl_FragColor;
+        void main() {
+            // gl_FragColor is unused
+        }
+    )";
+
+    // Verify compilation only, as output is not written to.
+    ANGLE_GL_PROGRAM(program, essl1_shaders::vs::Simple(), kFS);
+}
 }  // anonymous namespace
 
 ANGLE_INSTANTIATE_TEST_ES2_AND_ES3_AND_ES31_AND_ES32(
Loading diff…

Original Bug Report

reported by [email protected]

Type confusion in the EmulateGLFragColorBroadcast workaround when using 'invariant gl_FragColor'

This bug was first reported to Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=2029402

The following test shows a crash:

TEST_P(GLSLTest, EmulateGLFragColorBroadcastInvariantFragColor)
{
    ANGLE_SKIP_TEST_IF(!EnsureGLExtensionEnabled("GL_EXT_draw_buffers"));

    constexpr char kFS[] = R"(#extension GL_EXT_draw_buffers : require
        invariant gl_FragColor;
        void main() {
            gl_FragColor = vec4(1.0, 0.0, 0.0, 1.0);
        }
    )";

    ANGLE_GL_PROGRAM(program, essl1_shaders::vs::Simple(), kFS);
    glUseProgram(program);
}

This requires running on the GL backend any of the GLSL output types except SH_GLSL_420_CORE_OUTPUT which removes the invariant keyword.

Running it locally in a debug build generates the following:

IntermNode.cpp:401 (replaceChildNode): Replacing a node with a node of invalid type: calling replacement.getAsSymbolNode() should not return nullptr.

The following ASAN report is generated:

=================================================================
==7477==ERROR: AddressSanitizer: SEGV on unknown address 0x0000bfff8003 (pc 0x75940eb3cd26 bp 0x7ffd1d79b590 sp 0x7ffd1d79b520 T0)
==7477==The signal is caused by a READ memory access.
    #0 0x75940eb3cd26 in sh::TSymbol::symbolType() const /firefox/gfx/angle/checkout/src/compiler/translator/Symbol.h:56:44
    #1 0x75940eb3cd26 in sh::HashName(sh::TSymbol const*, unsigned long (*)(char const*, unsigned long), std::map<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>, std::less<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>, std::allocator<std::pair<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>> const, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>>>*) /firefox/gfx/angle/checkout/src/compiler/translator/HashNames.cpp:87:17
    #2 0x75940eb7f1e1 in sh::TOutputGLSLBase::hashName(sh::TSymbol const*) /firefox/gfx/angle/checkout/src/compiler/translator/OutputGLSLBase.cpp:1130:12
    #3 0x75940eb7f1e1 in sh::TOutputGLSLBase::visitGlobalQualifierDeclaration(sh::Visit, sh::TIntermGlobalQualifierDeclaration*) /firefox/gfx/angle/checkout/src/compiler/translator/OutputGLSLBase.cpp:898:63
    #4 0x75940ed6fb4a in void sh::TIntermTraverser::traverse<sh::TIntermNode>(sh::TIntermNode*) /firefox/gfx/angle/checkout/src/compiler/translator/tree_util/IntermTraverse.cpp:33:23
    #5 0x75940eb7ea91 in sh::TOutputGLSLBase::visitBlock(sh::Visit, sh::TIntermBlock*) /firefox/gfx/angle/checkout/src/compiler/translator/OutputGLSLBase.cpp:868:18
    #6 0x75940ed6d39a in sh::TIntermBlock::visit(sh::Visit, sh::TIntermTraverser*) /firefox/gfx/angle/checkout/src/compiler/translator/tree_util/IntermTraverse.cpp:180:16
    #7 0x75940ed6d39a in sh::TIntermTraverser::traverseBlock(sh::TIntermBlock*) /firefox/gfx/angle/checkout/src/compiler/translator/tree_util/IntermTraverse.cpp:467:23
    #8 0x75940ec5f454 in sh::TranslatorGLSL::translate(sh::TIntermBlock*, ShCompileOptions const&, sh::PerformanceDiagnostics*) /firefox/gfx/angle/checkout/src/compiler/translator/TranslatorGLSL.cpp:213:11
    #9 0x75940eb2ce9b in sh::TCompiler::compile(char const* const*, unsigned long, ShCompileOptions const&) /firefox/gfx/angle/checkout/src/compiler/translator/Compiler.cpp:1229:18
    #10 0x75940e73dec9 in mozilla::webgl::ShaderValidator::ValidateAndTranslate(char const*) const /firefox/dom/canvas/WebGLShaderValidator.cpp:279:7
    #11 0x75940e73c326 in mozilla::WebGLShader::CompileShader() /firefox/dom/canvas/WebGLShader.cpp:100:34
    #12 0x75940e66ea25 in mozilla::WebGLContext::CompileShader(mozilla::WebGLShader&) /firefox/dom/canvas/WebGLContextGL.cpp:1496:10
    #13 0x75940e5c612c in mozilla::HostWebGLContext::CompileShader(unsigned long) const /firefox/dom/canvas/HostWebGLContext.h:329:15
    #14 0x75940e5a808e in void mozilla::ClientWebGLContext::Run_WithDestArgTypes<void (mozilla::HostWebGLContext::*)(unsigned long) const, unsigned long>(std::optional<JS::AutoCheckCannotGC>&&, void (mozilla::HostWebGLContext::*)(unsigned long) const, unsigned long, unsigned long const&) const /firefox/dom/canvas/ClientWebGLContext.cpp:449:5
    #15 0x75940e4ba362 in void mozilla::ClientWebGLContext::Run_WithDestArgTypes_ConstnessHelper<unsigned long>(std::optional<JS::AutoCheckCannotGC>&&, void (mozilla::HostWebGLContext::*)(unsigned long) const, unsigned long, std::remove_reference<std::remove_const<unsigned long>::type>::type const&) const /firefox/dom/canvas/ClientWebGLContext.h:2388:5
    #16 0x75940e4ba362 in void mozilla::ClientWebGLContext::Run<void (mozilla::HostWebGLContext::*)(unsigned long) const, &mozilla::HostWebGLContext::CompileShader(unsigned long) const, unsigned long>(unsigned long const&) const /firefox/dom/canvas/ClientWebGLContext.h:2358:5
    #17 0x75940e4ba362 in mozilla::ClientWebGLContext::CompileShader(mozilla::WebGLShaderJS&) const /firefox/dom/canvas/ClientWebGLContext.cpp:6861:3
    #18 0x75940d7dfd0e in mozilla::dom::WebGLRenderingContext_Binding::compileShader(JSContext*, JS::Handle<JSObject*>, void*, JSJitMethodCallArgs const&) /firefox/obj-firefox-asan/dom/bindings/./WebGLRenderingContextBinding.cpp:16268:24
    #19 0x75940e2027bd in bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions>(JSContext*, unsigned int, JS::Value*) /firefox/dom/bindings/BindingUtils.cpp:3378:13
    #20 0x759417db935a in CallJSNative(JSContext*, bool (*)(JSContext*, unsigned int, JS::Value*), js::CallReason, JS::CallArgs const&) /firefox/js/src/vm/Interpreter.cpp:490:13
    #21 0x759417db935a in js::InternalCallOrConstruct(JSContext*, JS::CallArgs const&, js::MaybeConstruct, js::CallReason) /firefox/js/src/vm/Interpreter.cpp:586:12

==7477==Register values:
rax = 0x0000000200000018  rbx = 0x00007ffd1d79b520  rcx = 0x0000000040000003  rdx = 0x000000008fff6fff
rdi = 0x0000000200000001  rsi = 0x0000000000000000  rbp = 0x00007ffd1d79b590  rsp = 0x00007ffd1d79b520
 r8 = 0x0000000000000000   r9 = 0x00007fffffffff01  r10 = 0x0000765432c1d701  r11 = 0x0000000000000001
r12 = 0x00000eb28631ae10  r13 = 0x0000778432bc0d68  r14 = 0x00007594318d7080  r15 = 0x00007594318d7080
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/firefox/obj-firefox-asan/dist/bin/libxul.so+0x1a9c8d26) (BuildId: bc75d35c2d8c6b7624508c50301aeb52)
==7477==ABORTING
View on issue tracker