diff --git a/third_party/angle/src/compiler/translator/ParseContext.cpp b/third_party/angle/src/compiler/translator/ParseContext.cpp index ef8d290e85..c8bfda94e5 100644 --- a/third_party/angle/src/compiler/translator/ParseContext.cpp +++ b/third_party/angle/src/compiler/translator/ParseContext.cpp @@ -9129,6 +9129,15 @@ TIntermTyped *TParseContext::addComma(TIntermTyped *left, { error(loc, "sequence operator is not allowed for interface blocks", ","); } + // Opaque types (samplers, images, atomic counters, pixel-local-storage handles, etc.) + // are not allowed as operands to the sequence operator. Without this check a + // pixelLocalANGLE-typed comma expression can survive to MonomorphizeUnsupportedFunctions + // and reach RewritePixelLocalStorage with an unbound function parameter, causing a + // past-the-end std::map iterator dereference. + if (IsOpaqueType(left->getBasicType()) || IsOpaqueType(right->getBasicType())) + { + error(loc, "sequence operator is not allowed for variables with an opaque type", ","); + } TIntermBinary *commaNode = TIntermBinary::CreateComma(left, right, mShaderVersion); markStaticUseIfSymbol(left);