From 1c5131547e777334e1fbe6de7c669e094ada7678 Mon Sep 17 00:00:00 2001
From: Lokbondo Kung <lokokung@google.com>
Date: Tue, 19 May 2026 12:22:44 -0700
Subject: [PATCH] [wire] Fixes potential UAF when dealing with injected Unregisters.

- In the bug below, it was found that by injecting UnregisterObject
  commands that correspond to allocated but not backed objects, i.e.
  objects that would be returned via asynchronous APIs, it was
  possible to make the server access freed memory if we tried to
  run the async API again while reusing the same object ids. This
  change makes it so that the server tracks both the id and the
  generation to uniquely identify objects when dealing with a
  malicious or compromised client. When an async callback fires on
  the server side that should fulfill a reservation that was
  somehow already Unregistered, the server now fails the callback
  and reclaims the backing object instead.
- In order to properly test this new change, the mock API was
  updated to allow specifying specific futures when emulating
  callbacks firing on the server side. A sibling API was added to
  allow mock expectations to retrieve the server-side Futures to
  allow fine-grained control of which callbacks to trigger via
  emulation. This meant that the mock objects now need maps for
  callbacks per object because we could have multiple identical
  callback types in flight at once. To avoid polluting other
  existing test code, the additional Future argument is
  optional with the assertion that only one callback was in
  flight.

Bug: 508092644
Change-Id: I6944afc4420c7f345c16796cc692dafa4f2f88cc
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/309135
Commit-Queue: Loko Kung <lokokung@google.com>
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
---

diff --git a/generator/templates/dawn/wire/server/ServerBase.h b/generator/templates/dawn/wire/server/ServerBase.h
index 0f16f4e29..f4c1a28 100644
--- a/generator/templates/dawn/wire/server/ServerBase.h
+++ b/generator/templates/dawn/wire/server/ServerBase.h
@@ -63,21 +63,21 @@
             return std::get<KnownObjects<T>>(mKnown).Get(id, result);
         }
         template <typename T>
-        WireResult FillReservation(ObjectId id, T handle, Known<T>* known = nullptr) {
-            auto result = std::get<KnownObjects<T>>(mKnown).FillReservation(id, handle, known);
+        WireResult FillReservation(ObjectHandle handle, T nativeHandle, Known<T>* known = nullptr) {
+            auto result = std::get<KnownObjects<T>>(mKnown).FillReservation(handle, nativeHandle, known);
             if (result == WireResult::FatalError) {
-                Release(handle);
+                Release(nativeHandle);
             }
             return result;
         }
         template <typename T>
         WireResult Allocate(Reserved<T>* result,
-                            ObjectHandle handler,
+                            ObjectHandle handle,
                             AllocationState state = AllocationState::Allocated) {
             // Allocations always take the lock because |vector::push_back| may be called which
             // can invalidate pointers.
             auto serverGuard = GetGuard();
-            return std::get<KnownObjects<T>>(mKnown).Allocate(result, handler, state);
+            return std::get<KnownObjects<T>>(mKnown).Allocate(result, handle, state);
         }
         template <typename T>
         WireResult Free(ObjectId id, ObjectData<T>* data) {
diff --git a/generator/templates/mock_api.cpp b/generator/templates/mock_api.cpp
index 4595cb3..c10b367 100644
--- a/generator/templates/mock_api.cpp
+++ b/generator/templates/mock_api.cpp
@@ -31,6 +31,7 @@
 #include <algorithm>
 
 #include "dawn/common/Log.h"
+#include "dawn/common/Assert.h"
 #include "dawn/dawn_version.h"
 
 using namespace testing;
@@ -59,6 +60,10 @@
 ProcTableAsClass::~ProcTableAsClass() {
 }
 
