EnzymeAD / EnzymeAD/Enzyme

Enzyme miscompiles nested branch with outer: uninitialized taped predicate causes inactive path to execute

Open
#2,629 1 comment 1 reaction 2 assignees Claimed by @minansys View on GitHub
Dominant language
LLVM
Stars
1.7k
Forks
188
Avg merge
1d 22h
Merged PRs (30d)
26

Description

@wsmoses

In this code

https://fwd.gymni.ch/rn0wMS

When fan = false, or true, it runs fine. When bool fan = (argc > 1) ? true : false; it will crash

Moreover, when fan = false, the result is wrong as well.

Here is the investigation from chatgpt and a PR proposed by chatgpt

https://github.com/EnzymeAD/Enzyme/pull/2713

```Enzyme miscompiles nested branch with outer enzyme_const guard: uninitialized taped predicate causes fan=false path to execute inner-block (can segfault)

Summary

When differentiating a function that has:

an outer branch guarded by a runtime bool fan passed as enzyme_const, and

an inner branch guarded by an active predicate (e.g. radius > 0 where radius depends on differentiable inputs),

Enzyme sometimes generates IR that branches on an uninitialized (undef) taped predicate when fan == false. This can make the reverse/adjoint execute code that should be unreachable, leading to a crash (e.g., a nullptr dereference) or silent misbehavior.

Commenting out the inner if (radius > 0) (or replacing it with a non-branching normalization) avoids the issue.

Expected behavior

If fan == false, the if (fan) { ... } region should not execute in either primal or the differentiated code. No inner work, no loads/stores dependent on that region, no crash.

Actual behavior

With Enzyme autodiff enabled, running with fan == false sometimes triggers execution of code inside the if (fan) region, as if the inner predicate branch is taken despite fan being false. This can crash (e.g. nullptr deref) or produce incorrect behavior.

```

The simplified code is
https://tinyurl.com/29wt64bo

when fan is false, the kernel function is really only *out = fvec[0] + fvec[1] + fvec[2]; therefore dfvec should be {1, 1, 1} instea d of dfvec = {0, 0, 0}. The code runs fine in O3 but not in O1 and O0 @wsmoses

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.