[webkit-changes] [WebKit/WebKit] 990097: [WebGPU] insertBits is not bounds checked

[mwyrzykowski]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 990097ce54db2bc234da8e30317514839ecf66f3
      https://github.com/WebKit/WebKit/commit/990097ce54db2bc234da8e30317514839ecf66f3
  Author: Mike Wyrzykowski <mwyrzykowski at apple.com>
  Date:   2025-02-27 (Thu, 27 Feb 2025)

  Changed paths:
    A LayoutTests/fast/webgpu/nocrash/fuzz-288671-expected.txt
    A LayoutTests/fast/webgpu/nocrash/fuzz-288671.html
    M Source/WebGPU/WGSL/Metal/MetalFunctionWriter.cpp
    M Source/WebGPU/WGSL/TypeCheck.cpp
    M Source/WebGPU/WGSL/WGSLShaderModule.h

  Log Message:
  -----------
  [WebGPU] insertBits is not bounds checked
https://bugs.webkit.org/show_bug.cgi?id=288671
rdar://145583842

Reviewed by Tadeu Zagallo.

Implemented insertBits as described in https://www.w3.org/TR/WGSL/#insertBits-builtin:

  w is the bit width of T
  o = min(offset, w)
  c = min(count, w - o)
  The result is e if c is 0.
  Otherwise, bits o..o + c - 1 of the result are copied from bits 0..c - 1 of newbits. Other bits of the result are copied from e.

* LayoutTests/fast/webgpu/nocrash/fuzz-288671-expected.txt: Added.
* LayoutTests/fast/webgpu/nocrash/fuzz-288671.html: Added.
Add regression test.

* Source/WebGPU/WGSL/Metal/MetalFunctionWriter.cpp:
(WGSL::Metal::FunctionDefinitionWriter::emitNecessaryHelpers):
(WGSL::Metal::FunctionDefinitionWriter::visit):
* Source/WebGPU/WGSL/TypeCheck.cpp:
(WGSL::TypeChecker::visit):
* Source/WebGPU/WGSL/WGSLShaderModule.h:
(WGSL::ShaderModule::usesInsertBits const):
(WGSL::ShaderModule::setUsesInsertBits):

Canonical link: https://commits.webkit.org/291233@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications