Fix OOB in subscript indexing of col-major matrix in cbuffer

[tex3d]

A bug in HLOperationLower code that lowers the matrix subscript operation when the matrix is in a cbuffer could cause out-of-bounds alloca indexing.

The indexing creates an alloca to store a column-vector loaded from one cbuffer vector. This should have one element per row of the matrix, so it can then index along that dimension using the local array.

The bug was using the number of columns when sizing the alloca instead of the number of rows. This caused it to write to out-of-bounds index when the number of rows exceeded the number of columns (like for float3x2).

Fixes #7865.

[bogner]

The fix is obviously good.

Not sure if its worth spending the time, but we might be able to reduce the test case a bit to make it clearer what exactly we're testing.

[bob80905]

LGTM, but echoing Justin, if it can be made more concise that would be great too.

[damyanp]

#8131 might have a test case we can use for this :)

[damyanp]

/azp run

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[tex3d]

#8131 might have a test case we can use for this :)

This is already as minimal (if not more) than that example. A more custom IR, rather than one originally generated from HLSL, could potentially be a bit smaller, but it'll be a bit more work to craft and rewrite the checks.

Since it's an IR test for dxilgen, it has to start with High Level (HL) IR and check the output immediately after the dxilgen pass, making sure each component is linked to the right operation, before later passes clean up intermediates with scalarize and so on. Unfortunately, the IR looks ugly initially after dxilgen due to extra packing/unpacking vectors when translating vector HL ops to scalar DXIL ops and keeping intermediate vectors for connecting code and later cleanup, so the checks are either going to be ugly, or much more minimal in what they verify.

It could simply check for the alloca [3 x float], since the bug would have caused it to be alloca [2 x float], but that doesn't check that the right components got hooked up to the right destinations.