Repository navigation
fix(shader): reject temporary owners for borrowed memory regions - #8495
Conversation
|
Other open pull requests touch the same code. Merging one will break the other, or both implement the same thing. If this one builds on them, list them in Depends on.
Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.
|
|
Updated at Native macOS request-serializer tests pass with ASan and UBSan. Matched main/candidate software-GPU runs each pass 11 common CTests plus exact RGBA byte readback, including flip and teardown. Both skip the same two 32-lane-only color cases; skips are excluded from the pass count. Khronos validation is loaded and the existing pNext VUID is identical to main, with no new VUIDs. No wire-format, shader semantics or AOT changes. Marking ready for review; full Linux/Windows CI still needs maintainer dispatch. |
|
Checked the deleted rvalue-range constructor against copy/move and the named-owner, array, span, pointer/count and empty-assignment paths; no remaining temporary-owner assignments in the tree; the compile-time assertions in |
What
request.context.memory = memory.Regions()currently compiles, but the returned vector dies at the semicolon and leaves the request's span dangling. #7759, now merged, fixes the 21 existing call sites. This change makes direct assignment from a temporary owning range a compile error, so that pattern cannot be reintroduced silently.MemoryRegionViewkeeps the existing const-span interface and deletes conversion from non-borrowed rvalue contiguous ranges. Named mutable/const vectors and arrays, existing spans, pointer/count pairs, empty views and request copies remain supported. The conversion from a span stays constexpr/noexcept; tests pin size, alignment and trivial copyability. The view adds no ownership or allocation.The existing request serializer test now checks these compile-time acceptance/rejection rules, pointer identity, observing changes to the live owner, copying a request and serializing/replaying its memory. Removing only the deleted constructor makes the negative assertions fail.
The view does not make arbitrary lifetime errors impossible. A named owner can still die too early, and a preconstructed span or raw pointer can already refer to dead storage. The region array and all byte storage must outlive their consumers; the debt entry records that limit. Shader instruction semantics and the request wire format are unchanged.
#7759 is merged upstream and is retained with its authorship. There is no remaining landing dependency. The API guard changes
Recompiler.hpp, the existing request serializer test and the shader debt entry. No ARM64 AOT branch or feature is part of this change.Overlap check: #6970 has an independent change at the same include-list location in
Recompiler.hpp; both includes must be retained if it lands first. Several stale branches share files and could not be compared automatically. No other temporary-owner API guard was found.Tested
Head
13b1892fddb844e229c7903df7cff2679fed3661on main513ca7e5585edd6e84b47e61328729588a7afe9d.request_serializerCTest passes with ASan and UBSan. The earlier use-after-free and deleted-constructor negative controls remain historical evidence.Matched main/candidate runs use Ubuntu 24.04 x86-64, GCC 13.3 cross compiler hosted on ARM64, QEMU 10.2.3, SPIRV-Tools, Mesa 25.2.8 llvmpipe / LLVM 20.1.2. Vulkan is required, shader cache is disabled and
VK_LAYER_KHRONOS_validationis requested; loader diagnostics confirm the layer is inserted. All runs have the same baselineVUID-VkDeviceCreateInfo-pNext-pNextfor structure type 1000574000 from layer 1.3.275: no new VUIDs, not zero validation errors. Write watching is unavailable and the existing byte-comparison fallback is used.Whitespace and conventions checks pass. Published commits and maintainer changes are preserved; integration was checked conflict-free against main
de4be245b8f0bb941dd8b10cb4c700f9d564ecb9. Full upstream Linux/Windows CI requires maintainer dispatch. No console, title-unblock or native Windows runtime claim. No physical-GPU or title run of this head.Checklist
main; no other open PR implements the same functionsNotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file.mdfiles or images added to the repository (attach them to this PR)