Chrome · WebGPU
CVE-2026-2315
Logic Error in WebGPU
Overview
High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Files Changed
src/dawn/native/vulkan/PhysicalDeviceVk.cppwebgpu-cts/expectations.txt
Patch
From 4c7d0f5ecc872898bd236e423fbd2be5f8666992 Mon Sep 17 00:00:00 2001 From: Peter McNeeley <[email protected]> Date: Wed, 28 Jan 2026 06:05:12 -0800 Subject: [PATCH] [dawn] Disable extension workgroup zero init on pixel 10 Bug: 479242793 Change-Id: Ie53495eb7d2b9939abb3a17691e49a9f6369b9be Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/287195 Reviewed-by: dan sinclair <[email protected]> Reviewed-by: Loko Kung <[email protected]> Commit-Queue: Peter McNeeley <[email protected]> --- diff --git a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp index c9fa553..f925819 100644 --- a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp +++ b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp @@ -1089,10 +1089,11 @@ // extension is available. Override the decision if it is not applicable or // zeroInitializeWorkgroupMemoryFeatures.shaderZeroInitializeWorkgroupMemory == VK_FALSE. // Never use the extension on Mali devices due to a known bug (see crbug.com/tint/2101). + // Pixel 10 workgroup zero init does not always work as expected (see crbug.com/479242793). if (!GetDeviceInfo().HasExt(DeviceExt::ZeroInitializeWorkgroupMemory) || GetDeviceInfo().zeroInitializeWorkgroupMemoryFeatures.shaderZeroInitializeWorkgroupMemory == VK_FALSE || - IsAndroidARM()) { + IsAndroidARM() || IsPixel10()) { deviceToggles->ForceSet(Toggle::VulkanUseZeroInitializeWorkgroupMemoryExtension, false); } // By default try to initialize workgroup memory with OpConstantNull according to the Vulkan diff --git a/webgpu-cts/expectations.txt b/webgpu-cts/expectations.txt index 9ed6a1a..5419551 100644 --- a/webgpu-cts/expectations.txt +++ b/webgpu-cts/expectations.txt @@ -1716,30 +1716,6 @@ crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,statement,discard:three_quarters:useStorageBuffers=true [ Failure ] crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,statement,discard:uniform_read_loop:useStorageBuffers=true [ Failure ] crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,statement,phony:executes:case="loop" [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=18 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=19 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=21 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=22 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=23 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=24 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=25 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=26 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=28 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="function";workgroupSize=[1,1,1];batch__=29 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=15 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=16 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=17 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=19 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=20 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=21 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=22 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=23 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=24 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=25 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=26 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=27 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=28 [ Failure ] -crbug.com/0000 [ android-pixel-10 ] webgpu:shader,execution,zero_init:compute,zero_init:addressSpace="private";workgroupSize=[1,1,1];batch__=29 [ Failure ] crbug.com/0000 [ android-pixel-10 ] webgpu:shader,validation,expression,call,builtin,textureSampleBaseClampToEdge:* [ Failure ] crbug.com/0000 [ android-pixel-10 ] webgpu:shader,validation,expression,call,builtin,textureSampleBias:* [ Failure ] crbug.com/0000 [ android-pixel-10 ] webgpu:shader,validation,expression,call,builtin,textureSampleCompare:* [ Failure ]
Loading diff…
Original Bug Report
reported by [email protected]
Use dawn workgroup zero init fallback for pixel 10
The vulkan extension for workgroup zero init may not always work as intended.
Use the tint fallback for now.
View on issue tracker
References
On This Page