Branch: refs/heads/main Home: https://github.com/WebKit/WebKit Commit: 543bc8506d61350573b54b6bdd0667e0322d2dfc https://github.com/WebKit/WebKit/commit/543bc8506d61350573b54b6bdd0667e0322d2dfc Author: Tadeu Zagallo <tzaga...@apple.com> Date: 2024-05-23 (Thu, 23 May 2024)
Changed paths: A LayoutTests/fast/webgpu/fuzz-128381161-expected.txt A LayoutTests/fast/webgpu/fuzz-128381161.html M Source/WebGPU/WGSL/AttributeValidator.cpp M Source/WebGPU/WGSL/Parser.cpp M Source/WebGPU/WGSL/Types.cpp A Source/WebGPU/WGSL/tests/invalid/struct-parse.wgsl Log Message: ----------- [WGSL] Type::size can overflow https://bugs.webkit.org/show_bug.cgi?id=274395 rdar://128381161 Reviewed by Mike Wyrzykowski. We use 32-bit values to represent the byte size of types, and that can overflow when computing the size of structs or arrays. That is not a problem in practice, as the size of buffers is limited by the API, so we just clamp the numbers to uint_max. * LayoutTests/fast/webgpu/fuzz-128381161-expected.txt: Added. * LayoutTests/fast/webgpu/fuzz-128381161.html: Added. * Source/WebGPU/WGSL/AttributeValidator.cpp: (WGSL::AttributeValidator::visit): * Source/WebGPU/WGSL/Parser.cpp: (WGSL::Parser<Lexer>::parseStructure): * Source/WebGPU/WGSL/Types.cpp: (WGSL::Type::size const): * Source/WebGPU/WGSL/tests/invalid/struct-parse.wgsl: Added. Canonical link: https://commits.webkit.org/279204@main To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications _______________________________________________ webkit-changes mailing list webkit-changes@lists.webkit.org https://lists.webkit.org/mailman/listinfo/webkit-changes