Repository navigation
Fix output-position stream bounds in DXIL validation - #9090
Open
Damyan Pepper (damyanp) wants to merge 1 commit into
Open
Damyan Pepper (damyanp) wants to merge 1 commit into
Damyan Pepper (damyanp) wants to merge 1 commit into
Conversation
Reuse the bounded stream index for output-position tracking and check stream bounds before accessing the output-position mask. Add raw-bitcode regression coverage for stream limits and position completeness. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Damyan Pepper (damyanp)
force-pushed
the
damyanp-output-stream-validation-fix
branch
from
November 3, 2026 17:26
3d3b395 to
eaf6826
Compare
Damyan Pepper (damyanp)
marked this pull request as ready for review
November 3, 2026 18:15
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues are recorded for the DXIL validation fix addressing invalid output-stream metadata.
No open issues 🎉
What changed in this PR
This PR fixes out-of-bounds accesses in DXIL validation when output-position signatures contain invalid stream metadata.
Changes:
- Bounds-checks stream indices before updating position masks and uses the validated stream index for position tracking.
- Adds regression tests for valid and invalid geometry/vertex shader streams and incomplete position writes.
- Documents the validator fix in the release notes.
| File | Description |
|---|---|
| tools/clang/unittests/HLSL/ValidationTest.cpp | Adds raw-bitcode tests for stream bounds and position-write validation. |
| lib/DxilValidation/DxilValidation.cpp | Prevents out-of-bounds access in output-position tracking. |
| docs/ReleaseNotes.md | Records the invalid output-stream metadata fix. |
Review effort: Balanced
Ashley Coleman (V-FEXrt)
approved these changes
Nov 3, 2026
Comment on lines
+161
to
164
| if (IsOutput && SE.GetSemantic()->GetKind() == DXIL::SemanticKind::Position && | ||
| SE.GetOutputStream() < DXIL::kNumOutputStreams) { | ||
| Status.OutputPositionMask[SE.GetOutputStream()] |= 1 << Col; | ||
| } |
Collaborator
There was a problem hiding this comment.
Suggested change
| if (IsOutput && SE.GetSemantic()->GetKind() == DXIL::SemanticKind::Position && | |
| SE.GetOutputStream() < DXIL::kNumOutputStreams) { | |
| Status.OutputPositionMask[SE.GetOutputStream()] |= 1 << Col; | |
| } | |
| if (IsOutput && SE.GetSemantic()->GetKind() == DXIL::SemanticKind::Position && | |
| SE.GetOutputStream() < DXIL::kNumOutputStreams) | |
| Status.OutputPositionMask[SE.GetOutputStream()] |= 1 << Col; |
Comment on lines
6286
to
6288
| if (IsOutput && SemanticKind == DXIL::SemanticKind::Position) { | ||
| Status.hasOutputPosition[E->GetOutputStream()] = true; | ||
| Status.hasOutputPosition[StreamId] = true; | ||
| } |
Collaborator
There was a problem hiding this comment.
Are you sure this is semantically the same? StreamId gets cleared to 0 for several things (like !IsOutput) and it seem like maybe we could be slightly changing functionality here?
Also the extra {} should be removed
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Assisted by GitHub Copilot.