From 1cbebdcffe64c05e8ed14db7331333425f6feb65 Mon Sep 17 00:00:00 2001
From: Jim Blandy <jimb@red-bean.com>
Date: Fri, 10 Oct 2025 09:38:35 -0700
Subject: [PATCH] [core] Don't skip binding index checks for derived layouts.
 (#8325)

When deriving a bind group layout for a pipeline, bother to enforce
`wgpu_types::Limits::max_bindings_per_bind_group`. Move the check:

- from `wgpu_core::device::bgl::EntryMap::from_entries`, which is only used
  for explicit bind group creation

- into `wgpu_core::device::Device::create_bind_group_layout`, which is used
  for all bind group layout creation.
---
 CHANGELOG.md                     | 1 +
 wgpu-core/src/device/bgl.rs      | 9 ---------
 wgpu-core/src/device/global.rs   | 2 +-
 wgpu-core/src/device/resource.rs | 9 +++++++++
 4 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 400f9624a..95c279bba 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -84,6 +84,7 @@ SamplerDescriptor {
 
 - Reject fragment shader output `location`s > `max_color_attachments` limit. By @ErichDonGubler in [#8316](https://github.com/gfx-rs/wgpu/pull/8316).
 - WebGPU device requests now support the required limits `maxColorAttachments` and `maxColorAttachmentBytesPerSample`. By @evilpie in [#8328](https://github.com/gfx-rs/wgpu/pull/8328)
+- Reject binding indices that exceed `wgpu_types::Limits::max_bindings_per_bind_group` when deriving a bind group layout for a pipeline. By @jimblandy in [#8325](https://github.com/gfx-rs/wgpu/pull/8325).
 
 ## v27.0.2 (2025-10-03)
 
diff --git a/wgpu-core/src/device/bgl.rs b/wgpu-core/src/device/bgl.rs
index 482ed1754..2d26e1225 100644
--- a/wgpu-core/src/device/bgl.rs
+++ b/wgpu-core/src/device/bgl.rs
@@ -63,19 +63,10 @@ impl EntryMap {
     /// Errors if there are duplicate bindings or if any binding index is greater than
     /// the device's limits.
     pub fn from_entries(
-        device_limits: &wgt::Limits,
         entries: &[wgt::BindGroupLayoutEntry],
     ) -> Result<Self, binding_model::CreateBindGroupLayoutError> {
         let mut inner = FastIndexMap::with_capacity_and_hasher(entries.len(), Default::default());
         for entry in entries {
-            if entry.binding >= device_limits.max_bindings_per_bind_group {
-                return Err(
-                    binding_model::CreateBindGroupLayoutError::InvalidBindingIndex {
-                        binding: entry.binding,
-                        maximum: device_limits.max_bindings_per_bind_group,
-                    },
-                );
-            }
             if inner.insert(entry.binding, *entry).is_some() {
                 return Err(binding_model::CreateBindGroupLayoutError::ConflictBinding(
                     entry.binding,
diff --git a/wgpu-core/src/device/global.rs b/wgpu-core/src/device/global.rs
index c63ed373a..0542c6ebd 100644
--- a/wgpu-core/src/device/global.rs
+++ b/wgpu-core/src/device/global.rs
@@ -693,7 +693,7 @@ impl Global {
                 break 'error e.into();
             }
 
-            let entry_map = match bgl::EntryMap::from_entries(&device.limits, &desc.entries) {
+            let entry_map = match bgl::EntryMap::from_entries(&desc.entries) {
                 Ok(map) => map,
                 Err(e) => break 'error e,
             };
diff --git a/wgpu-core/src/device/resource.rs b/wgpu-core/src/device/resource.rs
index 81e907d13..d2233757f 100644
--- a/wgpu-core/src/device/resource.rs
+++ b/wgpu-core/src/device/resource.rs
@@ -2292,6 +2292,15 @@ impl Device {
         }
 
         for entry in entry_map.values() {
+            if entry.binding >= self.limits.max_bindings_per_bind_group {
+                return Err(
+                    binding_model::CreateBindGroupLayoutError::InvalidBindingIndex {
+                        binding: entry.binding,
+                        maximum: self.limits.max_bindings_per_bind_group,
+                    },
+                );
+            }
+
             use wgt::BindingType as Bt;
 
             let mut required_features = wgt::Features::empty();