← All issues

WGSL Uniformity Analysis Compiler Pass

b7f96d9

In WGSL, "uniformity" means that a value or control-flow path is the same across all invocations in a subgroup or workgroup. Certain built-in functions — textureSample, workgroupBarrier, workgroupUniformLoad — require uniform arguments; if invoked non-uniformly (e.g., inside a branch guarded by a per-invocation value like @builtin(global_invocation_id)), GPU driver behavior is undefined and this is exploitable for information leaks or crashes on some hardware. Uniformity analysis is a mandatory shader-compilation-time static check per the WGSL specification (section 15.2.3).

This commit introduces a new UniformityAnalysis compiler pass in Source/WebGPU/WGSL/UniformityAnalysis.cpp. The pass builds a control flow graph, tracks "behavior sets" (which values and control flow transfers are uniform/non-uniform) per AST node via a dataflow propagation, and rejects shaders that call uniformity-requiring builtins from non-uniform contexts. It is wired into the existing staticCheck pipeline that runs after type-checking.

WGSL shader source
        │
        ▼
   Parser / AST → TypeChecker::analyze()
        │
        └──► [NEW] UniformityAnalysis   ← builds CFG, propagates behavior sets
                        │
                        ▼ (reject on violation)
             Metal code generation

Without uniformity validation, shaders violating uniformity constraints were being silently accepted. The conformance test suite (webgpu:shader,validation,uniformity,uniformity:*) was failing as a result. This pass closes that gap and makes WebKit's WGSL implementation spec-compliant on a safety-critical axis. For GPU security, the validator is the defense against undefined behavior at the driver level.

🔒

Pattern-based audit directions for variant discovery

Subscribe to read more