[SM6.9][SER] inout dx::HitObject parameter reaches the DXIL intrinsic as undef #9062

Description

Passing a dx::HitObject as an inout parameter loses the caller's value. The callee sees undef and validation fails. in works, and inout also works with -Od or -disable-lifetime-markers. Lifetime markers are on by default from SM 6.6, so this affects normal SM 6.9 compiles.

Steps to Reproduce

RWBuffer<uint> o : register(u0);

void F(inout dx::HitObject h) { o[0] = h.IsMiss(); }

[shader("raygeneration")]
void main() {
  RayDesc r;
  dx::HitObject h = dx::HitObject::MakeMiss(0, 0, r);
  F(h);
}

dxc -T lib_6_9 hitobject_inout.hlsl

Compiles cleanly with any of: -Od, -disable-lifetime-markers, or inout changed to in.

Actual Behavior

error: validation errors
hitobject_inout.hlsl:3:40: error: HitObject is undef.
note: at '%2 = call i1 @dx.op.hitObject_StateScalar.i1(i32 269, %dx.types.HitObject undef)' in block '#0' of function '?main@@YAXXZ'.
Validation failed.

Expected Behavior

h.IsMiss() reads the hit object created by MakeMiss.

Environment

• DXC 1.9.2609.5 (01b62ad47), also reproduced on 1.9.2602.24
• Windows 10 Home 64-bit, build 19045

Additional context

The copy-in and copy-back code in CGHLSLMS.cpp disagree on whether HitObject is an object:

• Copy-in (:6201) checks IsByValueObject, treats HitObject as a value, and emits the copy.
• Copy-back (:6495) checks only dxilutil::IsHLSLObjectType, treats it as an object, and falls through to tmpArgAddr->replaceAllUsesWith(argLV.getAddress()) at :6540.

The lifetime.start emitted at :6408 is one of the rewritten uses, so it moves onto the caller's alloca after MakeMiss has stored to it. mem2reg treats it as a def and the value becomes undef. The lifetime.end at :6549 is created after the RAUW and stays on the unused temporary.

This looks like a regression from #7767 (8872029ef), which introduced IsByValueObject but didn't update the copy-back check.

Test coverage note: hitobject-byval.hlsl and hitobject-array-byval.hlsl say inout behaves like the other modifiers, but neither tests it. Adding an inout RUN line wouldn't catch this anyway, because none of the callees read their parameter. A test with a reading callee will be attached as hitobject-inout-byval.hlsl; only its inout RUN line fails today.