dawn_wire: Validate all objects are from the same device in the client

This is a temporary fix until dawn_wire can support multiple devices.
When using objects from different devices, the wire will inject an
error into the receiver object's device. Methods that return objects
will return a dummy object. Using the dummy object will cause a fatal
error on the server.

Without this fix, the server would blindly lookup an ObjectId which
could point to some other object. This would bypass same-device
validation and have incorrect results.

Bug: dawn:383
Change-Id: I898f07d4b26f2a97ef952b82af488e7f807c36f0
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/19261
Commit-Queue: Austin Eng <enga@chromium.org>
Reviewed-by: Kai Ninomiya <kainino@chromium.org>

generator/templates/dawn_wire/client/ApiProcs.cpp

@@ -12,6 +12,7 @@
 //* See the License for the specific language governing permissions and
 //* limitations under the License.
 
+#include "common/Log.h"
 #include "dawn_wire/client/ApiObjects.h"
 #include "dawn_wire/client/ApiProcs_autogen.h"
 #include "dawn_wire/client/Client.h"
@@ -22,6 +23,98 @@
 #include <vector>
 
 namespace dawn_wire { namespace client {
+    namespace {
+
+        //* Outputs an rvalue that's the number of elements a pointer member points to.
+        {% macro member_length(member, accessor) -%}
+            {%- if member.length == "constant" -%}
+                {{member.constant_length}}
+            {%- else -%}
+                {{accessor}}{{as_varName(member.length.name)}}
+            {%- endif -%}
+        {%- endmacro %}
+
+        {% for type in by_category["object"] %}
+            DAWN_DECLARE_UNUSED bool DeviceMatches(const Device* device, const {{as_cType(type.name)}} obj) {
+                return device == reinterpret_cast<const {{as_wireType(type)}}>(obj)->device;
+            }
+
+            DAWN_DECLARE_UNUSED bool DeviceMatches(const Device* device, const {{as_cType(type.name)}} *const obj, uint32_t count = 1) {
+                ASSERT(count == 0 || obj != nullptr);
+                for (uint32_t i = 0; i < count; ++i) {
+                    if (!DeviceMatches(device, obj[i])) {
+                        return false;
+                    }
+                }
+                return true;
+            }
+        {% endfor %}
+
+        bool DeviceMatches(const Device* device, WGPUChainedStruct const* chainedStruct);
+
+        {% for type in by_category["structure"] if type.may_have_dawn_object %}
+            DAWN_DECLARE_UNUSED bool DeviceMatches(const Device* device, const {{as_cType(type.name)}}& obj) {
+                {% if type.extensible %}
+                    if (!DeviceMatches(device, obj.nextInChain)) {
+                        return false;
+                    }
+                {% endif %}
+                {% for member in type.members if member.type.may_have_dawn_object or member.type.category == "object" %}
+                    {% if member.optional %}
+                        if (obj.{{as_varName(member.name)}} != nullptr)
+                    {% endif %}
+                    {
+                        if (!DeviceMatches(device, obj.{{as_varName(member.name)}}
+                            {%- if member.annotation != "value" and member.length != "strlen" -%}
+                                , {{member_length(member, "obj.")}}
+                            {%- endif -%})) {
+                            return false;
+                        }
+                    }
+                {% endfor %}
+                return true;
+            }
+
+            DAWN_DECLARE_UNUSED bool DeviceMatches(const Device* device, const {{as_cType(type.name)}} *const obj, uint32_t count = 1) {
+                for (uint32_t i = 0; i < count; ++i) {
+                    if (!DeviceMatches(device, obj[i])) {
+                        return false;
+                    }
+                }
+                return true;
+            }
+        {% endfor %}
+
+        bool DeviceMatches(const Device* device, WGPUChainedStruct const* chainedStruct) {
+            while (chainedStruct != nullptr) {
+                switch (chainedStruct->sType) {
+                    {% for sType in types["s type"].values if sType.valid %}
+                        {% set CType = as_cType(sType.name) %}
+                        case {{as_cEnum(types["s type"].name, sType.name)}}: {
+                            {% if types[sType.name.get()].may_have_dawn_object %}
+                                if (!DeviceMatches(device, reinterpret_cast<const {{CType}}*>(chainedStruct))) {
+                                    return false;
+                                }
+                            {% endif %}
+                            break;
+                        }
+                    {% endfor %}
+                    case WGPUSType_Invalid:
+                        break;
+                    default:
+                        UNREACHABLE();
+                        dawn::WarningLog()
+                            << "All objects may not be from the same device. "
+                            << "Unknown sType " << chainedStruct->sType << " discarded.";
+                        return false;
+                }
+                chainedStruct = chainedStruct->next;
+            }
+            return true;
+        }
+
+    }  // anonymous namespace
+
     //* Implementation of the client API functions.
     {% for type in by_category["object"] %}
         {% set Type = type.name.CamelCase() %}
@@ -29,13 +122,61 @@ namespace dawn_wire { namespace client {
 
         {% for method in type.methods %}
             {% set Suffix = as_MethodSuffix(type.name, method.name) %}
-            {% if Suffix not in client_handwritten_commands %}
+
-                {{as_cType(method.return_type.name)}} Client{{Suffix}}(
+            {% if Suffix in client_handwritten_commands %}
-                    {{-cType}} cSelf
+                static
-                    {%- for arg in method.arguments -%}
+            {% endif %}
-                        , {{as_annotated_cType(arg)}}
+            {{as_cType(method.return_type.name)}} Client{{Suffix}}(
-                    {%- endfor -%}
+                {{-cType}} cSelf
-                ) {
+                {%- for arg in method.arguments -%}
+                    , {{as_annotated_cType(arg)}}
+                {%- endfor -%}
+            ) {
+                {% if len(method.arguments) > 0 %}
+                    {
+                        bool sameDevice = true;
+                        auto self = reinterpret_cast<{{as_wireType(type)}}>(cSelf);
+                        Device* device = self->device;
+                        DAWN_UNUSED(device);
+
+                        do {
+                            {% for arg in method.arguments if arg.type.may_have_dawn_object or arg.type.category == "object" %}
+                                {% if arg.optional %}
+                                    if ({{as_varName(arg.name)}} != nullptr)
+                                {% endif %}
+                                {
+                                    if (!DeviceMatches(device, {{as_varName(arg.name)}}
+                                        {%- if arg.annotation != "value" and arg.length != "strlen" -%}
+                                            , {{member_length(arg, "")}}
+                                        {%- endif -%})) {
+                                        sameDevice = false;
+                                        break;
+                                    }
+                                }
+                            {% endfor %}
+                        } while (false);
+
+                        if (DAWN_UNLIKELY(!sameDevice)) {
+                            ClientDeviceInjectError(reinterpret_cast<WGPUDevice>(device),
+                                                    WGPUErrorType_Validation,
+                                                    "All objects must be from the same device.");
+                            {% if method.return_type.category == "object" %}
+                                // Allocate an object without registering it on the server. This is backed by a real allocation on
+                                // the client so commands can be sent with it. But because it's not allocated on the server, it will
+                                // be a fatal error to use it.
+                                auto self = reinterpret_cast<{{as_wireType(type)}}>(cSelf);
+                                auto* allocation = self->device->GetClient()->{{method.return_type.name.CamelCase()}}Allocator().New(self->device);
+                                return reinterpret_cast<{{as_cType(method.return_type.name)}}>(allocation->object.get());
+                            {% elif method.return_type.name.canonical_case() == "void" %}
+                                return;
+                            {% else %}
+                                return {};
+                            {% endif %}
+                        }
+                    }
+                {% endif %}
+
+                {% if Suffix not in client_handwritten_commands %}
                     auto self = reinterpret_cast<{{as_wireType(type)}}>(cSelf);
                     Device* device = self->device;
                     {{Suffix}}Cmd cmd;
@@ -62,8 +203,13 @@ namespace dawn_wire { namespace client {
                     {% if method.return_type.category == "object" %}
                         return reinterpret_cast<{{as_cType(method.return_type.name)}}>(allocation->object.get());
                     {% endif %}
-                }
+                {% else %}
-            {% endif %}
+                    return ClientHandwritten{{Suffix}}(cSelf
+                        {%- for arg in method.arguments -%}
+                            , {{as_varName(arg.name)}}
+                        {%- endfor -%});
+                {% endif %}
+            }
         {% endfor %}
 
