WebCore and WebKit move to the WebGPU C++ API

Component: WebGPU | 668135a

Source/WebCore/Modules/WebGPU/GPU.cpp

-GPU::GPU(Ref<WebGPU::GPU>&& backing)
+GPU::GPU(Ref<WebGPUIntegration>&& backing)
...
-    m_backing->requestAdapter(convertToBacking(options), [promise = WTF::move(promise)](RefPtr<WebGPU::Adapter>&& adapter) mutable {
+    m_backing->requestAdapter(convertToBacking(options), [promise = WTF::move(promise), gpu = m_backing](RefPtr<WebGPU::Adapter>&& adapter) mutable {
...
-        promise.resolve(GPUAdapter::create(adapter.releaseNonNull()).ptr());
+        promise.resolve(GPUAdapter::create(adapter.releaseNonNull(), WTF::move(gpu)).ptr());

WebGPU in WebKit is layered. The JS-facing GPU* classes in WebCore convert descriptors into backing types. In the GPU-process model those go through RemoteXProxy objects in the Web Process, are serialized over IPC, and are replayed by RemoteX objects in the GPU Process on top of the Metal implementation. The GPU Process is the privileged side. Its IPC converters, descriptor decoding and handle-to-object resolution keep a compromised Web Process from corrupting it.

This commit changes WebCore and WebKit to talk to WebGPU through the C++ API (WebGPU::X, from WebGPUCpp.h) instead of the C API, the InternalAPI abstract classes and the *Impl wrappers. WebCore::GPUX now holds Ref<WebGPU::X>, RemoteXProxy implements WebGPU::X, and RemoteX wraps WebGPU::Metal::X. InternalAPI/, WebGPUPtr.h, the ConvertToBackingContext helpers and the isRemoteXProxy()/isXImpl() checks are deleted.

Significance

The Web Process to GPU Process WebGPU boundary is rewritten, and unknown buffer-usage and color-write-mask bits now become Invalid and fail validation instead of being silently dropped.

Audit directions

Check the retargeted IPC converters and WebGPU.serialization.in. Every handle, enum and flag field should still be validated on the GPU Process side. The wire format is unchanged, so focus on fields whose decoding now depends on C++ API types.
Confirm that every consumer checks the new BufferUsage/ColorWrite Invalid values before use, and that no descriptor conversion path skips the check and passes an out-of-range value into Metal code.
Descriptors now borrow arrays as spans. Check that the backing storage outlives each call, especially on async pipeline-creation paths that convert descriptors later.
With the isRemoteXProxy()/isXImpl() downcasts removed, look for new unchecked static casts or places where a proxy can be confused with a Metal object.
Check label lifetime now that labels are owned by WebCore::GPUX, check for stale render buffers or size mismatches across configure, unconfigure() and resize, and check retain/release balance across the mixed ARC/non-ARC boundary where raw CF references are passed.