Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e02581f3b0d9122b97c7aef7454c3327a1dc553b
https://github.com/WebKit/WebKit/commit/e02581f3b0d9122b97c7aef7454c3327a1dc553b
Author: Chris Dumez <[email protected]>
Date: 2026-07-30 (Thu, 30 Jul 2026)
Changed paths:
M Source/WebGPU/WGSL/Token.h
Log Message:
-----------
WGSL Token copy-assignment leaks the Identifier String's StringImpl on every
token advance
https://bugs.webkit.org/show_bug.cgi?id=320614
Reviewed by Mike Wyrzykowski.
Token stores its identifier in a union member (String ident), so the String's
lifetime must be managed manually via the type discriminant. The move-assignment
operator and the destructor both destruct the existing String before overwriting
(if (type == TokenType::Identifier) ident.~String();), but the copy-assignment
operator omitted this: it overwrote type and then placement-constructed a fresh
String over the still-live one, leaking the previously held StringImpl
reference.
Parser::consume() copy-assigns into m_current on every token advance
(m_current = m_tokens[++m_currentTokenIndex]), and identifiers are the most
common
token in WGSL, so compiling attacker-supplied shader source leaked one
StringImpl
per identifier consumed for the lifetime of the process -- a monotonic
memory-growth vector reachable from untrusted WGSL in the GPU process.
Destruct the existing Identifier String at the top of the copy-assignment
operator, mirroring the move-assignment operator and the destructor.
* Source/WebGPU/WGSL/Token.h:
(WGSL::Token::operator=):
Canonical link: https://commits.webkit.org/318274@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
