[10] WGSL GlobalVariableRewriter iterator-invalidation UAF

Severity: Medium | Component: WebGPU WGSL compiler — GlobalVariableRewriter | efa18a8

Rated Medium because the observable effect is a use-after-free on HashMap backing storage during WGSL compilation — reachable from web content via the WebGPU API — but exploitation requires controlling heap state at rehash time, which is non-trivial given the HashMap's own reallocation behavior.

HashMap modified while iterating in GlobalVariableRewriter. While propagating the list of length parameters from callee to callers, the code mutated the HashMap during iteration. The fix defers insertions into a separate vector.

Source/WebGPU/WGSL/GlobalVariableRewriter.cpp

Tools/TestWebKitAPI/Tests/WGSL/shaders/fuzz-166715941.wgsl

Patch Details

In RewriteGlobalVariables::visitCallee(), the fix defers mutations to the m_lengthParameters HashMap until after iteration completes. Previously, inside a loop iterating over it->value, the code called m_lengthParameters.add(caller, ...), which could insert new keys and trigger a rehash, invalidating the outer iterator.

HashMap iterator invalidation due to insertion during iteration in a compiler pass.

Background

WTF HashMap is WebKit's hash map implementation. Inserting a new key may trigger a rehash that reallocates the backing store to a larger buffer, freeing the old one and invalidating all iterators. The WGSL GlobalVariableRewriter is a compiler pass that transforms WGSL global variable accesses into explicit function parameters for Metal code generation. It walks the call graph bottom-up, propagating which globals (and their array lengths) each function needs, threading them through call sites as additional arguments. arrayLength() in WGSL is a built-in that returns the runtime size of a runtime-sized array in a storage buffer — the compiler must pass the buffer's byte length as an extra parameter through the call chain, tracked in m_lengthParameters.

Analysis

Before the fix, visitCallee() iterated over m_lengthParameters[callee.target] via an iterator it into the m_lengthParameters HashMap (as strongly implied by the fix pattern and data types). Inside this loop, for each caller's call site, the code called m_lengthParameters.add(caller, ...) to propagate length parameters upward through the call graph. Inserting a new key into a WTF HashMap can trigger a rehash, which reallocates the backing store and invalidates all existing iterators — including it, which is still being used in the outer loop. After rehash, the outer loop dereferences a dangling iterator pointing into the old (freed) backing store.

Audit directions