Move buffer slice OOB check from panic in wgpu to validation error in wgpu-core

CHANGELOG.md

@@ -477,6 +477,7 @@ By @ErichDonGubler in [#6456](https://github.com/gfx-rs/wgpu/pull/6456), [#6148]
 - Set index type to NONE in `get_acceleration_structure_build_sizes`. By @Vecvec in [#6802](https://github.com/gfx-rs/wgpu/pull/6802).
 - Fix `wgpu-info` not showing dx12 adapters. By @wumpf in [#6844](https://github.com/gfx-rs/wgpu/pull/6844).
 - Use `transform_buffer_offset` when initialising `transform_buffer`. By @Vecvec in [#6864](https://github.com/gfx-rs/wgpu/pull/6864).
+- Move buffer slice OOB checks to be a validation error in `wgpu-core`, instead of a panic in `wgpu` only. By @ErichDonGubler in [#6493](https://github.com/gfx-rs/wgpu/pull/6493).
 
 #### Naga
 

wgpu-core/src/command/render.rs

@@ -716,6 +716,17 @@ pub enum RenderPassErrorInner {
         end_count_offset: u64,
         count_buffer_size: u64,
     },
+    #[error(
+        "Requested indirect index buffer bytes {}..{} which overruns indirect buffer of size {}",
+        begin_offset,
+        end_offset,
+        buffer_size
+    )]
+    IndirectIndexBufferOverrun {
+        begin_offset: u64,
+        end_offset: u64,
+        buffer_size: u64,
+    },
     #[error("Cannot pop debug group, because number of pushed debug groups is zero")]
     InvalidPopDebugGroup,
     #[error(transparent)]
@@ -2190,6 +2201,21 @@ fn set_index_buffer(
         Some(s) => offset + s.get(),
         None => buffer.size,
     };
+
+    let check_oob = |bound| {
+        if bound > buffer.size {
+            Err(RenderPassErrorInner::IndirectIndexBufferOverrun {
+                begin_offset: offset,
+                end_offset: end,
+                buffer_size: buffer.size,
+            })
+        } else {
+            Ok(())
+        }
+    };
+    check_oob(offset)?;
+    check_oob(end)?;
+
     state.index.update_buffer(offset..end, index_format);
 
     state

wgpu/src/api/buffer.rs

@@ -232,7 +232,6 @@ impl Buffer {
     /// end of the buffer.
     pub fn slice<S: RangeBounds<BufferAddress>>(&self, bounds: S) -> BufferSlice<'_> {
         let (offset, size) = range_to_offset_size(bounds);
-        check_buffer_bounds(self.size, offset, size);
         BufferSlice {
             buffer: self,
             offset,
@@ -744,31 +743,6 @@ impl Drop for BufferViewMut<'_> {
     }
 }
 
-fn check_buffer_bounds(
-    buffer_size: BufferAddress,
-    offset: BufferAddress,
-    size: Option<BufferSize>,
-) {
-    // A slice of length 0 is invalid, so the offset must not be equal to or greater than the buffer size.
-    if offset >= buffer_size {
-        panic!(
-            "slice offset {} is out of range for buffer of size {}",
-            offset, buffer_size
-        );
-    }
-
-    if let Some(size) = size {
-        // Detect integer overflow.
-        let end = offset.checked_add(size.get());
-        if end.map_or(true, |end| end > buffer_size) {
-            panic!(
-                "slice offset {} size {} is out of range for buffer of size {}",
-                offset, size, buffer_size
-            );
-        }
-    }
-}
-
 fn range_to_offset_size<S: RangeBounds<BufferAddress>>(
     bounds: S,
 ) -> (BufferAddress, Option<BufferSize>) {
@@ -789,7 +763,7 @@ fn range_to_offset_size<S: RangeBounds<BufferAddress>>(
 
 #[cfg(test)]
 mod tests {
-    use super::{check_buffer_bounds, range_to_offset_size, BufferSize};
+    use super::{range_to_offset_size, BufferSize};
 
     #[test]
     fn range_to_offset_size_works() {
@@ -812,31 +786,4 @@ mod tests {
     fn range_to_offset_size_panics_for_unbounded_empty_range() {
         range_to_offset_size(..0);
     }
-
-    #[test]
-    #[should_panic]
-    fn check_buffer_bounds_panics_for_offset_at_size() {
-        check_buffer_bounds(100, 100, None);
-    }
-
-    #[test]
-    fn check_buffer_bounds_works_for_end_in_range() {
-        check_buffer_bounds(200, 100, BufferSize::new(50));
-        check_buffer_bounds(200, 100, BufferSize::new(100));
-        check_buffer_bounds(u64::MAX, u64::MAX - 100, BufferSize::new(100));
-        check_buffer_bounds(u64::MAX, 0, BufferSize::new(u64::MAX));
-        check_buffer_bounds(u64::MAX, 1, BufferSize::new(u64::MAX - 1));
-    }
-
-    #[test]
-    #[should_panic]
-    fn check_buffer_bounds_panics_for_end_over_size() {
-        check_buffer_bounds(200, 100, BufferSize::new(101));
-    }
-
-    #[test]
-    #[should_panic]
-    fn check_buffer_bounds_panics_for_end_wraparound() {
-        check_buffer_bounds(u64::MAX, 1, BufferSize::new(u64::MAX));
-    }
 }