+WGPUFuture ProcTableAsClass::GetLastFuture() {
+    return {mNextFutureID - 1};
+}
+
 {% set Prefix = metadata.proc_table_prefix %}
 void ProcTableAsClass::GetProcTable({{Prefix}}ProcTable* table) {
     std::ranges::copy(dawn::kDawnVersion, table->version);
@@ -91,18 +96,28 @@
                 {%- endfor -%}
             ) {
                 ProcTableAsClass::Object* object = reinterpret_cast<ProcTableAsClass::Object*>({{as_varName(type.name)}});
-                object->m{{Suffix}}Callback = callbackInfo.callback;
-                object->m{{Suffix}}Userdata1 = callbackInfo.userdata1;
-                object->m{{Suffix}}Userdata2 = callbackInfo.userdata2;
-
-                On{{Suffix}}(
-                    {{-as_varName(type.name)}}
-                    {%- for arg in method.arguments -%}
-                        , {{as_varName(arg.name)}}
-                    {%- endfor -%}
-                );
                 {% if method.returns and method.returns.type.name.get() == "future" %}
-                    return {mNextFutureID++};
+                    dawn::FutureID futureID = mNextFutureID++;
+                    object->m{{Suffix}}Requests[futureID] = {callbackInfo.callback, callbackInfo.userdata1, callbackInfo.userdata2};
+
+                    On{{Suffix}}(
+                        {{-as_varName(type.name)}}
+                        {%- for arg in method.arguments -%}
+                            , {{as_varName(arg.name)}}
+                        {%- endfor -%}
+                    );
+                    return {futureID};
+                {% else %}
+                    object->m{{Suffix}}Callback = callbackInfo.callback;
+                    object->m{{Suffix}}Userdata1 = callbackInfo.userdata1;
+                    object->m{{Suffix}}Userdata2 = callbackInfo.userdata2;
+
+                    On{{Suffix}}(
+                        {{-as_varName(type.name)}}
+                        {%- for arg in method.arguments -%}
+                            , {{as_varName(arg.name)}}
+                        {%- endfor -%}
+                    );
                 {% endif %}
             }
             {% set CallbackInfoType = (method.arguments|last).type %}
@@ -112,13 +127,44 @@
                 {%- for arg in CallbackType.arguments -%}
                     , {{as_annotated_cType(arg)}}
                 {%- endfor -%}
+                {%- if method.returns and method.returns.type.name.get() == "future" -%}
+                    , WGPUFuture future
+                {%- endif -%}
             ) {
                 ProcTableAsClass::Object* object = reinterpret_cast<ProcTableAsClass::Object*>({{as_varName(type.name)}});
-                object->m{{Suffix}}Callback(
-                    {%- for arg in CallbackType.arguments -%}
-                        {{as_varName(arg.name)}}{{", "}}
-                    {%- endfor -%}
-                    object->m{{Suffix}}Userdata1, object->m{{Suffix}}Userdata2);
+                {% if method.returns and method.returns.type.name.get() == "future" %}
+                    if (future.id == dawn::kNullFutureID) {
+                        // TODO(crbug.com/514400091): We provide this default version for emulating
+                        // callbacks to avoid breaking existing tests that only ever have one
+                        // outstanding pending callback at a time. Consider updating all tests,
+                        // and/or adding better utility functions to make this process easier.
+                        DAWN_ASSERT(object->m{{Suffix}}Requests.size() == 1);
+                        auto it = object->m{{Suffix}}Requests.begin();
+                        auto data = it->second;
+                        object->m{{Suffix}}Requests.erase(it);
+                        data.callback(
+                            {%- for arg in CallbackType.arguments -%}
+                                {{as_varName(arg.name)}}{{", "}}
+                            {%- endfor -%}
+                            data.userdata1, data.userdata2);
+                    } else {
+                        auto it = object->m{{Suffix}}Requests.find(future.id);
+                        DAWN_ASSERT(it != object->m{{Suffix}}Requests.end());
+                        auto data = it->second;
+                        object->m{{Suffix}}Requests.erase(it);
+                        data.callback(
+                            {%- for arg in CallbackType.arguments -%}
+                                {{as_varName(arg.name)}}{{", "}}
+                            {%- endfor -%}
+                            data.userdata1, data.userdata2);
+                    }
+                {% else %}
+                    object->m{{Suffix}}Callback(
+                        {%- for arg in CallbackType.arguments -%}
+                            {{as_varName(arg.name)}}{{", "}}
+                        {%- endfor -%}
+                        object->m{{Suffix}}Userdata1, object->m{{Suffix}}Userdata2);
+                {% endif %}
             }
         {% endif %}
     {% endfor %}
diff --git a/generator/templates/mock_api.h b/generator/templates/mock_api.h
index 096da17..8c20ea1 100644
--- a/generator/templates/mock_api.h
+++ b/generator/templates/mock_api.h
@@ -40,6 +40,7 @@
 #include <memory>
 
 #include "dawn/common/FutureUtils.h"
+#include "absl/container/flat_hash_map.h"
 
 // An abstract base class representing a proc table so that API calls can be mocked. Most API calls
 // are directly represented by a delete virtual method but others need minimal state tracking to be
@@ -49,6 +50,7 @@
         virtual ~ProcTableAsClass();
 
         void GetProcTable({{Prefix}}ProcTable* table);
+        WGPUFuture GetLastFuture();
 
         // Creates an object that can be returned by a mocked call as in WillOnce(Return(foo)).
         // It returns an object of the write type that isn't equal to any previously returned object.
@@ -99,6 +101,9 @@

diff --git a/src/dawn/tests/unittests/wire/WireSpecificCommandTests.cpp b/src/dawn/tests/unittests/wire/WireSpecificCommandTests.cpp
index 3f8087b..4564ab7 100644
--- a/src/dawn/tests/unittests/wire/WireSpecificCommandTests.cpp
+++ b/src/dawn/tests/unittests/wire/WireSpecificCommandTests.cpp
@@ -25,21 +25,34 @@
 // OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+#include <span>
+
 #include "dawn/common/StringViewUtils.h"
+#include "dawn/tests/MockCallback.h"
+#include "dawn/tests/StringViewMatchers.h"
 #include "dawn/tests/unittests/wire/WireTest.h"
+#include "dawn/utils/TerribleCommandBuffer.h"
+#include "dawn/wire/BufferConsumer.h"
 #include "dawn/wire/ChunkedCommandSerializer.h"
 #include "dawn/wire/Wire.h"
 #include "dawn/wire/WireClient.h"
 #include "dawn/wire/WireCmd_autogen.h"
 #include "dawn/wire/WireServer.h"
 #include "dawn/wire/client/Client.h"
+#include "dawn/wire/server/Server.h"
 
 namespace dawn::wire {
 namespace {
 
 using testing::_;
+using testing::EmptySizedString;
 using testing::InvokeWithoutArgs;
+using testing::IsNull;
+using testing::MockCppCallback;
+using testing::NonEmptySizedString;
+using testing::NotNull;
 using testing::Return;
+using testing::WithArg;
 
 // Fixture that helps execute specific commands through the wire that may not be possible to trigger
 // through usage of the dawn::wire::client. It is even more change detecting than regular dawn::wire
@@ -53,6 +66,33 @@
 
         serializer.SerializeCommand(cmd, *GetWireClient()->GetImplForTesting());
     }
+
+    // Intercept a command that will be sent from the client to the server. This involves first
+    // capturing the command, deserializing it as if we were the server, and then re-injecting it
+    // back into the client command buffer. Note that this does not currently handle object
+    // serialization correctly, so when modifying commands with descriptors that include other
+    // WebGPU objects, users may need to manually update those members. This is currently a
+    // limitation that is hard to address because of the way the commands are [de]serialized in the
+    // wire.
+    template <typename Cmd, typename ToIntercept, typename Modifier>
+    void InterceptServerCmd(ToIntercept toIntercept, Modifier modifier) {
+        Cmd cmd;
+        utils::TerribleCommandBuffer* c2sBuf = GetC2SCommandBuffer();
+        size_t startOffset = c2sBuf->GetOffsetForTesting();
+        toIntercept();
+        size_t endOffset = c2sBuf->GetOffsetForTesting();
+        std::span<const char> subrange = c2sBuf->GetContentSubrange(startOffset, endOffset);
+        dawn::wire::DeserializeBuffer deserializeBuffer(subrange.data(), subrange.size());
+        EXPECT_EQ(WireResult::Success, cmd.Deserialize(&deserializeBuffer, &mAllocator,
+                                                       *GetWireServer()->GetImplForTesting()));
+
+        modifier(&cmd);
+        c2sBuf->SetOffsetForTesting(startOffset);
+        AddSpecificServerCmd(cmd);
+    }
+
+  private:
+    WireDeserializeAllocator mAllocator;
 };
 
 // Regression test for https://issues.chromium.org/492139412 where a server receiving
@@ -135,5 +175,358 @@
     FlushClient();
 }
 