         {% if not type.name.canonical_case() == "device" %}

generator/templates/dawn_wire/client/ApiProcs.h

@@ -24,11 +24,14 @@ namespace dawn_wire { namespace client {
         {% set cType = as_cType(type.name) %}
         {% for method in c_methods(type) %}
             {% set Suffix = as_MethodSuffix(type.name, method.name) %}
+            {% if Suffix in client_handwritten_commands %}
+                {% set Suffix = "Handwritten" + Suffix %}
+            {% endif %}
             {{as_cType(method.return_type.name)}} Client{{Suffix}}(
-              {{-cType}} cSelf
+                {{-cType}} cSelf
-              {%- for arg in method.arguments -%}
+                {%- for arg in method.arguments -%}
-                  , {{as_annotated_cType(arg)}}
+                    , {{as_annotated_cType(arg)}}
-              {%- endfor -%}
+                {%- endfor -%}
             );
         {% endfor %}
     {% endfor %}

src/dawn_wire/client/ApiProcs.cpp

@@ -46,9 +46,9 @@ namespace dawn_wire { namespace client {
         }
     }  // namespace
 
-    void ClientBufferMapReadAsync(WGPUBuffer cBuffer,
+    void ClientHandwrittenBufferMapReadAsync(WGPUBuffer cBuffer,
-                                  WGPUBufferMapReadCallback callback,
+                                             WGPUBufferMapReadCallback callback,
-                                  void* userdata) {
+                                             void* userdata) {
         Buffer* buffer = reinterpret_cast<Buffer*>(cBuffer);
 
         uint32_t serial = buffer->requestSerial++;
@@ -76,9 +76,9 @@ namespace dawn_wire { namespace client {
         SerializeBufferMapAsync(buffer, serial, readHandle);
     }
 
-    void ClientBufferMapWriteAsync(WGPUBuffer cBuffer,
+    void ClientHandwrittenBufferMapWriteAsync(WGPUBuffer cBuffer,
-                                   WGPUBufferMapWriteCallback callback,
+                                              WGPUBufferMapWriteCallback callback,
-                                   void* userdata) {
+                                              void* userdata) {
         Buffer* buffer = reinterpret_cast<Buffer*>(cBuffer);
 
         uint32_t serial = buffer->requestSerial++;
@@ -107,8 +107,8 @@ namespace dawn_wire { namespace client {
         SerializeBufferMapAsync(buffer, serial, writeHandle);
     }
 
-    WGPUBuffer ClientDeviceCreateBuffer(WGPUDevice cDevice,
+    WGPUBuffer ClientHandwrittenDeviceCreateBuffer(WGPUDevice cDevice,
-                                        const WGPUBufferDescriptor* descriptor) {
+                                                   const WGPUBufferDescriptor* descriptor) {
         Device* device = reinterpret_cast<Device*>(cDevice);
         Client* wireClient = device->GetClient();
 
@@ -130,7 +130,7 @@ namespace dawn_wire { namespace client {
         return reinterpret_cast<WGPUBuffer>(buffer);
     }
 
-    WGPUCreateBufferMappedResult ClientDeviceCreateBufferMapped(
+    WGPUCreateBufferMappedResult ClientHandwrittenDeviceCreateBufferMapped(
         WGPUDevice cDevice,
         const WGPUBufferDescriptor* descriptor) {
         Device* device = reinterpret_cast<Device*>(cDevice);
@@ -190,25 +190,27 @@ namespace dawn_wire { namespace client {
         return result;
     }
 
-    void ClientDevicePushErrorScope(WGPUDevice cDevice, WGPUErrorFilter filter) {
+    void ClientHandwrittenDevicePushErrorScope(WGPUDevice cDevice, WGPUErrorFilter filter) {
         Device* device = reinterpret_cast<Device*>(cDevice);
         device->PushErrorScope(filter);
     }
 
-    bool ClientDevicePopErrorScope(WGPUDevice cDevice, WGPUErrorCallback callback, void* userdata) {
+    bool ClientHandwrittenDevicePopErrorScope(WGPUDevice cDevice,
+                                              WGPUErrorCallback callback,
+                                              void* userdata) {
         Device* device = reinterpret_cast<Device*>(cDevice);
         return device->RequestPopErrorScope(callback, userdata);
     }
 
-    uint64_t ClientFenceGetCompletedValue(WGPUFence cSelf) {
+    uint64_t ClientHandwrittenFenceGetCompletedValue(WGPUFence cSelf) {
         auto fence = reinterpret_cast<Fence*>(cSelf);
         return fence->completedValue;
     }
 
-    void ClientFenceOnCompletion(WGPUFence cFence,
+    void ClientHandwrittenFenceOnCompletion(WGPUFence cFence,
-                                 uint64_t value,
+                                            uint64_t value,
-                                 WGPUFenceOnCompletionCallback callback,
+                                            WGPUFenceOnCompletionCallback callback,
-                                 void* userdata) {
+                                            void* userdata) {
         Fence* fence = reinterpret_cast<Fence*>(cFence);
         if (value > fence->signaledValue) {
             ClientDeviceInjectError(reinterpret_cast<WGPUDevice>(fence->device),
@@ -229,10 +231,10 @@ namespace dawn_wire { namespace client {
         fence->requests.Enqueue(std::move(request), value);
     }
 
-    void ClientBufferSetSubData(WGPUBuffer cBuffer,
+    void ClientHandwrittenBufferSetSubData(WGPUBuffer cBuffer,
-                                uint64_t start,
+                                           uint64_t start,
-                                uint64_t count,
+                                           uint64_t count,
-                                const void* data) {
+                                           const void* data) {
         Buffer* buffer = reinterpret_cast<Buffer*>(cBuffer);
 
         BufferSetSubDataInternalCmd cmd;
@@ -247,7 +249,7 @@ namespace dawn_wire { namespace client {
         cmd.Serialize(allocatedBuffer);
     }
 
-    void ClientBufferUnmap(WGPUBuffer cBuffer) {
+    void ClientHandwrittenBufferUnmap(WGPUBuffer cBuffer) {
         Buffer* buffer = reinterpret_cast<Buffer*>(cBuffer);
 
         // Invalidate the local pointer, and cancel all other in-flight requests that would
@@ -294,7 +296,7 @@ namespace dawn_wire { namespace client {
         cmd.Serialize(allocatedBuffer, *buffer->device->GetClient());
     }
 
-    void ClientBufferDestroy(WGPUBuffer cBuffer) {
+    void ClientHandwrittenBufferDestroy(WGPUBuffer cBuffer) {
         Buffer* buffer = reinterpret_cast<Buffer*>(cBuffer);
 
         // Cancel or remove all mappings
@@ -310,7 +312,8 @@ namespace dawn_wire { namespace client {
         cmd.Serialize(allocatedBuffer, *buffer->device->GetClient());
     }
 
-    WGPUFence ClientQueueCreateFence(WGPUQueue cSelf, WGPUFenceDescriptor const* descriptor) {
+    WGPUFence ClientHandwrittenQueueCreateFence(WGPUQueue cSelf,
+                                                WGPUFenceDescriptor const* descriptor) {
         Queue* queue = reinterpret_cast<Queue*>(cSelf);
         Device* device = queue->device;
 
@@ -333,7 +336,7 @@ namespace dawn_wire { namespace client {
         return cFence;
     }
 
-    void ClientQueueSignal(WGPUQueue cQueue, WGPUFence cFence, uint64_t signalValue) {
+    void ClientHandwrittenQueueSignal(WGPUQueue cQueue, WGPUFence cFence, uint64_t signalValue) {
         Fence* fence = reinterpret_cast<Fence*>(cFence);
         Queue* queue = reinterpret_cast<Queue*>(cQueue);
         if (fence->queue != queue) {
@@ -367,15 +370,15 @@ namespace dawn_wire { namespace client {
     void ClientDeviceRelease(WGPUDevice) {
     }
 
-    void ClientDeviceSetUncapturedErrorCallback(WGPUDevice cSelf,
+    void ClientHandwrittenDeviceSetUncapturedErrorCallback(WGPUDevice cSelf,
-                                                WGPUErrorCallback callback,
+                                                           WGPUErrorCallback callback,
-                                                void* userdata) {
+                                                           void* userdata) {
         Device* device = reinterpret_cast<Device*>(cSelf);
         device->SetUncapturedErrorCallback(callback, userdata);
     }
-    void ClientDeviceSetDeviceLostCallback(WGPUDevice cSelf,
+    void ClientHandwrittenDeviceSetDeviceLostCallback(WGPUDevice cSelf,
-                                           WGPUDeviceLostCallback callback,
+                                                      WGPUDeviceLostCallback callback,
-                                           void* userdata) {
+                                                      void* userdata) {
         Device* device = reinterpret_cast<Device*>(cSelf);
         device->SetDeviceLostCallback(callback, userdata);
     }

src/tests/BUILD.gn

@@ -188,6 +188,7 @@ test("dawn_unittests") {
     "unittests/wire/WireFenceTests.cpp",
     "unittests/wire/WireInjectTextureTests.cpp",
     "unittests/wire/WireMemoryTransferServiceTests.cpp",
+    "unittests/wire/WireMultipleDeviceTests.cpp",
     "unittests/wire/WireOptionalTests.cpp",
     "unittests/wire/WireTest.cpp",
     "unittests/wire/WireTest.h",

src/tests/unittests/wire/WireMultipleDeviceTests.cpp

@@ -0,0 +1,285 @@
+// Copyright 2020 The Dawn Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "tests/unittests/wire/WireTest.h"
+
+#include "common/Assert.h"
+#include "dawn/dawn_proc.h"
+#include "dawn_wire/WireClient.h"
+#include "dawn_wire/WireServer.h"
+#include "tests/MockCallback.h"
+#include "utils/TerribleCommandBuffer.h"
+
+#include <array>
+
+using namespace testing;
+using namespace dawn_wire;
+
+class WireMultipleDeviceTests : public testing::Test {
+  protected:
+    void SetUp() override {
+        DawnProcTable procs = dawn_wire::WireClient::GetProcs();
+        dawnProcSetProcs(&procs);
+    }
+
+    void TearDown() override {
+        dawnProcSetProcs(nullptr);
+    }
+
+    class WireHolder {
+      public:
+        WireHolder() {
+            DawnProcTable mockProcs;
+            mApi.GetProcTableAndDevice(&mockProcs, &mServerDevice);
+
+            // Ignore Tick()
+            EXPECT_CALL(mApi, DeviceTick(_)).Times(AnyNumber());
+
+            // This SetCallback call cannot be ignored because it is done as soon as we start the
+            // server
+            EXPECT_CALL(mApi, OnDeviceSetUncapturedErrorCallback(_, _, _)).Times(Exactly(1));
+            EXPECT_CALL(mApi, OnDeviceSetDeviceLostCallback(_, _, _)).Times(Exactly(1));
+
+            mS2cBuf = std::make_unique<utils::TerribleCommandBuffer>();
+            mC2sBuf = std::make_unique<utils::TerribleCommandBuffer>();
+
+            WireServerDescriptor serverDesc = {};
+            serverDesc.device = mServerDevice;
+            serverDesc.procs = &mockProcs;
+            serverDesc.serializer = mS2cBuf.get();
+
+            mWireServer.reset(new WireServer(serverDesc));
+            mC2sBuf->SetHandler(mWireServer.get());
+
+            WireClientDescriptor clientDesc = {};
+            clientDesc.serializer = mC2sBuf.get();
+
+            mWireClient.reset(new WireClient(clientDesc));
+            mS2cBuf->SetHandler(mWireClient.get());
+
+            mClientDevice = mWireClient->GetDevice();
+        }
+
+        ~WireHolder() {
+            mApi.IgnoreAllReleaseCalls();
+            mWireClient = nullptr;
+            mWireServer = nullptr;
+        }
+
+        void FlushClient(bool success = true) {
+            ASSERT_EQ(mC2sBuf->Flush(), success);
+        }
+
+        void FlushServer(bool success = true) {
+            ASSERT_EQ(mS2cBuf->Flush(), success);
+        }
+
+        testing::StrictMock<MockProcTable>* Api() {
+            return &mApi;
+        }
+
+        WGPUDevice ClientDevice() {
+            return mClientDevice;
+        }
+
+        WGPUDevice ServerDevice() {
+            return mServerDevice;
+        }
+
+      private:
+        testing::StrictMock<MockProcTable> mApi;
+        std::unique_ptr<dawn_wire::WireServer> mWireServer;
+        std::unique_ptr<dawn_wire::WireClient> mWireClient;
+        std::unique_ptr<utils::TerribleCommandBuffer> mS2cBuf;
+        std::unique_ptr<utils::TerribleCommandBuffer> mC2sBuf;
+        WGPUDevice mServerDevice;
+        WGPUDevice mClientDevice;
+    };
+
+    void ExpectInjectedError(WireHolder* wire) {
+        std::string errorMessage;
+        EXPECT_CALL(*wire->Api(),
+                    DeviceInjectError(wire->ServerDevice(), WGPUErrorType_Validation, _))
+            .WillOnce(Invoke([&](WGPUDevice device, WGPUErrorType type, const char* message) {
+                errorMessage = message;
+                // Mock the call to the error callback.
+                wire->Api()->CallDeviceErrorCallback(device, type, message);
+            }));
+        wire->FlushClient();
+
+        // The error callback should be forwarded to the client.
+        StrictMock<MockCallback<WGPUErrorCallback>> mockErrorCallback;
+        wgpuDeviceSetUncapturedErrorCallback(wire->ClientDevice(), mockErrorCallback.Callback(),
+                                             mockErrorCallback.MakeUserdata(this));
+
+        EXPECT_CALL(mockErrorCallback, Call(WGPUErrorType_Validation, StrEq(errorMessage), this))
+            .Times(1);
+        wire->FlushServer();
+    }
+};
+
+// Test that using objects from a different device is a validation error.
+TEST_F(WireMultipleDeviceTests, ValidatesSameDevice) {
+    WireHolder wireA;
+    WireHolder wireB;
+
+    // Create the objects
+    WGPUQueue queueA = wgpuDeviceCreateQueue(wireA.ClientDevice());
+    WGPUQueue queueB = wgpuDeviceCreateQueue(wireB.ClientDevice());
+
+    WGPUFenceDescriptor desc = {};
+    WGPUFence fenceA = wgpuQueueCreateFence(queueA, &desc);
+
+    // Flush on wire B. We should see the queue created.
+    EXPECT_CALL(*wireB.Api(), DeviceCreateQueue(wireB.ServerDevice()))
+        .WillOnce(Return(wireB.Api()->GetNewQueue()));
+    wireB.FlushClient();
+
+    // Signal with a fence from a different wire.
+    wgpuQueueSignal(queueB, fenceA, 1u);
+
+    // We should inject an error into the server.
+    ExpectInjectedError(&wireB);
+}
+
+// Test that objects created from mixed devices are an error to use.
+TEST_F(WireMultipleDeviceTests, DifferentDeviceObjectCreationIsError) {
+    WireHolder wireA;
+    WireHolder wireB;
+
+    // Create a bind group layout on wire A.
+    WGPUBindGroupLayoutDescriptor bglDesc = {};
+    WGPUBindGroupLayout bglA = wgpuDeviceCreateBindGroupLayout(wireA.ClientDevice(), &bglDesc);
+    EXPECT_CALL(*wireA.Api(), DeviceCreateBindGroupLayout(wireA.ServerDevice(), _))
+        .WillOnce(Return(wireA.Api()->GetNewBindGroupLayout()));
+
+    wireA.FlushClient();
+
+    std::array<WGPUBindGroupBinding, 2> bindings;
+
+    // Create a buffer on wire A.
+    WGPUBufferDescriptor bufferDesc = {};
+    bindings[0].buffer = wgpuDeviceCreateBuffer(wireA.ClientDevice(), &bufferDesc);
+    EXPECT_CALL(*wireA.Api(), DeviceCreateBuffer(wireA.ServerDevice(), _))
+        .WillOnce(Return(wireA.Api()->GetNewBuffer()));
+
+    wireA.FlushClient();
+
+    // Create a sampler on wire B.
+    WGPUSamplerDescriptor samplerDesc = {};
+    bindings[1].sampler = wgpuDeviceCreateSampler(wireB.ClientDevice(), &samplerDesc);
+    EXPECT_CALL(*wireB.Api(), DeviceCreateSampler(wireB.ServerDevice(), _))
+        .WillOnce(Return(wireB.Api()->GetNewSampler()));
+
+    wireB.FlushClient();
+
+    // Create a bind group on wire A using the bgl (A), buffer (A), and sampler (B).
+    WGPUBindGroupDescriptor bgDesc = {};
+    bgDesc.layout = bglA;
+    bgDesc.bindingCount = bindings.size();
+    bgDesc.bindings = bindings.data();
+    WGPUBindGroup bindGroupA = wgpuDeviceCreateBindGroup(wireA.ClientDevice(), &bgDesc);
+
+    // It should inject an error because the sampler is from a different device.
+    ExpectInjectedError(&wireA);
+
+    // The bind group was never created on a server because it failed device validation.
+    // Any commands that use it should error.
+    wgpuBindGroupRelease(bindGroupA);
