abde48c0d245ad5237be71e898b1522ac173dcfa  [WebGLOnWebGPU] Use glClearDepthf, not glClearDepth

The bug at a glance

This fixes a null function-pointer dereference in the experimental WebGL-on-WebGPU backend: clearDepth() invoked driver_gl_.fn.glClearDepthFn, which is the desktop-GL entry point and is null when Chromium uses ANGLE’s GLES entry points. Calling through a null function pointer is a deterministic crash (renderer-process DoS), not a controllable memory-corruption primitive, so severity is low. The affected code path is WebGLOnWebGPU, an in-development/flag-gated backend rather than the default WebGL path, further narrowing exposure. CVSS 3.1 reflects a low-privilege, network/web-reachable crash with availability-only impact and no confidentiality/integrity impact. It is a genuine reliability bug worth tracking (any script calling gl.clearDepth on the affected backend crashes the renderer) but there is no evidence of memory disclosure or code execution.

ANGLE exposes GLES entry points; the desktop GL glClearDepth (double-precision) entry point is not populated in that function table, leaving glClearDepthFn null, whereas glClearDepthfFn (the GLES float variant) is valid. The WebGLOnWebGPU shim called the wrong one. The angle for an analyst: this is a wrong-entry-point selection against ANGLE’s function table, and the observable is a null-pointer call reachable directly from the WebGL clearDepth() API.

Root cause

WebGLRenderingContextWebGPUBase::clearDepth(GLfloat depth) forwarded to driver_gl_.fn.glClearDepthFn(depth). glClearDepth corresponds to the desktop GL void glClearDepth(GLdouble) function and is not part of the GLES entry-point set that ANGLE populates; its function pointer is therefore null under ANGLE. Any WebGL script calling context.clearDepth() on this backend would dereference the null pointer and crash the renderer. The fix changes the call to glClearDepthfFn, the GLES float-precision entry point (glClearDepthf), which is populated and semantically correct for WebGL’s float depth argument.

Key code

Call the GLES float entry point glClearDepthf, which ANGLE populates, instead of the null desktop-GL glClearDepth

 void WebGLRenderingContextWebGPUBase::clearDepth(GLfloat depth) {
-  driver_gl_.fn.glClearDepthFn(depth);
+  driver_gl_.fn.glClearDepthfFn(depth);
 }

Patch walkthrough

• third_party/blink/renderer/modules/webgl/webgl_rendering_context_webgpu_base.cc — Single-line change in clearDepth(): the forwarded driver call is switched from glClearDepthFn (desktop GL, null under ANGLE) to glClearDepthfFn (GLES float variant). The argument is already a GLfloat, so the float entry point is the correct match; no other logic changes.

Background

ANGLE — Almost Native Graphics Layer Engine; translates GLES calls to the platform backend (D3D/Metal/Vulkan/WebGPU). Chromium uses ANGLE’s GLES entry points, so desktop-GL-only functions are absent (null) in the driver function table.

glClearDepth vs glClearDepthf — glClearDepth(GLdouble) is desktop GL; glClearDepthf(GLfloat) is the GLES equivalent. WebGL exposes a float depth clear value, so the GLES float entry point is the appropriate one.

WebGLOnWebGPU — An experimental Blink backend implementing the WebGL API on top of WebGPU/ANGLE. Being under active development, it exercises entry points that must match ANGLE’s populated function set.

Vulnerability window

1. introduction — Introduced when the WebGLOnWebGPU clearDepth shim was written against the desktop-GL entry point name rather than the GLES float variant.
2. report — Tracked under Bug 413078308 as part of WebGLOnWebGPU bring-up; calling clearDepth on the backend crashes via null fn pointer.
3. fix — 2026-01-07, Geoff Lang switched the call to glClearDepthfFn (CL 7406481), reviewed by Corentin Wallez.

Proof of concept

No test shipped. Trigger recipe: on a build with the WebGLOnWebGPU backend active, obtain a WebGL context and call gl.clearDepth(1.0). On the unpatched code the renderer dereferences the null glClearDepthFn pointer and crashes. This is a deterministic DoS observable from a one-line script; no exploit code is provided because there is no memory-corruption primitive to demonstrate.

Exploitation

1. precondition — Victim runs a build/config where the WebGLOnWebGPU backend services WebGL contexts.
2. trigger — Any page calls WebGLRenderingContext.clearDepth(), reaching the null function pointer and crashing the renderer process (availability impact only).

Detection & hunting

For defenders and detection engineers:

• Renderer crash with null-address call in clearDepth on WebGLOnWebGPU — Crash reports showing an instruction-pointer of 0 (or near-null) with a stack through WebGLRenderingContextWebGPUBase::clearDepth on affected builds are direct matches.

Audit directions

• Other desktop-GL entry points used in WebGLOnWebGPU — Audit the WebGLOnWebGPU driver_gl_.fn.* call sites for other desktop-GL-only functions (e.g. glClearDepth, glDepthRange vs glDepthRangef, glClipControl variants) that are null under ANGLE and must use GLES equivalents.
• Function-table population assumptions — Verify the backend never calls into fn pointers without confirming they are populated for the active ANGLE entry-point set; consider CHECK/DCHECK on the pointer at call sites during development.