Skip to content

WGSL scoping bug hides a duplicate @binding, undersizing the argument buffer and forging a shader device pointer - #78752

Merged
webkit-commit-queue merged 1 commit into
mainfrom
integration/ci/7e32e6e1ffe3_7e32e6e1ffe3_main
Oct 29, 2026
Merged

webkit-commit-queue merged 1 commit into
mainfrom
integration/ci/7e32e6e1ffe3_7e32e6e1ffe3_main

Conversation

@webkit-opensource-integration

@webkit-opensource-integration webkit-opensource-integration commented Oct 29, 2026 •

Copy link
Copy Markdown

9589788

WGSL scoping bug hides a duplicate @binding, undersizing the argument buffer and forging a shader device pointer
https://bugs.webkit.org/show_bug.cgi?id=323904
rdar://186926179

Reviewed by Gerald Squelart.

Visit the declaration before introducing its name in both visitors, and turn the
duplicate-binding ASSERT in determineUsedGlobals into a hard error so a future
divergence between the validator and the rewriter cannot produce a shader whose
argument buffer disagrees with its layout in a release build.

Tests: sar3/fast/webgpu/regression/repro_186926179.html
       sar3/fast/webgpu/regression/shader-module-declaration-scope.html

* LayoutTests/sar3/fast/webgpu/regression/repro_186926179-expected.txt: Added.
* LayoutTests/sar3/fast/webgpu/regression/repro_186926179.html: Added.
* LayoutTests/sar3/fast/webgpu/regression/shader-module-declaration-scope-expected.txt: Added.
* LayoutTests/sar3/fast/webgpu/regression/shader-module-declaration-scope.html: Added.
* Source/WebGPU/WGSL/GlobalSorting.cpp:
(WGSL::GraphBuilder::visit):
* Source/WebGPU/WGSL/GlobalVariableRewriter.cpp:
(WGSL::RewriteGlobalVariables::determineUsedGlobals):
* Source/WebGPU/WGSL/IOValidator.cpp:
(WGSL::IOValidator::visit):
* Tools/TestWebKitAPI/Tests/WGSL/TypeCheckingTests.mm:
(TestWebKitAPI::expectStaticCheckErrorContaining):
(TestWebKitAPI::TEST):

Originally-landed-as: 316606.692@safari-7625-branch (7e32e6e1ffe3). rdar://191050941
Canonical link: https://commits.webkit.org/325176@main

85d2e1e

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-cmake-debug ❌ 🧪 wpe-wk2 ❌ 🧪 win-tests
✅ 🧪 webkitperl ❌ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe
loading-orange 🧪 ios-wk2-wpt ✅ 🧪 api-mac-cmake-debug
✅ 🧪 api-ios ✅ 🧪 mac-wk2 ✅ 🛠 gtk3-gcc
✅ 🛠 ios-safer-cpp ✅ 🧪 mac-cmake-debug-wk2 ✅ 🛠 gtk
✅ 🛠 vision ✅ 🧪 mac-wk2-stress ❌ 🧪 gtk-wk2
✅ 🛠 🧪 merge ✅ 🛠 vision-sim ✅ 🧪 mac-intel-wk2 ✅ 🧪 api-gtk
❌ 🧪 vision-wk2 ✅ 🛠 mac-safer-cpp ✅ 🛠 playstation
✅ 🛠 tv ✅ 🧪 mac-site-isolation
✅ 🛠 tv-sim
✅ 🛠 watch
✅ 🛠 watch-sim

@webkit-opensource-integration webkit-opensource-integration added the safe-merge-queue Applied to automatically send a pull-request to merge-queue after passing EWS checks label Oct 29, 2026
@webkit-opensource-integration

Copy link
Copy Markdown
Author

Integration performed the following cherry-picks: 7e32e6e for rdar://191050941.

@djg
djg force-pushed the integration/ci/7e32e6e1ffe3_7e32e6e1ffe3_main branch from 2dc081b to 85d2e1e Compare October 29, 2026 03:19
@webkit-ews-buildbot webkit-ews-buildbot added the merging-blocked Applied to prevent a change from being merged label Oct 29, 2026
@mwyrzykowski mwyrzykowski added merge-queue Applied to send a pull request to merge-queue and removed merging-blocked Applied to prevent a change from being merged safe-merge-queue Applied to automatically send a pull-request to merge-queue after passing EWS checks labels Oct 29, 2026
… buffer and forging a shader device pointer

https://bugs.webkit.org/show_bug.cgi?id=323904
rdar://186926179

Reviewed by Gerald Squelart.

Visit the declaration before introducing its name in both visitors, and turn the
duplicate-binding ASSERT in determineUsedGlobals into a hard error so a future
divergence between the validator and the rewriter cannot produce a shader whose
argument buffer disagrees with its layout in a release build.

Tests: sar3/fast/webgpu/regression/repro_186926179.html
       sar3/fast/webgpu/regression/shader-module-declaration-scope.html

* LayoutTests/sar3/fast/webgpu/regression/repro_186926179-expected.txt: Added.
* LayoutTests/sar3/fast/webgpu/regression/repro_186926179.html: Added.
* LayoutTests/sar3/fast/webgpu/regression/shader-module-declaration-scope-expected.txt: Added.
* LayoutTests/sar3/fast/webgpu/regression/shader-module-declaration-scope.html: Added.
* Source/WebGPU/WGSL/GlobalSorting.cpp:
(WGSL::GraphBuilder::visit):
* Source/WebGPU/WGSL/GlobalVariableRewriter.cpp:
(WGSL::RewriteGlobalVariables::determineUsedGlobals):
* Source/WebGPU/WGSL/IOValidator.cpp:
(WGSL::IOValidator::visit):
* Tools/TestWebKitAPI/Tests/WGSL/TypeCheckingTests.mm:
(TestWebKitAPI::expectStaticCheckErrorContaining):
(TestWebKitAPI::TEST):

Originally-landed-as: 316606.692@safari-7625-branch (7e32e6e). rdar://191050941
Canonical link: https://commits.webkit.org/325176@main
@webkit-commit-queue webkit-commit-queue changed the title Cherry-pick(s) 7e32e6e1ffe3. rdar://191050941 WGSL scoping bug hides a duplicate @binding, undersizing the argument buffer and forging a shader device pointer Oct 29, 2026
@webkit-commit-queue
webkit-commit-queue force-pushed the integration/ci/7e32e6e1ffe3_7e32e6e1ffe3_main branch from 85d2e1e to 9589788 Compare October 29, 2026 21:37
@webkit-commit-queue

Copy link
Copy Markdown
Collaborator

Committed 325176@main (9589788): https://commits.webkit.org/325176@main

Reviewed commits have been landed. Closing PR #78752 and removing active labels.

@webkit-commit-queue
webkit-commit-queue merged commit 9589788 into WebKit:main Oct 29, 2026
@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label Oct 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants