Skip to content

[WIP] Fix integer-divide overflow in JIT strength reduction - #134502

Draft
jakobbotsch with Copilot wants to merge 6 commits into
mainfrom
copilot/fix-jit-bug-in-gcd
Draft

jakobbotsch with Copilot wants to merge 6 commits into
mainfrom
copilot/fix-jit-bug-in-gcd

Conversation

Copilot AI commented Sep 23, 2026

Copy link
Copy Markdown
Contributor

@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
16 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

@dotnet-policy-service

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @dotnet/runtime-infrastructure
See info in area-owners.md if you want to be subscribed.

Agent-Logs-Url: https://github.com/dotnet/runtime/sessions/ab8269e9-fb00-449c-8da8-63fb5bf7edee

Co-authored-by: jakobbotsch <7887810+jakobbotsch@users.noreply.github.com>
Comment on lines +2059 to +2064
if (a == -1)
{
// Avoid signed remainder overflow for MinValue % -1. Return positive 1
// so that callers do not divide MinValue by -1 either.
return 1;
}

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot Make this return -1 in that case, and update the comment.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated in da6ba1d; completed in 43776e6. Gcd now returns -1 and the comment is corrected. This exposed another MinValue / -1 fault in RephraseIV, so that path now uses wrapping unsigned negation. Linux x64 Debug build and all 356 Regression_ro_2 cases passed, including the 10 focused int/long cases.

Copilot AI and others added 2 commits September 23, 2026 10:04
Co-authored-by: jakobbotsch <7887810+jakobbotsch@users.noreply.github.com>
Co-authored-by: jakobbotsch <7887810+jakobbotsch@users.noreply.github.com>
@jakobbotsch

Copy link
Copy Markdown
Member

@copilot Instead of this fix let's just fix it by making ComputeRephrasableIVByScaling fail when one of the steps is the min value, and revert the rest. Include a comment that this avoids the edge case of computing MinValue / -1.

Co-authored-by: jakobbotsch <7887810+jakobbotsch@users.noreply.github.com>

Copilot AI commented Sep 23, 2026

Copy link
Copy Markdown
Contributor Author

@copilot Instead of this fix let's just fix it by making ComputeRephrasableIVByScaling fail when one of the steps is the min value, and revert the rest. Include a comment that this avoids the edge c...

Implemented in 88f40f2. ComputeRephrasableIVByScaling now returns nullptr before Gcd when either step is the minimum value, with the requested MinValue / -1 comment. Reverted all changes to Gcd and RephraseIV; retained the regression tests. Linux x64 Debug build and all 356 Regression_ro_2 cases passed.

Comment on lines +9 to +29
[Theory]
[InlineData(0, 0)]
[InlineData(1, 0)]
[InlineData(2, int.MaxValue)]
[InlineData(5, -10)]
[InlineData(6, int.MaxValue - 14)]
public static void TestInt32(int n, int expected)
{
Assert.Equal(expected, SumInt32(n));
}

[Theory]
[InlineData(0, 0L)]
[InlineData(1, 0L)]
[InlineData(2, long.MaxValue)]
[InlineData(5, -10L)]
[InlineData(6, long.MaxValue - 14)]
public static void TestInt64(int n, long expected)
{
Assert.Equal(expected, SumInt64(n));
}

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@copilot We do not need multiple InlineData to test this. A single Fact with a single test value is fine.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated in ec4e4cd to one [Fact] using n = 5, with assertions for both int and long. The focused fact and all 364 Regression_ro_2 cases passed on Linux x64 Checked.

Co-authored-by: jakobbotsch <7887810+jakobbotsch@users.noreply.github.com>
Copilot AI requested a review from jakobbotsch September 23, 2026 11:26
@MihaZupan MihaZupan added area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI and removed area-Infrastructure labels Sep 23, 2026
@dotnet-policy-service

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch
See info in area-owners.md if you want to be subscribed.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area-CodeGen-coreclr CLR JIT compiler in src/coreclr/src/jit and related components such as SuperPMI

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

JIT: (bug) Strength reduction computes int.MinValue % -1 in Gcd, faulting the JIT with an integer-divide overflow

3 participants