1593274 - Audit wgpu-* dependencies

Status: RESOLVED FIXED

(Core :: Graphics: WebGPU, task, P3)

Description

[Dzmitry Malyshau [:kvark]]

Related to bug 1575008, we are vendoring a large dependency tree into m-c. It would be good to have more eyes on some of the crates being vendored, in particular:

• https://github.com/gfx-rs/gfx/, with the focus on "gfx-hal" and Vulkan/Metal/D312 code
• low level API crates https://github.com/gfx-rs/metal-rs/ and https://github.com/gfx-rs/d3d12-rs
• helper crates "gfx-auxil", "storage-map", and "range-alloc"
• https://github.com/amethyst/rendy , only the "rendy-memory" and "rendy-descriptor" crates, which we use

Aside from all of those stands Spirv-cross and our Rust wrapper of it. They also need to be audited, but our long term plan is to eventually remove them.

What aspects of the code need to be looked at:

1. safety guarantees
2. use of generic bounds and collections (e.g. IntoIterator, Borrow)
3. use of traits, general type dependency graphs

Comment 1

[Dzmitry Malyshau [:kvark]]

Note that Rendy dependencies were mostly rewritten into https://github.com/gfx-rs/gfx-extras
It can be considered reviewed.

Comment 2

[Jim Blandy :jimb]

We've been looking at this code for quite a while, and we have been following the cargo vet rules. I think the grandfathering we've done is probably fine. Closing.