Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 43ed70e7c3525d0b7d751272d01155b749d7e01a
https://github.com/WebKit/WebKit/commit/43ed70e7c3525d0b7d751272d01155b749d7e01a
Author: Ruthvik Konda <[email protected]>
Date: 2026-08-30 (Sun, 30 Aug 2026)
Changed paths:
A
LayoutTests/fast/webgpu/nocrash/draw-indirect-unsubmitted-encoder-cache-desync-expected.txt
A
LayoutTests/fast/webgpu/nocrash/draw-indirect-unsubmitted-encoder-cache-desync.html
Log Message:
-----------
[WebGPU] Unsubmitted command encoder can poison drawIndirect clamp cache
leading to GPU OOB vertex fetch
https://bugs.webkit.org/show_bug.cgi?id=315627
rdar://176482416
Reviewed by Mike Wyrzykowski.
Merge resolution: the Source/WebGPU changes from this commit are dropped as
obsolete on main; only the regression test is integrated.
The fix added a `committed` flag to Buffer::m_indirectCache plus
takeSlowIndirectValidationPath(), so that a drawIndirect clamp recorded by a
command encoder that was finished but never submitted could not leave the cache
claiming m_indirectBuffer held clamped arguments the GPU had never received.
319317@main ("[WebGPU] drawIndirect/drawIndexedIndirect clamp into a single
per-Buffer scratch slot, racing every other indirect draw in the same render
pass") deleted the mechanism that depended on: m_indirectCache, the
skippedDrawIndirectValidation / skippedDrawIndirectIndexedValidation skip paths,
takeSlowIndirectValidationPath / takeSlowIndirectIndexValidationPath and the
per-Buffer m_indirectBuffer / m_indirectIndexedBuffer scratch slots are all
gone.
Every clamping indirect draw now allocates per-draw scratch via
newZeroedIndirectScratch and runs its clamp dispatch in the same command buffer
as the draw, so there is no cache to poison and no skip path to reach: the
encode-time clamp always reads the current arguments, and an unsubmitted
encoder's scratch is never read by anything. None of the symbols this commit
modified still exist in Source/WebGPU, so every hunk conflicted against deleted
code.
The layout test is kept as regression coverage for the reported sequence:
drawIndirect against one arguments buffer from a submitted encoder, then from an
encoder that is finished but never submitted, then from a third encoder bound to
a smaller vertex buffer.
*
LayoutTests/fast/webgpu/nocrash/draw-indirect-unsubmitted-encoder-cache-desync-expected.txt:
Added.
*
LayoutTests/fast/webgpu/nocrash/draw-indirect-unsubmitted-encoder-cache-desync.html:
Added.
Identifier: [email protected]
Canonical link: https://commits.webkit.org/320125@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
