Fix crash when scalarizing OOB access - #8942
Chris B (llvm-beanz) wants to merge 6 commits into
Conversation
The SROA HLSL pass misses checking that a GEP index is inbounds, which can cause an OOB memory access. This is not the complete fix for microsoft#8940, but it addresses the optimizer crash.
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Out-of-bounds accesses to scalarized internal globals can still trigger the same crash.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
What changed in this PR
Adds vector-index bounds validation to prevent SROA crashes.
Changes:
- Rejects out-of-range constant vector indices during local-allocation scalarization.
- Adds regression coverage for valid, negative, nested, and oversized indices.
- Documents the optimizer crash fix.
| File | Description |
|---|---|
lib/Transforms/Scalar/ScalarReplAggregatesHLSL.cpp |
Validates constant vector indices. |
tools/clang/test/DXC/Passes/ScalarReplHLSL/vector-index-bounds.ll |
Adds regression tests. |
docs/ReleaseNotes.md |
Records the bug fix. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The bounds validation can still accept negative indices, risking miscompilation or out-of-bounds failure.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Critical and moderate index-validation defects must be fixed before approval.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (1)
Resolved since last review (1)
| if (GEPIt->isVectorTy() && IdxVal && !isValidVectorIndex(IdxVal, arraySize)) | ||
| return MarkUnsafe(Info, GEPI); |
The SROA HLSL pass misses checking that a GEP index is inbounds, which can cause an OOB memory access.
This is not the complete fix for #8940, but it addresses the optimizer crash.
Assisted-by: GitHub Copilot