)]}'
{
  "commit": "6ec9bf51b0952b13848c8c7c16c54780e74e2a42",
  "tree": "f3a975c84dc9a93ae4da440b13b9d938eeb9d1fb",
  "parents": [
    "e271ac9c6038365abbb79ede3cba994dccf0581a"
  ],
  "author": {
    "name": "Antonio Maiorano",
    "email": "amaiorano@google.com",
    "time": "Thu Mar 12 10:23:54 2026 -0700"
  },
  "committer": {
    "name": "Dawn LUCI CQ",
    "email": "dawn-scoped@luci-project-accounts.iam.gserviceaccount.com",
    "time": "Thu Mar 12 10:23:54 2026 -0700"
  },
  "message": "[native] Fix UAF in CopyTextureToTexture\n\nThis was happening with\nuse_blit_for_depth_texture_to_texture_copy_to_nonzero_subresource\nenabled, and doing a 0-depth (no-op) copy, then making sure that the src\nand dst texture refs go to 0 so they are deleted, and then submitting.\nThe bug was that the raw texture pointers were being added\nCommandEncoder::mTopLevelTextures but without the texture refs being\nalso stored in a command\n\nFixed by ensuring we only take the BlitDepthToDepth path if\ndepthOrArrayLayers \u003e 1.\n\nAdded a validation test that reproduced the UAF with ASAN before my fix,\nand no longer with my fix.\n\nBug: 489585038\nChange-Id: I390b09bbb69ed0ceffbec2017ec7556a05a023e3\nReviewed-on: https://dawn-review.googlesource.com/c/dawn/+/296675\nReviewed-by: Corentin Wallez \u003ccwallez@chromium.org\u003e\nCommit-Queue: Antonio Maiorano \u003camaiorano@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ad93ec3d17c796e59cc27156e4332bf639641ae2",
      "old_mode": 33188,
      "old_path": "src/dawn/native/BlitDepthToDepth.cpp",
      "new_id": "f66a9057a74ae0472edbf5f05f6a4a6c51c52997",
      "new_mode": 33188,
      "new_path": "src/dawn/native/BlitDepthToDepth.cpp"
    },
    {
      "type": "modify",
      "old_id": "9d9a60ff1359042d3434a651ee042af1af5a5179",
      "old_mode": 33188,
      "old_path": "src/dawn/native/CommandAllocator.h",
      "new_id": "1e4220ece012dce539336d4612d242f7071e34b4",
      "new_mode": 33188,
      "new_path": "src/dawn/native/CommandAllocator.h"
    },
    {
      "type": "modify",
      "old_id": "3efced1d0bb813efe2869d9280d9482186bc433c",
      "old_mode": 33188,
      "old_path": "src/dawn/native/CommandEncoder.cpp",
      "new_id": "5587d34dff0cdb9bc76cedd86119cebeca87c6b2",
      "new_mode": 33188,
      "new_path": "src/dawn/native/CommandEncoder.cpp"
    },
    {
      "type": "modify",
      "old_id": "7a2d7c758fa1b08eec80ee0cf055b99132b35baf",
      "old_mode": 33188,
      "old_path": "src/dawn/tests/unittests/validation/CopyCommandsValidationTests.cpp",
      "new_id": "a38f54c32552e2e2828aa9962b2b6bc7f5554bd4",
      "new_mode": 33188,
      "new_path": "src/dawn/tests/unittests/validation/CopyCommandsValidationTests.cpp"
    }
  ]
}