[WebGPU] Validate MatMul execution plans in planner

[Jiajia Qin (qjia7)]

Description

• Change MatMulExecutionPlanner::CreateExecutionPlan to return Status and publish its output plan only after validation succeeds.
• Validate algorithm/configuration compatibility, host-known algorithm prerequisites, packed tuning, subgroup size agreement, and overflow-safe packed/Split-K dispatch arithmetic in the planner.
• Remove duplicated prerequisite reconstruction and validation from MatMulComputeDispatcher.
• Add contract tests for unsupported forced requests, unchanged output on failure, invalid vendor configurations, and dispatch overflow.
• Update the WebGPU MatMul planner design documentation.

Motivation and Context

Follow-up to #32630. A successful CreateExecutionPlan should mean that the returned plan is executable for all prerequisites already known to the host. Previously the planner returned an unchecked proposal and the dispatcher reconstructed the same prerequisite facts to validate it, which weakened the plan contract and allowed the two paths to drift.

Forced test selections still bypass performance heuristics, but unsupported requests now fail in plan creation without silently falling back.

Testing

• Static Vulkan onnxruntime_provider_test build
• 41 planner, configuration, and execution-plan validation tests passed
• 22 hardware-backed forced MatMul, FP32 accumulation, Split-K, dynamic reselection, and pointwise Conv tests passed
• WebGPU plugin library target built successfully

The full local plugin onnxruntime_provider_test link remains blocked by an existing MSVC C4744 Abseil/GoogleTest signedness warning promoted to C2220, followed by LNK1257; no changed planner source failed compilation.

[github-actions]

You can commit the suggested changes from lintrunner.

[Copilot]

🟡 Changes recommended

Packed plans can still succeed with dimensions that fail their required uint32_t conversions during execution.

1 open finding

• Validate all shader dimensions before creating a matmul plan · New

What changed in this PR

Moves WebGPU MatMul plan validation into the execution planner so successful plans are host-validated before dispatch.

Changes:

• Makes plan creation status-returning and failure-atomic.
• Centralizes prerequisite, configuration, and dispatch validation.
• Adds planner contract tests and updates design documentation.

File	Description
matmul.cc	Consumes validated plans from the planner.
matmul_execution_planner.h	Defines the new status-returning planner contract.
matmul_execution_planner.cc	Implements centralized plan validation.
matmul_execution_planner_test.cc	Tests validation failures and overflow handling.
webgpu_matmul_execution_planner.md	Documents planner-owned validation.

🧠 Review effort: Balanced

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Combined dispatch-count overflow remains unvalidated, allowing accepted plans to fail during program normalization.

0 open findings

1 resolved since last review

• Validate all shader dimensions before creating a matmul plan

Previously missed (1)

In code that hasn't changed since last review

Validate combined workgroup count before dispatch

onnxruntime/​core/​providers/​webgpu/​math/​matmul_execution_planner.cc:228

The planner checks each logical dispatch dimension independently, but it never checks their combined workgroup count. ProgramManager::NormalizeDispatchGroupSize rejects x * y * z > UINT32_MAX because logical workgroup IDs are flattened into a u32 (program_manager.cc:36-39), so dimensions such as packed_m == n == UINT32_MAX pass plan creation and then fail in RunProgram. Compute all three group counts here and validate their overflow-safe product; for Split-K, repeat the product check after replacing Z with batch * splits_per_batch, and add combined-dimension coverage.

🧠 Review effort: Balanced

[Xiaofei Han (xiaofeihan1)]

Re-reviewed cfc378e against the merge base. The combined packed/Split-K dispatch checks and Naive/GEMV conversion checks address my previous comments. The added subgroup validation also matches execution's shared batch-folding and per-thread tuning decisions. Failure-atomic plan publication and existing selection/failure behavior are preserved. No further actionable code findings.

This approval is based on source/test review and the successful relevant WebGPU CI checks, not a local test run. Remaining failed checks are in environment setup (Rust setup, Java networking, and Android apt locking); approval does not mean all CI checks are green.