Skip to content

Enzyme miscompiles nested branch with outer: uninitialized taped predicate causes inactive path to execute #2629

@minansys

Description

@minansys

@wsmoses

In this code

https://fwd.gymni.ch/rn0wMS

When fan = false, or true, it runs fine. When bool fan = (argc > 1) ? true : false; it will crash

Moreover, when fan = false, the result is wrong as well.

Here is the investigation from chatgpt and a PR proposed by chatgpt

#2713


Summary

When differentiating a function that has:

an outer branch guarded by a runtime bool fan passed as enzyme_const, and

an inner branch guarded by an active predicate (e.g. radius > 0 where radius depends on differentiable inputs),

Enzyme sometimes generates IR that branches on an uninitialized (undef) taped predicate when fan == false. This can make the reverse/adjoint execute code that should be unreachable, leading to a crash (e.g., a nullptr dereference) or silent misbehavior.

Commenting out the inner if (radius > 0) (or replacing it with a non-branching normalization) avoids the issue.

Expected behavior

If fan == false, the if (fan) { ... } region should not execute in either primal or the differentiated code. No inner work, no loads/stores dependent on that region, no crash.

Actual behavior

With Enzyme autodiff enabled, running with fan == false sometimes triggers execution of code inside the if (fan) region, as if the inner predicate branch is taken despite fan being false. This can crash (e.g. nullptr deref) or produce incorrect behavior.

The simplified code is
https://tinyurl.com/29wt64bo

when fan is false, the kernel function is really only *out = fvec[0] + fvec[1] + fvec[2]; therefore dfvec should be {1, 1, 1} instea d of dfvec = {0, 0, 0}. The code runs fine in O3 but not in O1 and O0 @wsmoses

Metadata

Metadata

Labels

No labels
No labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions