Yank versions of wgpu without #5812?

[workingjubilee]

Before d309bba, Direct3D was just merrily reading random uninit data into its execution. We know this for a fact because the very moment wgpu called a version of compile_fxc compiled by a rustc with rust-lang/rust@38104f3 on Windows, the programs got hoist on the petard of STATUS_ACCESS_VIOLATION. Much better, because the bug was made visible and has been quickly fixed! It is worth considering yanking affected versions of wgpu, especially those that have the fix backported to their major version, so that Windows stops munching on garbage data, and to accelerate retiring the affected versions from the ecosystem (even if it does not actually completely remove them due to how yanking works).

...Or not! I'm a programmer, not a cop.

[ErichDonGubler]

Adding this to our wgpu maintainers meeting agenda for next Wednesday.

[jimblandy]

Which versions are affected?

[workingjubilee]

This goes back to the introduction of 81569dd sooo wgpu 0.15.0 it seems?

That is a... lot of versions to yank, so I think it would be most productive to, e.g.

• yank wgpu 0.20.0 and 0.20.1, since the patch is in 0.20.2 and that would force the upgrade (thus, having an actual practical effect)
• decide on a disposition for Backport Do not feed &"" to D3DCompile (#5812) to 0.19 #5833
• consider yanking previous 0.19 versions if the answer is "merge"
• decide on a disposition for Backport Do not feed &"" to D3DCompile (#5812) to 0.18 #5834
• consider yanking previous 0.18 versions if the answer is "merge"
• only then consider 0.17, 0.16, and 0.15