+// This is a regression test for https://issues.chromium.org/508092644 where a compromised client
+// could potentially ask the server to Unregister a reserved, but not backed Device.
+TEST_F(WireSpecificCommandTests, RequestDeviceIdReuseAfterInjectedUnregister) {
+    // Set up all the mock callbacks and objects.
+    MockCppCallback<wgpu::DeviceLostCallback<void>*> deviceLostCb;
+    MockCppCallback<wgpu::RequestDeviceCallback<void>*> requestDeviceCb;
+    WGPUDevice apiDeviceA = api.GetNewDevice();
+    WGPUFuture futureA;
+    WGPUDevice apiDeviceB = api.GetNewDevice();
+    WGPUFuture futureB;
+    auto SetDeviceCallbacks = [](WGPUDevice apiDevice, const WGPUDeviceDescriptor* desc) {
+        ProcTableAsClass::Object* object = reinterpret_cast<ProcTableAsClass::Object*>(apiDevice);
+        object->mDeviceLostCallback = desc->deviceLostCallbackInfo.callback;
+        object->mDeviceLostUserdata1 = desc->deviceLostCallbackInfo.userdata1;
+        object->mDeviceLostUserdata2 = desc->deviceLostCallbackInfo.userdata2;
+    };
+
+    // Add the first request for a device and capture the C->S command for it.
+    wgpu::DeviceDescriptor deviceDescA = {};
+    deviceDescA.SetDeviceLostCallback(wgpu::CallbackMode::AllowSpontaneous,
+                                      deviceLostCb.Callback());
+    AdapterRequestDeviceCmd requestA = {};
+    InterceptServerCmd<AdapterRequestDeviceCmd>(
+        [&]() {
+            adapter.RequestDevice(&deviceDescA, wgpu::CallbackMode::AllowSpontaneous,
+                                  requestDeviceCb.Callback());
+        },
+        [&](AdapterRequestDeviceCmd* cmd) { requestA = *cmd; });
+
+    // Immediately unregister the device that was reserved for the first request. This is not
+    // normally possible, so we inject the command directly.
+    UnregisterObjectCmd unregisterA = {};
+    unregisterA.objectType = ObjectType::Device;
+    unregisterA.objectId = requestA.deviceObjectHandle.id;
+    AddSpecificServerCmd(unregisterA);
+
+    // Add a second request for a device that attempts to reuse the same id that was originally
+    // reserved for the first request.
+    wgpu::DeviceDescriptor deviceDescB = {};
+    deviceDescB.SetDeviceLostCallback(wgpu::CallbackMode::AllowSpontaneous,
+                                      deviceLostCb.Callback());
+    AdapterRequestDeviceCmd requestB = {};
+    InterceptServerCmd<AdapterRequestDeviceCmd>(
+        [&]() {
+            adapter.RequestDevice(&deviceDescB, wgpu::CallbackMode::AllowSpontaneous,
+                                  requestDeviceCb.Callback());
+        },
+        [&](AdapterRequestDeviceCmd* cmd) {
+            cmd->deviceObjectHandle.id = requestA.deviceObjectHandle.id;
+            cmd->deviceObjectHandle.generation = requestA.deviceObjectHandle.generation + 1;
+            requestB = *cmd;
+        });
+
+    EXPECT_CALL(api, OnAdapterRequestDevice(apiAdapter, NotNull(), _))
+        .WillOnce(WithArg<1>([&](const WGPUDeviceDescriptor* desc) {
+            SetDeviceCallbacks(apiDeviceA, desc);
+            futureA = api.GetLastFuture();
+        }))
+        .WillOnce(WithArg<1>([&](const WGPUDeviceDescriptor* desc) {
+            SetDeviceCallbacks(apiDeviceB, desc);
+            futureB = api.GetLastFuture();
+        }));
+    FlushClient();
+
+    // Emulate the backend server completing the first request for a device successfully. Even
+    // though the backend successfully created the device, because the client has already asked to
+    // unregister that reserved slot, the server should just immediately release the successfully
+    // created device.
+    EXPECT_CALL(api, DeviceRelease(apiDeviceA)).Times(1);
+    api.CallAdapterRequestDeviceCallback(apiAdapter, WGPURequestDeviceStatus_Success, apiDeviceA,
+                                         kEmptyOutputStringView, futureA);
+    // Additionally verify that the server does not back the device.
+    EXPECT_EQ(GetWireServer()->GetDevice(requestA.deviceObjectHandle.id,
+                                         requestA.deviceObjectHandle.generation),
+              nullptr);
