The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/59bf6885630e36515f4e11b5fe8a7317524e6133

commit 59bf6885630e36515f4e11b5fe8a7317524e6133
Author: James Darpinian <jdarpinian@chromium.org>
Date: Wed Mar 14 04:34:54 2018

Fix validation of transform feedback buffer sizes at draw time.

There were three problems:
1. We didn't multiply the number of vertices by the number of instances.
2. We didn't account for vertices written by previous draw calls.
3. We didn't round the vertex count down to the nearest number of whole
   primitives.

Fixes the WebGL 2 conformance test added here:
https://github.com/KhronosGroup/WebGL/pull/2604

Bug:  820639 
Cq-Include-Trybots: master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
Change-Id: I9566ad14aa6671eca127a1b7f68b73e6408acd10
Reviewed-on: https://chromium-review.googlesource.com/957743
Commit-Queue: James Darpinian <jdarpinian@chromium.org>
Reviewed-by: Zhenyao Mo <zmo@chromium.org>
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#543008}
[modify] https://crrev.com/59bf6885630e36515f4e11b5fe8a7317524e6133/gpu/command_buffer/service/gles2_cmd_decoder.cc
[modify] https://crrev.com/59bf6885630e36515f4e11b5fe8a7317524e6133/gpu/command_buffer/service/transform_feedback_manager.cc
[modify] https://crrev.com/59bf6885630e36515f4e11b5fe8a7317524e6133/gpu/command_buffer/service/transform_feedback_manager.h

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/394f316f9d75cf6ea059a3d3c1db7243e124a209

commit 394f316f9d75cf6ea059a3d3c1db7243e124a209
Author: James Darpinian <jdarpinian@chromium.org>
Date: Fri Mar 16 00:46:49 2018

Handle integer overflow in transform feedback calculations.

Bug:  820639 
Cq-Include-Trybots: luci.chromium.try:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
Change-Id: Iafd87125bbe83e59b0425fcfaf9b6c8f1c14988a
Reviewed-on: https://chromium-review.googlesource.com/963620
Commit-Queue: James Darpinian <jdarpinian@chromium.org>
Reviewed-by: Zhenyao Mo <zmo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#543579}
[modify] https://crrev.com/394f316f9d75cf6ea059a3d3c1db7243e124a209/gpu/command_buffer/service/gles2_cmd_decoder.cc
[modify] https://crrev.com/394f316f9d75cf6ea059a3d3c1db7243e124a209/gpu/command_buffer/service/transform_feedback_manager.cc
[modify] https://crrev.com/394f316f9d75cf6ea059a3d3c1db7243e124a209/gpu/command_buffer/service/transform_feedback_manager.h

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/30b604d8d17480bd519fb97ec817db1e4ca90f0e

commit 30b604d8d17480bd519fb97ec817db1e4ca90f0e
Author: James Darpinian <jdarpinian@chromium.org>
Date: Tue Apr 03 02:42:30 2018

Check that transform feedback will not overflow its buffers.

Also fix the check for uniform buffer size to use the actual buffer
size instead of the size of the bound range.

Bug:  820639 
Change-Id: Iaa2a617ee7ce5ce7cfabbf64bd1d6f8c82c46b65
Reviewed-on: https://chromium-review.googlesource.com/965627
Commit-Queue: James Darpinian <jdarpinian@chromium.org>
Reviewed-by: Jamie Madill <jmadill@chromium.org>

[modify] https://crrev.com/30b604d8d17480bd519fb97ec817db1e4ca90f0e/src/libANGLE/TransformFeedback.cpp
[modify] https://crrev.com/30b604d8d17480bd519fb97ec817db1e4ca90f0e/src/libANGLE/Context.cpp
[modify] https://crrev.com/30b604d8d17480bd519fb97ec817db1e4ca90f0e/src/libANGLE/ErrorStrings.h
[modify] https://crrev.com/30b604d8d17480bd519fb97ec817db1e4ca90f0e/src/libANGLE/Program.h
[modify] https://crrev.com/30b604d8d17480bd519fb97ec817db1e4ca90f0e/src/libANGLE/MemoryProgramCache.cpp
[modify] https://crrev.com/30b604d8d17480bd519fb97ec817db1e4ca90f0e/src/tests/gl_tests/TransformFeedbackTest.cpp
[modify] https://crrev.com/30b604d8d17480bd519fb97ec817db1e4ca90f0e/src/libANGLE/angletypes.cpp
[modify] https://crrev.com/30b604d8d17480bd519fb97ec817db1e4ca90f0e/src/libANGLE/angletypes.h
[modify] https://crrev.com/30b604d8d17480bd519fb97ec817db1e4ca90f0e/src/libANGLE/validationES.cpp
[modify] https://crrev.com/30b604d8d17480bd519fb97ec817db1e4ca90f0e/src/libANGLE/TransformFeedback.h
[modify] https://crrev.com/30b604d8d17480bd519fb97ec817db1e4ca90f0e/src/libANGLE/Program.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/af4a967240846959c8747d2a1bb78ff10560ce96

commit af4a967240846959c8747d2a1bb78ff10560ce96
Author: angle-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com <angle-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Date: Tue Apr 03 03:49:18 2018

Roll src/third_party/angle/ 5a7e61bbd..30b604d8d (1 commit)

https://chromium.googlesource.com/angle/angle.git/+log/5a7e61bbda82..30b604d8d174

$ git log 5a7e61bbd..30b604d8d --date=short --no-merges --format='%ad %ae %s'
2018-03-12 jdarpinian Check that transform feedback will not overflow its buffers.

Created with:
  roll-dep src/third_party/angle
BUG= chromium:820639 


The AutoRoll server is located here: https://angle-chromium-roll.skia.org

Documentation for the AutoRoller is here:
https://skia.googlesource.com/buildbot/+/master/autoroll/README.md

If the roll is causing failures, please contact the current sheriff, who should
be CC'd on the roll, and stop the roller if necessary.


CQ_INCLUDE_TRYBOTS=luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
TBR=fjhenigman@chromium.org

Change-Id: I5a67f73f69ce29fe55a8318a22b6bf5de941fe7e
Reviewed-on: https://chromium-review.googlesource.com/991599
Reviewed-by: angle-chromium-autoroll <angle-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Commit-Queue: angle-chromium-autoroll <angle-chromium-autoroll@skia-buildbots.google.com.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#547620}
[modify] https://crrev.com/af4a967240846959c8747d2a1bb78ff10560ce96/DEPS

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d400565ddce087a38f25df0cfd023a3f93cb7d38

commit d400565ddce087a38f25df0cfd023a3f93cb7d38
Author: James Darpinian <jdarpinian@chromium.org>
Date: Thu Apr 12 05:38:07 2018

Transform feedback fixes are in, remove test failure expectations.

Bug:  696345 , 818383 , 820639 
Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel
Change-Id: Iaacb3bbaf738e994ea6caaad7b83c5a8bbf8e964
Reviewed-on: https://chromium-review.googlesource.com/993393
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Commit-Queue: James Darpinian <jdarpinian@chromium.org>
Cr-Commit-Position: refs/heads/master@{#550025}
[modify] https://crrev.com/d400565ddce087a38f25df0cfd023a3f93cb7d38/content/test/gpu/gpu_tests/webgl2_conformance_expectations.py

Remaining test failures will be debugged in bug 832238.