+    wireA.FlushClient(false);
+}
+
+// Test that using objects, included in an extension struct,
+// from a difference device is a validation error.
+TEST_F(WireMultipleDeviceTests, ValidatesSameDeviceInExtensionStruct) {
+    WireHolder wireA;
+    WireHolder wireB;
+
+    WGPUShaderModuleDescriptor shaderModuleDesc = {};
+    WGPUShaderModule shaderModuleA =
+        wgpuDeviceCreateShaderModule(wireA.ClientDevice(), &shaderModuleDesc);
+
+    // Flush on wire A. We should see the shader module created.
+    EXPECT_CALL(*wireA.Api(), DeviceCreateShaderModule(wireA.ServerDevice(), _))
+        .WillOnce(Return(wireA.Api()->GetNewShaderModule()));
+    wireA.FlushClient();
+
+    WGPURenderPipelineDescriptorDummyExtension extDesc = {};
+    extDesc.chain.sType = WGPUSType_RenderPipelineDescriptorDummyExtension;
+    extDesc.dummyStage.entryPoint = "main";
+    extDesc.dummyStage.module = shaderModuleA;
+
+    WGPURenderPipelineDescriptor pipelineDesc = {};
+    pipelineDesc.nextInChain = &extDesc.chain;
+    WGPURenderPipeline pipelineB =
+        wgpuDeviceCreateRenderPipeline(wireB.ClientDevice(), &pipelineDesc);
+
+    // We should inject an error into the server.
+    ExpectInjectedError(&wireB);
+
+    // The pipeline was never created on a server because it failed device validation.
+    // Any commands that use it should error.
+    wgpuRenderPipelineRelease(pipelineB);
+    wireB.FlushClient(false);
+}
+
+// Test that using objects, included in a chained extension struct,
+// from a different device is a validation error.
+TEST_F(WireMultipleDeviceTests, ValidatesSameDeviceSecondInExtensionStructChain) {
+    WireHolder wireA;
+    WireHolder wireB;
+
+    WGPUShaderModuleDescriptor shaderModuleDesc = {};
+    WGPUShaderModule shaderModuleA =
+        wgpuDeviceCreateShaderModule(wireA.ClientDevice(), &shaderModuleDesc);
+
+    // Flush on wire A. We should see the shader module created.
+    EXPECT_CALL(*wireA.Api(), DeviceCreateShaderModule(wireA.ServerDevice(), _))
+        .WillOnce(Return(wireA.Api()->GetNewShaderModule()));
+    wireA.FlushClient();
+
+    WGPUShaderModule shaderModuleB =
+        wgpuDeviceCreateShaderModule(wireB.ClientDevice(), &shaderModuleDesc);
+
+    // Flush on wire B. We should see the shader module created.
+    EXPECT_CALL(*wireB.Api(), DeviceCreateShaderModule(wireB.ServerDevice(), _))
+        .WillOnce(Return(wireB.Api()->GetNewShaderModule()));
+    wireB.FlushClient();
+
+    WGPURenderPipelineDescriptorDummyExtension extDescA = {};
+    extDescA.chain.sType = WGPUSType_RenderPipelineDescriptorDummyExtension;
+    extDescA.dummyStage.entryPoint = "main";
+    extDescA.dummyStage.module = shaderModuleA;
+
+    WGPURenderPipelineDescriptorDummyExtension extDescB = {};
+    extDescB.chain.sType = WGPUSType_RenderPipelineDescriptorDummyExtension;
+    extDescB.chain.next = &extDescA.chain;
+    extDescB.dummyStage.entryPoint = "main";
+    extDescB.dummyStage.module = shaderModuleB;
+
+    // The first extension struct is from Device B, and the second is from A.
+    // We should validate the second struct, is from the same device.
+    WGPURenderPipelineDescriptor pipelineDesc = {};
+    pipelineDesc.nextInChain = &extDescB.chain;
+    WGPURenderPipeline pipelineB =
+        wgpuDeviceCreateRenderPipeline(wireB.ClientDevice(), &pipelineDesc);
+
+    // We should inject an error into the server.
+    ExpectInjectedError(&wireB);
+
+    // The pipeline was never created on a server because it failed device validation.
+    // Any commands that use it should error.
+    wgpuRenderPipelineRelease(pipelineB);
+    wireB.FlushClient(false);
+}