emscripten-core / emscripten-core/emscripten

Signed shift on memory access in library_webgl.js when using 4GB support

Open
#20,137 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
27.6k
Forks
3.6k
Avg merge
1d 1h
Merged PRs (30d)
105

Description

When using 4GB support, my understanding is that memory accesses are rewritten to use unsigned shifts. In library_webgl.js, [glUniform4fv](https://github.com/emscripten-core/emscripten/blob/0a6f54b1276481fab90e474f2c4fd35d00c5fa6b/src/library_webgl.js#L2663) is rewritten from:
```
value >>= 2;
for (var i = 0; i < 4 * count; i += 4) {
var dst = value + i;
view[i] = heap[dst];
view[i + 1] = heap[dst + 1];
view[i + 2] = heap[dst + 2];
view[i + 3] = heap[dst + 3];
}
```
to:
```
value >>= 2;
for (var i = 0; i < 4 * count; i += 4) {
var dst = value + i;
view[i] = heap[dst >>> 0];
view[i + 1] = heap[dst + 1 >>> 0];
view[i + 2] = heap[dst + 2 >>> 0];
view[i + 3] = heap[dst + 3 >>> 0];
}
```
The memory accesses inside the loop look correct but should `value >>= 2` be `value >>>= 2`? With `value >>= 2`, I get memory accesses that read out of bounds. Possibly the same issue [here](https://github.com/emscripten-core/emscripten/blob/0a6f54b1276481fab90e474f2c4fd35d00c5fa6b/src/library_webgl.js#L2813). Let me know if I'm misunderstanding the expected output.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.