Skip to content

Fix lossless_negate for casts from unsigned inner types#9166

Open
alexreinking wants to merge 2 commits into
mainfrom
alexreinking/fix-lossless-cast
Open

Fix lossless_negate for casts from unsigned inner types#9166
alexreinking wants to merge 2 commits into
mainfrom
alexreinking/fix-lossless-cast

Conversation

@alexreinking
Copy link
Copy Markdown
Member

lossless_negate tried to negate cast(outer, inner) by negating inner and casting back, regardless of inner's signedness. This is unsound when inner is unsigned: unsigned negation wraps modularly, so cast(outer, -uint8(x)) != -cast(outer, uint8(x)) in general.

For example, -uint8(65) = uint8(191) (wrapping), but -int16(65) = -65, so int16(uint8(-x)) gives 191 while the correct -int16(uint8(x)) = -65.

This caused FindIntrinsics to produce incorrect vectorized code: when lowering Sub(int16(A), int16(B_uint8)) it would compute the negation of int16(B_uint8) by negating inside uint8 arithmetic, turning a subtraction into an incorrect addition.

The fix is to guard the Cast case: only attempt to push negation through a cast when the inner value has a signed integer type.

Fixes #9165

Breaking changes

None

Checklist

  • Tests added or updated (not required for docs, CI config, or typo fixes)
  • Commits include AI attribution where applicable (see Code of Conduct)

@alexreinking alexreinking requested a review from abadams May 29, 2026 20:45
lossless_negate tried to negate cast(outer, inner) by negating inner
and casting back, regardless of inner's signedness. This is unsound
when inner is unsigned: unsigned negation wraps modularly, so
cast(outer, -uint8(x)) != -cast(outer, uint8(x)) in general.

For example, -uint8(65) = uint8(191) (wrapping), but -int16(65) = -65,
so int16(uint8(-x)) gives 191 while the correct -int16(uint8(x)) = -65.

This caused FindIntrinsics to produce incorrect vectorized code: when
lowering Sub(int16(A), int16(B_uint8)) it would compute the negation
of int16(B_uint8) by negating inside uint8 arithmetic, turning a
subtraction into an incorrect addition.

The fix is to guard the Cast case: only attempt to push negation
through a cast when the inner type is not unsigned. Signed integers
are safe (overflow is checked via lossless_cast) and floats are safe
(negation is an exact sign-bit flip with no wrapping).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@alexreinking alexreinking force-pushed the alexreinking/fix-lossless-cast branch from d8c208b to a1a9a2b Compare May 29, 2026 20:55
@abadams
Copy link
Copy Markdown
Member

abadams commented May 29, 2026

Signed integer negation also wraps though, for the most-negative int.

@codecov
Copy link
Copy Markdown

codecov Bot commented May 29, 2026

Codecov Report

❌ Patch coverage is 40.00000% with 3 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@7e2ecf2). Learn more about missing BASE report.

Files with missing lines Patch % Lines
src/IROperator.cpp 40.00% 3 Missing ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##             main    #9166   +/-   ##
=======================================
  Coverage        ?   69.38%           
=======================================
  Files           ?      254           
  Lines           ?    78217           
  Branches        ?    18713           
=======================================
  Hits            ?    54268           
  Misses          ?    18474           
  Partials        ?     5475           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Lossless cast fuzz failure

2 participants