Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: d4a150e51b113197eacb4580d89142a4a0f8f318
https://github.com/WebKit/WebKit/commit/d4a150e51b113197eacb4580d89142a4a0f8f318
Author: Mike Wyrzykowski <[email protected]>
Date: 2026-08-30 (Sun, 30 Aug 2026)
Changed paths:
M Source/WebGPU/WebGPU/Queue.mm
M Source/WebGPU/WebGPU/Queue.swift
M Source/WebGPU/WebGPU/RenderPipeline.mm
M Source/WebGPU/WebGPU/WebGPUExt.h
M Source/WebKit/GPUProcess/graphics/WebGPU/RemoteQueue.cpp
Log Message:
-----------
Race window lead to reads from deallocated memory
https://bugs.webkit.org/show_bug.cgi?id=317317
rdar://179876979
Reviewed by Dan Glastonbury.
Correct race window where deallocated Vector or SharedMemory
can be written to by swapping in user memory.
No new tests as race window is incredibly small: memory
must be freed prior to being wired to the GPU.
* Source/WebGPU/WebGPU/Queue.mm:
(WebGPU::Queue::writeTexture):
* Source/WebGPU/WebGPU/Queue.swift:
* Source/WebGPU/WebGPU/RenderPipeline.mm:
(WebGPU::Device::addPipelineLayouts):
* Source/WebGPU/WebGPU/WebGPUExt.h:
* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteQueue.cpp:
(WebKit::RemoteQueue::writeBuffer):
(WebKit::RemoteQueue::writeTexture):
Originally-landed-as: [email protected] (4a92fe2ccba1).
rdar://185367080
Canonical link: https://commits.webkit.org/320118@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
