[webkit-changes] [WebKit/WebKit] d8d29d: [WGSL] UAF in the StringTypeAdapter for Type

[Tadeu Zagallo]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: d8d29d4618457c3fd19c35309136a14d0582e1d3
      https://github.com/WebKit/WebKit/commit/d8d29d4618457c3fd19c35309136a14d0582e1d3
  Author: Tadeu Zagallo <tzagallo at apple.com>
  Date:   2023-08-03 (Thu, 03 Aug 2023)

  Changed paths:
    M Source/WebGPU/WGSL/Types.h

  Log Message:
  -----------
  [WGSL] UAF in the StringTypeAdapter for Type
https://bugs.webkit.org/show_bug.cgi?id=259694
rdar://113214077

Reviewed by Dan Glastonbury.

The adapter passed the string representing the type as an rvalue to the base
StringTypeAdapter<String> implementation, which didn't retain the string.

No new test because it reproduces on the existing tests when ASAN is enabled.

* Source/WebGPU/WGSL/Types.h:

Canonical link: https://commits.webkit.org/266547@main