Skip to content

Fix hang/write-back drop for inout structs bitcast - #8821

Open
Vlad Korytsko (vkorytsko) wants to merge 5 commits into
microsoft:mainfrom
vkorytsko:inout-struct-cast-fix
Open

Fix hang/write-back drop for inout structs bitcast#8821
Vlad Korytsko (vkorytsko) wants to merge 5 commits into
microsoft:mainfrom
vkorytsko:inout-struct-cast-fix

Conversation

@vkorytsko

Copy link
Copy Markdown

Fix two SROA bugs casting between struct types in inout arguments

Both come from the same place: passing a struct to an inout parameter of a different struct type makes CodeGen coerce the argument with a pointer bitcast. SROA_Helper::RewriteBitCast has to handle that cast, and whether the two layouts are isLayoutIdentical decides which bug you hit.

1. inout write-back dropped on an identical layout

SROA_Parameter_HLSL ran a pre-pass that replaced the bitcast with a one-way copy into fresh storage; the callee wrote into the copy and nothing copied back. The fix is to delete obsolete prepass (#1718) and rely on correct aliasing-preserving rewrite (#2745).

2. hang on a layout mismatch

RewriteBitCast can redirect the cast in three cases: the destination is reachable through the source's leading elements, the layouts are identical, or the cast is unused. Otherwise the fall-through returned with the bitcast still using the value being replaced. That breaks the invariant RewriteForScalarRepl drives on - every user must be erased or stop using the value - so it spins forever (asserts in Debug in both RewriteBitCast type mismatch check and RewriteForScalarRepl infinite loop guard).

New isSafeBitCastForScalarRepl mirrors the three shapes the rewrite supports, so analysis and rewrite agree on what is handleable. Anything else keeps the alloca whole, which preserves the bitcast and the inout copy-out. For values that check does not cover the dead end becomes a diagnostic that also drops the use (static global variable).

Note: this is the first error emission in this module, however I'm not sure how to gracefully handle static global case.


Did not find any open issues related to this fixes. #4614 reports hang in the same pass, but from an empty base struct, and is not fixed here. #1718 and #2745 were revalidated, additional test cases were added.

…ructs

Casting a struct to an identical-layout struct in an inout argument
makes CodeGen coerce it with a pointer bitcast. SROA_Parameter_HLSL
replaced that bitcast with a one-way copy into a fresh alloca, so every
write the callee made was silently discarded.

That copy prepass was introduced in microsoft#1718 to fix a crash. microsoft#2745 later
taught RewriteBitCast to replace the cast with its operand, keeping the
aliasing copy-out needs. The prepass ran first and broke it.

Redundant prepass removed.
Passing a struct to an inout parameter of a different-layout struct
makes CodeGen coerce it with a pointer bitcast. RewriteBitCast has no
rewrite for such a pair and returned with the bitcast still using the
value being replaced, so RewriteForScalarRepl spun on a use it could
not eliminate. microsoft#2745 fixed identical-layouts, not these.

Keep such an alloca out of scalar replacement, leaving the inout
copy-out intact, and diagnose what cannot be (like a static global).
Copilot AI balanced review requested due to automatic review settings August 23, 2026 21:29
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes SROA hangs and lost write-backs for inout arguments cast between struct types.

Changes:

  • Adds bitcast safety analysis and fallback diagnostics.
  • Removes obsolete identical-layout preprocessing.
  • Adds HLSL 2018/2021 regression coverage.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
lib/Transforms/Scalar/ScalarReplAggregatesHLSL.cpp Updates SROA bitcast analysis and rewriting.
tools/clang/test/HLSLFileCheck/hlsl/types/cast/similar_layout_structs/cast_as_func_inout_param.hlsl Tests mismatched layouts under HLSL 2018.
tools/clang/test/HLSLFileCheck/hlsl/types/cast/similar_layout_structs/cast_as_func_inout_param-strictudt.hlsl Tests mismatched layouts under HLSL 2021.
tools/clang/test/HLSLFileCheck/hlsl/types/cast/identical_layout_structs/cast_as_func_inout_param.hlsl Tests write-back for identical layouts under HLSL 2018.
tools/clang/test/HLSLFileCheck/hlsl/types/cast/identical_layout_structs/cast_as_func_inout_param-strictudt.hlsl Tests write-back for identical layouts under HLSL 2021.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment on lines +2725 to +2728
dxilutil::EmitErrorOnInstruction(
BCI, "Unsupported cast between struct types with different layouts.");
BCI->replaceAllUsesWith(UndefValue::get(BCI->getType()));
BCI->eraseFromParent();

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Leaving an unsafe global unsplit doesn't work because nothing downstream lowers an aggregate global.
So I'm lowering bitcast-incompatible static globals in LowerStaticGlobalIntoAlloca pass, where the cast and the copy-out reading through it are already handled correctly. The diagnostic remains only for a global that can't be localized.

Comment on lines 1583 to +1585
if (BitCastInst *BC = dyn_cast<BitCastInst>(User)) {
if (!isSafeBitCastForScalarRepl(BC))
return MarkUnsafe(Info, User);

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added

@vkorytsko

Copy link
Copy Markdown
Author

@microsoft-github-policy-service agree

@damyanp

Copy link
Copy Markdown
Member

/azp run

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).

Globals never run through isSafeForScalarRepl, which casts every user
to an Instruction, while a global's users are commonly constant
expressions, so such a global reached RewriteBitCast and was diagnosed
rather than compiled.

Lower it into an alloca instead, where the cast and the copy-out
reading through it are already handled. isSafeBitCastForScalarRepl now
takes an operator to cover the constant expression form of the cast.

A global used outside an entry function is still diagnosed.
Copilot AI review requested due to automatic review settings August 29, 2026 16:52

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

ST = dyn_cast<StructType>(EltTy);
}

return SrcST->isLayoutIdentical(DstST);

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed traversal in RewriteBitCast, corresponding tests added.

isSafeBitCastForScalarRepl stops its leading element walk at a struct
with no elements, but the traversal in RewriteBitCast did not, and
called getElementType(0) on it. A cast between two layout-identical
structs whose leading members bottom out in an empty struct passes the
predicate and then asserts.

Guard the loop the same way. The empty chain now falls through to the
identical-layout case, which is the correct rewrite for these types.
Copilot AI review requested due to automatic review settings August 29, 2026 19:30

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

@vkorytsko

Copy link
Copy Markdown
Author

btw, #4614 was accidentally fixed here by 839b33c - it is safely excluded from scalar repl in isSafeBitCastForScalarRepl and never reaches broken struct traversal in RewriteBitCast. Although this issue was not targeted by this PR, it should now be reliably fixed, especially with the latest changes from 1009711 (struct traversal fix in RewriteBitCast).
Do I need to add proper tests for this issue and mention it in the ReleaseNotes?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: New

Development

Successfully merging this pull request may close these issues.

3 participants