From 03c1c9015ca0e22259104d9099812d332d6e009d Mon Sep 17 00:00:00 2001
From: Le Hoang Quyen <lehoangquyen@chromium.org>
Date: Fri, 17 Jul 2026 09:28:04 -0700
Subject: [PATCH] [webgl] Fix transform feedback program counter underflow

In WebGL2RenderingContextBase::endTransformFeedback, when transform
feedback ends, Blink previously decremented the active transform
feedback count of current_program_. However, per the WebGL 2.0
specification, useProgram can change current_program_ while transform
feedback is paused.

If current_program_ was swapped while transform feedback was paused,
endTransformFeedback incorrectly decremented current_program_ instead
of the program associated with the transform feedback object. Because
active_transform_feedback_count_ is unsigned and initialized to 0,
decrementing a program that was never started caused an underflow to
UINT_MAX (4294967295), which could be leveraged to bypass linkProgram
safety checks while a program is active in transform feedback.

This patch updates endTransformFeedback to decrement the counter on
transform_feedback_binding_->GetProgram(), and adds a CHECK_GT in
WebGLProgram::DecreaseActiveTransformFeedbackCount to guard against
underflows.

Bug: 513760788
Change-Id: I8881c16783399255d796f3f4a35ac83fcefd2679
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8107215
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Commit-Queue: Kenneth Russell <kbr@chromium.org>
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Auto-Submit: Quyen Le <lehoangquyen@google.com>
Cr-Commit-Position: refs/heads/main@{#1663963}
---

diff --git a/third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.cc b/third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.cc
index 40ea7b6..1e2b512 100644
--- a/third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.cc
+++ b/third_party/blink/renderer/modules/webgl/webgl2_rendering_context_base.cc
@@ -4214,8 +4214,10 @@
 
   transform_feedback_binding_->SetPaused(false);
   transform_feedback_binding_->SetActive(false);
-  if (current_program_)
-    current_program_->DecreaseActiveTransformFeedbackCount();
+  if (transform_feedback_binding_->GetProgram()) {
+    transform_feedback_binding_->GetProgram()
+        ->DecreaseActiveTransformFeedbackCount();
+  }
 }
 
 void WebGL2RenderingContextBase::transformFeedbackVaryings(
diff --git a/third_party/blink/renderer/modules/webgl/webgl_program.cc b/third_party/blink/renderer/modules/webgl/webgl_program.cc
index 33698c3..f5d8c36e 100644
--- a/third_party/blink/renderer/modules/webgl/webgl_program.cc
+++ b/third_party/blink/renderer/modules/webgl/webgl_program.cc
@@ -25,6 +25,7 @@
 
 #include "third_party/blink/renderer/modules/webgl/webgl_program.h"
 
+#include "base/check_op.h"
 #include "gpu/command_buffer/client/gles2_interface.h"
 #include "third_party/blink/renderer/modules/webgl/webgl_context_object_support.h"
 #include "third_party/blink/renderer/modules/webgl/webgl_shader.h"
@@ -86,6 +87,7 @@
 }
 
 void WebGLProgram::DecreaseActiveTransformFeedbackCount() {
+  CHECK_GT(active_transform_feedback_count_, 0u);
   --active_transform_feedback_count_;
 }