Skip to content

fix(webgpu): reading a mapped buffer throws on a detached ArrayBuffer - #4

Merged
fslabs-bot[bot] merged 1 commit into
patch-27.0.1from
ar/webgpu-buffer-map-state-shared
Aug 5, 2026
Merged

fix(webgpu): reading a mapped buffer throws on a detached ArrayBuffer#4
fslabs-bot[bot] merged 1 commit into
patch-27.0.1from
ar/webgpu-buffer-map-state-shared

Conversation

@aevyrie

@aevyrie aevyrie commented Aug 5, 2026

Copy link
Copy Markdown

Connections

None. Found while debugging the SpatialEngine WASM viewer after fsl_libs moved from wgpu 26 to 27.

Description

Reading a mapped buffer on the WebGPU backend can throw "Cannot perform Construct on a detached ArrayBuffer".

WebBuffer caches the array buffer from getMappedRange so several Rust-side reads share one JS call. Since 27, DispatchBuffer holds WebBuffer by value rather than behind an Arc, so cloning a buffer copies that cache instead of sharing it. Unmapping through one clone clears only its own copy while Javascript detaches the array buffer for every clone, and the next read builds a view over the detached buffer. The range recorded by map_async diverges the same way.

An Rc restores shared ownership, matching upstream from 29.0.1 onward. The patch-27.0.4 branch is still affected and wants the same change.

Testing

Reproduced in the SpatialEngine WASM viewer, where volumesight's streaming readback clones a buffer into its recycle pool before unmapping it. The error appears on every page load with 27.0.1, and bisecting showed it absent on 26.0.1. Check, clippy and fmt for wgpu on wasm32-unknown-unknown all pass.

Not run against wgpu's own test suite and not exercised on a native backend, though only the WebGPU path changes. A reviewer with a WebGPU mapping test should confirm nothing relies on clones having independent caches.

Squash or Rebase?

Single commit, ready to rebase.

Cloning a buffer duplicated its cached mapped ArrayBuffer rather than sharing it, so unmapping through one clone left every other clone holding an ArrayBuffer that Javascript had already detached. The next read built a Uint8Array view over that buffer and threw "Cannot perform Construct on a detached ArrayBuffer". The same applies to the mapped range recorded by map_async, which was invisible to any other clone.

Upstream carries this same change from 29.0.1 onward; 27.0.4 is still affected.
@fslabs-bot fslabs-bot Bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Aug 5, 2026
@aevyrie aevyrie added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 5, 2026
@fslabs-bot

fslabs-bot Bot commented Aug 5, 2026

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: IceSentry

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@fslabs-bot
fslabs-bot Bot merged commit 5903cab into patch-27.0.1 Aug 5, 2026
69 of 79 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants