Skip to content

Fix SkipStages narrowing loaded by Select condition#9152

Open
abadams wants to merge 1 commit into
mainfrom
abadams/llvm_use_after_free
Open

Fix SkipStages narrowing loaded by Select condition#9152
abadams wants to merge 1 commit into
mainfrom
abadams/llvm_use_after_free

Conversation

@abadams
Copy link
Copy Markdown
Member

@abadams abadams commented May 25, 2026

#9147 contained a bug: It treated Select like an if-then-else and combined the used and loaded flags in the same way. A select evaluates both sides, so the two flags need to be handled differently. This PR fixes it and adds a regression test. This is the cause of the recent failures in truncated_pyramid test - it has a Func which is loaded but not used.

SkipStages::visit(Select) was combining each branch's `loaded` predicate
with the select condition (via make_select / make_and). That's wrong:
Halide's Select evaluates both branches and only picks one of the
results, so any load inside either branch fires unconditionally. The
`loaded` predicate must be the OR of both branches, ungated by the
condition.

The bug caused allocation bounds inference to size affected buffers down
to zero whenever the runtime condition was false, while the generated
code still emitted a vectorized load from them -- a heap OOB read that
showed up intermittently as a valgrind use-after-free on the
truncated_pyramid test.

Keep `used` gated by the condition as before (with the same select/and
collapse that fixed the exponential blow-up in #9147).

Add a regression test in skip_stages.cpp that records the minimum
producer allocation size through a custom malloc handler and verifies
it's non-zero when the producer's only consumer is inside a
runtime-false select branch.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@codecov
Copy link
Copy Markdown

codecov Bot commented May 26, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@642087f). Learn more about missing BASE report.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #9152   +/-   ##
=======================================
  Coverage        ?   69.35%           
=======================================
  Files           ?      254           
  Lines           ?    78219           
  Branches        ?    18714           
=======================================
  Hits            ?    54248           
  Misses          ?    18481           
  Partials        ?     5490           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant