translator: Fix use-after-free with DepthRange.
Because this builtin uses a structure, certain shaders could trigger
the mangled name to be allocated during normal shader compilation.
Then when the scope is popped, the mangled name for DepthRange is
freed, and we're left with a dangling pointer.
Fix this temporarily by enforcing mangled name construction when
we initialize the builtins, but we should look for a more robust and
future-proof fix.
BUG=620937
Change-Id: If130c8b48a18054502abaec08f10264f282b4925
Reviewed-on: https://chromium-review.googlesource.com/354494
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Reviewed-by: Antoine Labour <piman@google.com>
Commit-Queue: Jamie Madill <jmadill@chromium.org>
diff --git a/src/compiler/translator/Initialize.cpp b/src/compiler/translator/Initialize.cpp
index a50c017..b45e47b 100644
--- a/src/compiler/translator/Initialize.cpp
+++ b/src/compiler/translator/Initialize.cpp
@@ -474,17 +474,22 @@
//
TFieldList *fields = NewPoolTFieldList();
TSourceLoc zeroSourceLoc = {0, 0, 0, 0};
- TField *near = new TField(new TType(EbtFloat, EbpHigh, EvqGlobal, 1), NewPoolTString("near"), zeroSourceLoc);
- TField *far = new TField(new TType(EbtFloat, EbpHigh, EvqGlobal, 1), NewPoolTString("far"), zeroSourceLoc);
- TField *diff = new TField(new TType(EbtFloat, EbpHigh, EvqGlobal, 1), NewPoolTString("diff"), zeroSourceLoc);
+ auto highpFloat1 = new TType(EbtFloat, EbpHigh, EvqGlobal, 1);
+ TField *near = new TField(highpFloat1, NewPoolTString("near"), zeroSourceLoc);
+ TField *far = new TField(highpFloat1, NewPoolTString("far"), zeroSourceLoc);
+ TField *diff = new TField(highpFloat1, NewPoolTString("diff"), zeroSourceLoc);
fields->push_back(near);
fields->push_back(far);
fields->push_back(diff);
TStructure *depthRangeStruct = new TStructure(NewPoolTString("gl_DepthRangeParameters"), fields);
- TVariable *depthRangeParameters = new TVariable(&depthRangeStruct->name(), depthRangeStruct, true);
+ TVariable *depthRangeParameters =
+ new TVariable(&depthRangeStruct->name(), TType(depthRangeStruct), true);
symbolTable.insert(COMMON_BUILTINS, depthRangeParameters);
TVariable *depthRange = new TVariable(NewPoolTString("gl_DepthRange"), TType(depthRangeStruct));
depthRange->setQualifier(EvqUniform);
+ // Ensure we evaluate the mangled name for depth range, so we allocate to the current scope.
+ depthRangeParameters->getType().getMangledName();
+ depthRange->getType().getMangledName();
symbolTable.insert(COMMON_BUILTINS, depthRange);
//