subagent transcript

session 18e25685 · workflow wf_23df5b1c
← 18e25685 · archive
delegated task
You are an adversarial verifier for a FreeCAD-wasm code review. A reviewer claims: SEVERITY: medium CATEGORY: use-before-init FILE: /home/magik6k/lcad
▸ Magik
You are an adversarial verifier for a FreeCAD-wasm code review. A reviewer claims: SEVERITY: medium CATEGORY: use-before-init FILE: /home/magik6k/lcad-wasm/freecad-port/FreeCAD/src/3rdParty/coin/src/glue/gl_egl.cpp SUMMARY: eglglue_context_create_offscreen builds surface_attrib from ctx->width/ctx->height before ctx is allocated/initialized. DETAIL/EVIDENCE: gl_egl.cpp:293-299 initializes 'EGLAttrib surface_attrib[]' using (EGLint) ctx->width and ctx->height, but ctx is only assigned at line 301 (ctx = eglglue_contextdata_init(...)). At the point surface_attrib is constructed, ctx is an uninitialized pointer, so this reads through a garbage pointer (undefined behavior / likely crash) if this path is ever taken. Also EGL_RENDERABLE_TYPE is EGL_OPENGL_BIT (line 282), inconsistent with the EGL_OPENGL_ES_API bound at line 314. This offscreen path is currently inert on wasm because the EGL platform entry points are stubbed to return 0 (WasmGLFixedFunc.cpp:527-533), so it does not affect on-screen rendering today, but it is a latent defect if offscreen/EGL is ever enabled. RECOMMENDATION: Move the ctx allocation before surface_attrib is populated (or populate width/height after init), and use EGL_OPENGL_ES2_BIT/ES3_BIT for RENDERABLE_TYPE to match the bound ES API. Independently verify by reading the actual file(s) and running git/grep as needed (repo at /home/magik6k/lcad-wasm/freecad-port/FreeCAD, toolchain at /opt/toolchains, deploy at /home/magik6k/lcad-wasm/freecad-port/deploy-gui). Default to REFUTED if you cannot confirm the evidence. Adjust severity to what the evidence actually supports.
Fable
thinking
I should check the actual file to confirm what's being claimed.
Fable
⚙ Read {"file_path": "/home/magik6k/lcad-wasm/freecad-port/FreeCAD/src/3rdParty/coin/src/glue/gl_egl.cpp", "offset": 265, "limit": 80}
tool result
265	{
266	  if (ctx == NULL) { return; }
267	  if (eglglue_get_display() != EGL_NO_DISPLAY && ctx->context != EGL_NO_CONTEXT) eglDestroyContext(eglglue_get_display(), ctx->context);
268	  if (eglglue_get_display() != EGL_NO_DISPLAY && ctx->surface != EGL_NO_SURFACE) eglDestroySurface(eglglue_get_display(), ctx->surface);
269	  if (eglglue_get_display() != EGL_NO_DISPLAY && ctx->storedcontext != EGL_NO_CONTEXT) eglDestroyContext(eglglue_get_display(), ctx->storedcontext);
270	  if (eglglue_get_di  …[truncated]
Fable
thinking
I'm seeing a use-before-initialization bug where `ctx->width` and `ctx->height` are accessed at lines 293-299, but `ctx` isn't assigned until line 301, meaning it's just a garbage pointer at that point. Now I need to verify the FC_WASM_EGL_API definition and check what's actually happening at line 314 with the EGL_OPENGL_ES_API binding.
Fable
⚙ Bash {"command": "grep -rn \"FC_WASM_EGL_API\\|EGL_OPENGL_ES_API\\|EGL_OPENGL_API\" /home/magik6k/lcad-wasm/freecad-port/FreeCAD/src/3rdParty/coin/ 2>/dev/null | head -30", "description": "Find FC_WASM_EGL_API definition"}
tool result
/home/magik6k/lcad-wasm/freecad-port/FreeCAD/src/3rdParty/coin/src/glue/gl_egl.cpp:102:#define FC_WASM_EGL_API EGL_OPENGL_ES_API
/home/magik6k/lcad-wasm/freecad-port/FreeCAD/src/3rdParty/coin/src/glue/gl_egl.cpp:104:#define FC_WASM_EGL_API EGL_OPENGL_API
/home/magik6k/lcad-wasm/freecad-port/FreeCAD/src/3rdParty/coin/src/glue/gl_egl.cpp:138:    CASE_STR( EGL_OPENGL_API          )
/home/magik6k/lcad-wasm/freecad-port/FreeCAD/src/3rdParty/coin/src/glue/gl_egl.cpp:139:    CASE_STR( EGL_OPENGL_ES_API  …[truncated]
Fable
⚙ Read {"file_path": "/home/magik6k/lcad-wasm/freecad-port/FreeCAD/src/3rdParty/coin/src/glue/gl_egl.cpp", "offset": 98, "limit": 12}
tool result
98	#include <EGL/eglext.h>
99	
100	/* WebAssembly/WebGL is an OpenGL ES context; bind the ES API, not desktop GL. */
101	#ifdef __EMSCRIPTEN__
102	#define FC_WASM_EGL_API EGL_OPENGL_ES_API
103	#else
104	#define FC_WASM_EGL_API EGL_OPENGL_API
105	#endif
106	
107	
108	EGLDisplay eglglue_display = EGL_NO_DISPLAY;
109	struct eglglue_contextdata;
Fable
thinking
I'm identifying two critical bugs in the code. First, there's a use-before-initialization issue where `ctx->width` and `ctx->height` are accessed at lines 296-297 before `ctx` is actually initialized by `eglglue_contextdata_init()` at line 301, leaving the pointer in an undefined state. Second, there's an inconsistency with `RENDERABLE_TYPE` where line 282 uses `EGL_OPENGL_BIT`, but under `__EMSCRIPTEN__` it appears to use something different.

