spcl / spcl/dace

Codegen: potential integer overflow in map's loop bounds

Open
#1,191 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
593
Forks
163
Avg merge
2d 23h
Merged PRs (30d)
60

Description

DaCe generates the following loop patterns for mapped tasklets, which is prone to integer overflow:
```c++
inline void dace_fun(dace_fun_t *__state, long long upper_bound) {
{
{
for (auto i = 0; i < upper_bound; i += 1) {
{
// Tasklet...
}
}
}
}
}
```
Note that the type of `i` is going to be inferred as `int` from `0` (https://coliru.stacked-crooked.com/a/4757b8050a279eb2), which is a 32-bit signed type on most platforms and will overflow at 2G elements, which is a very realistic domain size on today's systems. The overflow can easily lead to an infinite loop.

It would be safer to use the largest type necessary (https://coliru.stacked-crooked.com/a/daad3170fe2e3b28):
```c++
inline void dace_fun(dace_fun_t *__state, long long upper_bound) {
{
{
using LowerT = std::decay_t;
using UpperT = std::decay_t;
using StepT = std::decay_t;
using WidthT = std::common_type_t;
constexpr bool needSign = std::is_signed_v || std::is_signed_v || std::is_signed_v;
using LoopVarT = std::conditional_t, WidthT>;
for (auto i = LoopVarT(0); i < LoopVarT(upper_bound); i += LoopVarT(1)) {
{
// Tasklet...
}
}
}
}
}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.