Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 4ed1e2966ece9c19e07e22ce81a735d83d21ef69
https://github.com/WebKit/WebKit/commit/4ed1e2966ece9c19e07e22ce81a735d83d21ef69
Author: Chris Dumez <[email protected]>
Date: 2026-07-30 (Thu, 30 Jul 2026)
Changed paths:
M Source/WebGPU/WGSL/Metal/MetalFunctionWriter.cpp
Log Message:
-----------
WGSL textureDimensions(t, level) codegen clamps mip level one past the last
valid LOD
https://bugs.webkit.org/show_bug.cgi?id=320615
Reviewed by Mike Wyrzykowski.
The vector-returning textureDimensions(t, level) overload emits Metal code that
clamps the caller-supplied mip level with min(t.get_num_mip_levels(),
uint(level)),
then calls get_width/get_height/get_depth(<that value>). get_num_mip_levels()
returns the mip level count, so the valid LOD range is [0, count - 1]. A shader
passing level == count clamps to count -- still one past the last valid LOD --
and
queries get_width(count), an out-of-range LOD access whose result is
Metal-implementation-defined.
The level argument is arbitrary shader-controlled input, and nothing else clamps
it: the bounds-check pass (BoundsCheck.cpp) only rewrites index-access
expressions and variables, never texture-builtin arguments, so this min() is the
sole bounds protection for the builtin -- and it is off by one. The same file's
index-access bounds check clamps with min(index, size - 1) (BoundsCheck.cpp),
i.e.
subtracts one from the count to get the last valid index; this fix applies the
same idiom to the mip level.
Clamp against get_num_mip_levels() - 1 instead. A texture always has at least
one
mip level, so the subtraction cannot underflow, and valid levels (already
<= count - 1) are unaffected.
* Source/WebGPU/WGSL/Metal/MetalFunctionWriter.cpp:
(WGSL::Metal::emitTextureDimensions):
Canonical link: https://commits.webkit.org/318273@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
