Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 7605701f47be57dda96ead432207538a743d2302
https://github.com/WebKit/WebKit/commit/7605701f47be57dda96ead432207538a743d2302
Author: Mike Wyrzykowski <[email protected]>
Date: 2025-01-23 (Thu, 23 Jan 2025)
Changed paths:
A LayoutTests/fast/webgpu/nocrash/fuzz-286407-expected.txt
A LayoutTests/fast/webgpu/nocrash/fuzz-286407.html
M Source/WebCore/Modules/WebGPU/GPUBindGroupEntry.h
Log Message:
-----------
[WebGPU] GPUDevice bindGroup cache does not handle buffers with different
offsets
https://bugs.webkit.org/show_bug.cgi?id=286407
rdar://143114463
Reviewed by Cameron McCormack.
The GPUDevice GPUBindGroup cache incorrectly reused bind groups with
the same buffer but different offsets and sizes. Reuse should only be
applied to identical offsets and sizes otherwise and OOB read may occur.
* LayoutTests/fast/webgpu/nocrash/fuzz-286407-expected.txt: Added.
* LayoutTests/fast/webgpu/nocrash/fuzz-286407.html: Added.
Add regression test.
* Source/WebCore/Modules/WebGPU/GPUBindGroupEntry.h:
(WebCore::GPUBindGroupEntry::equalSizes):
(WebCore::GPUBindGroupEntry::equal):
Unlike GPUTexture, GPUSampler, and GPUExternalTextures, GPUBuffers
may specificy an offset into the buffer.
Canonical link: https://commits.webkit.org/289317@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
