winemetal: validate render draw state before encoding

[moreaki]

Problem

The winemetal render encoder can currently reach Metal draw calls after earlier state setup failed or when indexed draw buffers/ranges are invalid.

On macOS/Arm this matters while working on the DXMT path because shader or pipeline creation failures can leave the command stream without a valid render pipeline state. Sending such commands to Metal turns a recoverable guest rendering problem into an Objective-C Metal validation exception and VM process crash. Invalid indexed draw buffer state has the same shape: the encoder should reject the draw before calling into Metal.

Proposed fix

Add defensive validation at the winemetal render command boundary:

• track whether the encoder currently has a valid render pipeline state
• skip draw calls when no valid pipeline state is active
• validate indexed draw index buffer presence, type, offset, count, and total range
• validate indirect indexed draw argument buffer offset and size before encoding

Validation

• git diff --check passed.
• This patch was cherry-picked on top of DXMT: fix the supported LLVM 15 build #748 and kmk VBoxDxMt completed successfully on macOS/Arm with LLVM 15.0.7.

Signed-off-by: Roberto Nibali rnibali@gmail.com

[moreaki]

Re-audit result: withdrawing this report. The proposed guards were not tied to a standalone VirtualBox reproduction and do not cover all render command variants. They also omit some alignment/range cases and can turn failures into repeated logging rather than establish a correct recovery contract. A future report should start from a concrete crashing command stream and add the narrow validation at the responsible API boundary.