emscripten-core / emscripten-core/emscripten
Signed shift on memory access in library_webgl.js when using 4GB support
- Dominant language
- C++
- Stars
- 27.6k
- Forks
- 3.6k
- Avg merge
- 1d 1h
- Merged PRs (30d)
- 105
Description
When using 4GB support, my understanding is that memory accesses are rewritten to use unsigned shifts. In library_webgl.js, [glUniform4fv](https://github.com/emscripten-core/emscripten/blob/0a6f54b1276481fab90e474f2c4fd35d00c5fa6b/src/library_webgl.js#L2663) is rewritten from:
```
value >>= 2;
for (var i = 0; i < 4 * count; i += 4) {
var dst = value + i;
view[i] = heap[dst];
view[i + 1] = heap[dst + 1];
view[i + 2] = heap[dst + 2];
view[i + 3] = heap[dst + 3];
}
```
to:
```
value >>= 2;
for (var i = 0; i < 4 * count; i += 4) {
var dst = value + i;
view[i] = heap[dst >>> 0];
view[i + 1] = heap[dst + 1 >>> 0];
view[i + 2] = heap[dst + 2 >>> 0];
view[i + 3] = heap[dst + 3 >>> 0];
}
```
The memory accesses inside the loop look correct but should `value >>= 2` be `value >>>= 2`? With `value >>= 2`, I get memory accesses that read out of bounds. Possibly the same issue [here](https://github.com/emscripten-core/emscripten/blob/0a6f54b1276481fab90e474f2c4fd35d00c5fa6b/src/library_webgl.js#L2813). Let me know if I'm misunderstanding the expected output.
Contributor guide
Assessment
This issue has not been assessed yet.