Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 543f99d9d38bc37514d8cb3a4e03f66e41e5089d
https://github.com/WebKit/WebKit/commit/543f99d9d38bc37514d8cb3a4e03f66e41e5089d
Author: Tadeu Zagallo <[email protected]>
Date: 2026-06-30 (Tue, 30 Jun 2026)
Changed paths:
A LayoutTests/fast/webgpu/nocrash/fuzz-176882934-expected.txt
A LayoutTests/fast/webgpu/nocrash/fuzz-176882934.html
M Source/WebGPU/WebGPU/RenderPassEncoder.mm
Log Message:
-----------
[WebGPU] signed-negation overflow on baseVertex==INT32_MIN in
RenderPassEncoder::clampIndexBufferToValidValues
https://bugs.webkit.org/show_bug.cgi?id=315196
rdar://176882934
Reviewed by Mike Wyrzykowski.
RenderPassEncoder::clampIndexBufferToValidValues guards baseVertex magnitude
with
-baseVertex > static_cast<int64_t>(minVertexCount), but the unary negation runs
in 32-bit signed arithmetic before the comparison widens, so baseVertex ==
INT32_MIN
wraps to itself and passes the guard. The fix widens baseVertex to int64_t
before
negation and sign extension preserves all valid negative baseVertex values, so
the
guard's behaviour is unchanged for every input except INT32_MIN, whose
magnitude (2^31)
is now representable and correctly rejected.
Test: fast/webgpu/nocrash/fuzz-176882934.html
* LayoutTests/fast/webgpu/nocrash/fuzz-176882934-expected.txt: Added.
* LayoutTests/fast/webgpu/nocrash/fuzz-176882934.html: Added.
* Source/WebGPU/WebGPU/RenderPassEncoder.mm:
(WebGPU::RenderPassEncoder::clampIndexBufferToValidValues):
Originally-landed-as: 305413.952@safari-7624-branch (04553772a362).
rdar://180436823
Canonical link: https://commits.webkit.org/316131@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
