diff --git a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc index adcb4b0d6b9dc..cb8356ef0a89b 100644 --- a/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc +++ b/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc @@ -1221,8 +1221,12 @@ error::Error GLES2DecoderPassthroughImpl::HandleVertexAttribIPointer( GLint size = static_cast(c.size); GLenum type = static_cast(c.type); GLsizei stride = static_cast(c.stride); - GLsizei offset = static_cast(c.offset); - const void* ptr = reinterpret_cast(offset); + // c.offset is a renderer-controlled uint32_t. Narrowing to GLsizei (int32) + // before reinterpret_cast<> sign-extends values >= 0x80000000 to a negative + // GLintptr on LP64, which ANGLE uses as a backward displacement into its + // shared BufferBlock pool. Zero-extend instead. + GLuint offset = static_cast(c.offset); + const void* ptr = reinterpret_cast(static_cast(offset)); return DoVertexAttribIPointer(index, size, type, stride, ptr); } @@ -1237,8 +1241,12 @@ error::Error GLES2DecoderPassthroughImpl::HandleVertexAttribPointer( GLenum type = static_cast(c.type); GLboolean normalized = static_cast(c.normalized); GLsizei stride = static_cast(c.stride); - GLsizei offset = static_cast(c.offset); - const void* ptr = reinterpret_cast(offset); + // c.offset is a renderer-controlled uint32_t. Narrowing to GLsizei (int32) + // before reinterpret_cast<> sign-extends values >= 0x80000000 to a negative + // GLintptr on LP64, which ANGLE uses as a backward displacement into its + // shared BufferBlock pool. Zero-extend instead. + GLuint offset = static_cast(c.offset); + const void* ptr = reinterpret_cast(static_cast(offset)); return DoVertexAttribPointer(index, size, type, normalized, stride, ptr); }