Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 19c01c1ab93ebe875b1dde01db6eb3b87985a75f
https://github.com/WebKit/WebKit/commit/19c01c1ab93ebe875b1dde01db6eb3b87985a75f
Author: David Kilzer <[email protected]>
Date: 2026-08-05 (Wed, 05 Aug 2026)
Changed paths:
M Source/WebGPU/WGSL/Overload.h
Log Message:
-----------
[WGSL] Use std::forward() in allocateAbstractType() to avoid use-after-move
of lvalue arguments
<https://bugs.webkit.org/show_bug.cgi?id=321098>
<rdar://184137472>
Reviewed by Mike Wyrzykowski.
The `T&&` parameter of `allocateAbstractType()` is a forwarding
reference, so a non-const lvalue binds to it in preference to the
`const T&` overload, and the unconditional move then moves the lvalue.
The generated overloads in `TypeOverloads.h` pass the same
`TypeVariable` lvalue to `allocateAbstractType()` more than once per
candidate (e.g. `(T, T) => T`), so the Clang static analyzer reports a
use-after-move. This never crashed only because `TypeVariable` is
trivially copyable, so the move is really a copy; it would be a genuine
use-after-free if a non-trivial member were ever added.
Forward the argument instead so an lvalue is copied and only an rvalue
is moved. Because the generated candidates always pass an lvalue, no
move happens, so the fix stays correct regardless of whether
`TypeVariable` remains trivially copyable. A single forwarding overload
handles every value category, making the separate `const T&` overload
redundant.
No new tests since no change in behavior.
* Source/WebGPU/WGSL/Overload.h:
(WGSL::allocateAbstractType):
Canonical link: https://commits.webkit.org/318662@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
