[webkit-changes] [WebKit/WebKit] 01395c: [WebGPU] RenderPassEncoder should cache TextureVie...

[mwyrzykowski]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 01395cc14e30d42304b837694f98b67cdb157659
      https://github.com/WebKit/WebKit/commit/01395cc14e30d42304b837694f98b67cdb157659
  Author: Mike Wyrzykowski <mwyrzykowski at apple.com>
  Date:   2024-04-19 (Fri, 19 Apr 2024)

  Changed paths:
    M Source/WebGPU/WebGPU/RenderPassEncoder.h
    M Source/WebGPU/WebGPU/RenderPassEncoder.mm
    M Source/WebGPU/WebGPU/RenderPipeline.h
    M Source/WebGPU/WebGPU/RenderPipeline.mm

  Log Message:
  -----------
  [WebGPU] RenderPassEncoder should cache TextureView instances as WeakPtr
https://bugs.webkit.org/show_bug.cgi?id=272545
<radar://126229538>

Reviewed by Tadeu Zagallo.

The descriptor contains native C++ pointers but those are prone to
UAF if the Texture is destroyed during the render pass or the render
pass is left open.

Instead, use WeakPtr and treat the object as null if it's lifetime expired
during the render or compute pass.

* Source/WebGPU/WebGPU/RenderPassEncoder.h:
* Source/WebGPU/WebGPU/RenderPassEncoder.mm:
(WebGPU::m_maxDrawCount):
(WebGPU::RenderPassEncoder::colorDepthStencilTargetsMatch const):
* Source/WebGPU/WebGPU/RenderPipeline.h:
* Source/WebGPU/WebGPU/RenderPipeline.mm:
(WebGPU::RenderPipeline::colorDepthStencilTargetsMatch const):

Canonical link: https://commits.webkit.org/277742@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications