Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: ff78e4fceef7783f665b130f1c01766da3a2c137
https://github.com/WebKit/WebKit/commit/ff78e4fceef7783f665b130f1c01766da3a2c137
Author: Mike Wyrzykowski <[email protected]>
Date: 2026-08-29 (Sat, 29 Aug 2026)
Changed paths:
A LayoutTests/fast/webgpu/index-buffer-cache-invalidation-expected.txt
A LayoutTests/fast/webgpu/index-buffer-cache-invalidation.html
M Source/WebGPU/WebGPU/Buffer.h
M Source/WebGPU/WebGPU/Buffer.mm
Log Message:
-----------
Cache invalidation bypass via monotonic max-index tracking leads to GPU OOB
read
https://bugs.webkit.org/show_bug.cgi?id=313946
rdar://174681215
Reviewed by Dan Glastonbury.
Track highest validated indices and not simply the maximum indices
past to writeBuffer on an index buffer. Otherwise a writeBuffer(0xFF) call
will allow an OOB read for any future write calls.
* Source/WebGPU/WebGPU/Buffer.h:
* Source/WebGPU/WebGPU/Buffer.mm:
(WebGPU::Buffer::drawIndexedValidated):
(WebGPU::Buffer::needsIndexValidation):
(WebGPU::Buffer::indirectBufferInvalidated):
Test:
* LayoutTests/fast/webgpu/index-buffer-cache-invalidation-expected.txt: Added.
* LayoutTests/fast/webgpu/index-buffer-cache-invalidation.html: Added.
Originally-landed-as: [email protected] (f6253b9a6a94).
rdar://185368400
Canonical link: https://commits.webkit.org/320105@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