Now I'm checking whether the WebAssembly stubs actually render the EGL entry points inert, which would affect how severe these bugs are in practice.
Fable
⚙ Bash {"command": "sed -n '515,540p' /home/magik6k/lcad-wasm/freecad-port/deploy-gui/*WasmGLFixedFunc.cpp 2>/dev/null; find /home/magik6k/lcad-wasm/freecad-port -name \"WasmGLFixedFunc.cpp\" 2>/dev/null", "description": "Check wasm EGL stub"}
tool result
/home/magik6k/lcad-wasm/freecad-port/FreeCAD/src/Gui/WasmGLFixedFunc.cpp
Fable
⚙ Bash {"command": "grep -n \"eglChooseConfig\\|eglGetDisplay\\|eglInitialize\\|return 0\\|EGLBoolean\\|EGLDisplay\" /home/magik6k/lcad-wasm/freecad-port/FreeCAD/src/Gui/WasmGLFixedFunc.cpp | sed -n '1,30p'", "description": "Check EGL stubs in Was…
tool result
336:  return 0;
492:GLuint glGenLists(GLsizei){ return 0; }
528:typedef void* EGLDisplay; typedef void* EGLSurface; typedef void* EGLConfig; typedef int EGLenum; typedef int EGLint; typedef unsigned int EGLBoolean;
529:EGLDisplay eglGetPlatformDisplay(EGLenum, void*, const EGLint*){ return (EGLDisplay)0; }
530:EGLSurface eglCreatePlatformWindowSurface(EGLDisplay, EGLConfig, void*, const EGLint*){ return (EGLSurface)0; }
531:EGLSurface eglCreatePlatformPixmapSurface(EGLDisplay, EGLConfig, void*,   …[truncated]
Fable
thinking
The stub claim checks out—some EGL entry points are indeed stubbed. The core issue is confirmed: the code reads from ctx->width and ctx->height through an uninitialized pointer before ctx is ever assigned, which is clear undefined behavior if that code path runs. The reviewer rates this as medium severity since it's currently dormant on WebAssembly due to the stubbed EGL implementation, though they flag it as a potential latent issue.

Even though the value gets read into surface_attrib without being meaningfully dereferenced afterward, reading from an uninitialized pointer is genuine undefined behavior regardless. The RENDERABLE_TYPE mismatch is also confirmed—EGL_OPENGL_BIT versus the ES A  …
Fable
Both parts of the claim are confirmed by the source. **Use-before-init (confirmed):** At gl_egl.cpp:293-299, `surface_attrib[]` reads `ctx->width` (line 296) and `ctx->height` (line 297), but `ctx` is only assigned at line 301 via `eglglue_contextdata_init(width, height)`. At lines 296-297 `ctx` is an uninitialized local pointer (declared line 277), so this dereferences a garbage pointer — undefined behavior. Note the correct source values `width`/`height` are already available as function parameters, so the `ctx->` dereference is doubly wrong. **API inconsistency (confirmed):** Line 282 sets `EGL_RENDERABLE_TYPE, EGL_OPENGL_BIT` (desktop GL), while under `__EMSCRIPTEN__` the bound API `FC_WASM_EGL_API` is `EGL_OPENGL_ES_API` (line 102), used at line 314. So the renderable type is inconsistent with the ES API bound on the wasm build. **Inertness (confirmed):** WasmGLFixedFunc.cpp:528-533 stubs EGL platform entry points to return 0, so the offscreen/EGL path is not functional on wasm today, making this a latent defect rather than an active crash. Severity medium is appropriate: a clear-cut use-before-init UB, but currently dormant on the wasm target.
Fable
⚙ StructuredOutput {"verdict": "CONFIRMED", "reason": "Verified in gl_egl.cpp: surface_attrib[] at lines 293-299 reads ctx->width (296) and ctx->height (297) while ctx (declared line 277) is still an uninitialized pointer; ctx is only assigned at line 301 via…
tool result
Structured output provided successfully