Nicolas GonzalezandClaude Opus 5.5 7bbbf70eda fix(agc): bind a present V# beyond the storage buffer range to its own placeholder ...

A present V# whose size exceeds maxStorageBufferRange and whose base is not
registered was bound to the same 16-byte placeholder as a null V#. Its
guest checks pass, so a store through it could write that placeholder,
and a later scalar read through a null V# (which now relies on the length
check alone) would return the stored word instead of 0. Bind such a V# to
a separate placeholder, so the zeroed one is only bound for V#s the guest
checks treat as not present and no store reaches it.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-11-03 11:15:20 -03:00

..

include

fix(agc): bind a present V# beyond the storage buffer range to its own placeholder

2026-11-03 11:15:20 -03:00

shaders

Merge pull request #6905 from parl0v/perf/detile-word-copies

2026-11-03 21:09:15 +13:00

src

fix(agc): bind a present V# beyond the storage buffer range to its own placeholder

2026-11-03 11:15:20 -03:00