+
+    // When we flush the server, the RequestDevice callback for the first request should be called
+    // with callback cancelled, and the DeviceLost callback should also fire once for the first
+    // requested device.
+    EXPECT_CALL(requestDeviceCb, Call(wgpu::RequestDeviceStatus::CallbackCancelled, IsNull(),
+                                      NonEmptySizedString()));
+    EXPECT_CALL(deviceLostCb, Call).Times(1);
+    FlushServer();
+
+    // Emulate the backend server completing the second request for a device successfully.
+    api.CallAdapterRequestDeviceCallback(apiAdapter, WGPURequestDeviceStatus_Success, apiDeviceB,
+                                         kEmptyOutputStringView, futureB);
+    // Verify that the server backs the device.
+    EXPECT_EQ(GetWireServer()->GetDevice(requestB.deviceObjectHandle.id,
+                                         requestB.deviceObjectHandle.generation),
+              apiDeviceB);
+
+    // When the server completes the second request for a device, the RequestDevice callback for
+    // the second request should be called with success, and the DeviceLost callback should also
+    // fire once for the second requested device because we don't save the device from the
+    // RequestDevice callback.
+    EXPECT_CALL(requestDeviceCb,
+                Call(wgpu::RequestDeviceStatus::Success, NotNull(), EmptySizedString()));
+    EXPECT_CALL(deviceLostCb, Call).Times(1);
+    FlushServer();
+
+    // Finally, since we dropped the device on the client side, it should be Unregistered from the
+    // client, and correspondingly released on the server side once the commands are flushed. Note
+    // that the client flush should still fail though because we injected a different ID for the
+    // device than the client frontend actually allocated for the second device. This means that the
+    // wire client frontend will try to Unregister a non-existent object as a result of the modified
+    // and injected second request which will cause the server to fail.
+    EXPECT_CALL(api, DeviceRelease(apiDeviceB)).Times(1);
+    FlushClient(false);
+}
+
+// This is a regression test for https://issues.chromium.org/508092644 where a compromised client
+// could potentially ask the server to Unregister a reserved, but not backed Adapter.
+TEST_F(WireSpecificCommandTests, RequestAdapterIdReuseAfterInjectedUnregister) {
+    // Set up all the mock callbacks and objects.
+    MockCppCallback<wgpu::RequestAdapterCallback<void>*> requestAdapterCb;
+    WGPUAdapter apiAdapterA = api.GetNewAdapter();
+    WGPUFuture futureA;
+    WGPUAdapter apiAdapterB = api.GetNewAdapter();
+    WGPUFuture futureB;
+
+    // Add the first request for an adapter.
+    InstanceRequestAdapterCmd requestA = {};
+    InterceptServerCmd<InstanceRequestAdapterCmd>(
+        [&]() {
+            instance.RequestAdapter(nullptr, wgpu::CallbackMode::AllowSpontaneous,
+                                    requestAdapterCb.Callback());
+        },
+        [&](InstanceRequestAdapterCmd* cmd) { requestA = *cmd; });
+
+    // Immediately unregister the adapter that was reserved for the first request. This is not
+    // normally possible, so we inject the command directly.
+    UnregisterObjectCmd unregisterA = {};
+    unregisterA.objectType = ObjectType::Adapter;
+    unregisterA.objectId = requestA.adapterObjectHandle.id;
+    AddSpecificServerCmd(unregisterA);
+
+    // Add a second request for an adapter that attempts to reuse the same id that was originally
+    // reserved for the first request.
+    InstanceRequestAdapterCmd requestB = {};
+    InterceptServerCmd<InstanceRequestAdapterCmd>(
+        [&]() {
+            instance.RequestAdapter(nullptr, wgpu::CallbackMode::AllowSpontaneous,
+                                    requestAdapterCb.Callback());
+        },
+        [&](InstanceRequestAdapterCmd* cmd) {
+            cmd->adapterObjectHandle.id = requestA.adapterObjectHandle.id;
+            cmd->adapterObjectHandle.generation = requestA.adapterObjectHandle.generation + 1;
+            requestB = *cmd;
+        });
+
+    EXPECT_CALL(api, OnInstanceRequestAdapter(apiInstance, IsNull(), _))
+        .WillOnce([&]() { futureA = api.GetLastFuture(); })
+        .WillOnce([&]() { futureB = api.GetLastFuture(); });
+    FlushClient();
+
+    // Emulate the backend server completing the first request for an adapter successfully. Even
+    // though the backend successfully created the adapter, because the client has already asked to
+    // unregister that reserved slot, the server should just immediately release the successfully
+    // created adapter.
+    EXPECT_CALL(api, AdapterRelease(apiAdapterA)).Times(1);
+    api.CallInstanceRequestAdapterCallback(apiInstance, WGPURequestAdapterStatus_Success,
+                                           apiAdapterA, kEmptyOutputStringView, futureA);
+
+    // When we flush the server, the RequestAdapter callback for the first request should be called
+    // with callback cancelled.
+    EXPECT_CALL(requestAdapterCb, Call(wgpu::RequestAdapterStatus::CallbackCancelled, IsNull(),
+                                       NonEmptySizedString()));
+    FlushServer();
+
+    // Emulate the backend server completing the second request for an adapter successfully.
+    api.CallInstanceRequestAdapterCallback(apiInstance, WGPURequestAdapterStatus_Success,
+                                           apiAdapterB, kEmptyOutputStringView, futureB);
+
+    // When the server completes the second request for an adapter, the RequestAdapter callback for
+    // the second request should be called with success.
+    EXPECT_CALL(requestAdapterCb,
+                Call(wgpu::RequestAdapterStatus::Success, NotNull(), EmptySizedString()));
+    FlushServer();
+
+    // Finally, since we dropped the adapter on the client side, it should be Unregistered from the
+    // client, and correspondingly released on the server side once the commands are flushed. Note
+    // that the client flush should still fail though because we injected a different ID for the
+    // adapter than the client frontend actually allocated for the second adapter. This means that
+    // the wire client frontend will try to Unregister a non-existent object as a result of the
+    // modified and injected second request which will cause the server to fail.
+    EXPECT_CALL(api, AdapterRelease(apiAdapterB)).Times(1);
+    FlushClient(false);
+}
+
+// This is a regression test for https://issues.chromium.org/508092644 where a compromised client
+// could potentially ask the server to Unregister a reserved, but not backed ComputePipeline. See
+// the RequestAdapterIdReuseAfterInjectedUnregister test above for more equivalent descriptions for
+// each step throughout the test.
+TEST_F(WireSpecificCommandTests, CreateComputePipelineAsyncIdReuseAfterInjectedUnregister) {
+    wgpu::ShaderModuleDescriptor shaderDesc = {};
+    wgpu::ShaderModule shader = device.CreateShaderModule(&shaderDesc);
+    WGPUShaderModule apiShader = api.GetNewShaderModule();
+    EXPECT_CALL(api, DeviceCreateShaderModule(apiDevice, _)).WillOnce(Return(apiShader));
+    FlushClient();
+
+    wgpu::ComputePipelineDescriptor descriptor = {};
+    descriptor.compute.module = shader;
+
+    MockCppCallback<wgpu::CreateComputePipelineAsyncCallback<void>*> createComputePipelineCb;
+    WGPUComputePipeline apiPipelineA = api.GetNewComputePipeline();
+    WGPUFuture futureA;
+    WGPUComputePipeline apiPipelineB = api.GetNewComputePipeline();
+    WGPUFuture futureB;
+
+    DeviceCreateComputePipelineAsyncCmd requestA = {};
+    InterceptServerCmd<DeviceCreateComputePipelineAsyncCmd>(
+        [&]() {
+            device.CreateComputePipelineAsync(&descriptor, wgpu::CallbackMode::AllowSpontaneous,
+                                              createComputePipelineCb.Callback());
+        },
+        [&](DeviceCreateComputePipelineAsyncCmd* cmd) {
+            requestA = *cmd;
+            // Manually fix the shader module since the [de]serialization can't handle objects.
+            const_cast<WGPUComputePipelineDescriptor*>(cmd->descriptor)->compute.module =
+                shader.Get();
+        });
+
... (truncated)