Enzyme generates undef-fed tape PHIs for packed-state nested guard reproducer

[minansys]

https://tinyurl.com/2c2v5q9u

Summary

On current Enzyme main (d0749cbb, Attempt to fix rematerialization ficticious phi issues (#2827)), the attached LLVM IR reproducer still generates undef-fed tape state in augmented_eval.

This looks related to the old nested-guard family from #2629, but not like the exact same control-flow bug. In this reproducer, reverse still remains gated by the saved outer state, but Enzyme still packs undef into saved i1, ptr, and double values along inactive paths.

So this appears to be a remaining tape / PHI / rematerialization issue rather than a duplicate of the specific nested-predicate control-flow bug fixed for #2629.

Attached reproducer

The reproducer is the attached LLVM IR file:

• packed_state_outer_guard_undef_tape.ll

It is self-contained and does not depend on any C++ source or Cromwell code.

The reduced shape is:

• packed state with booleans and an optional pointer
• outer guard around a helper call
• nested helper branches inside that helper
• a looped dot-product path that Enzyme tapes as { ptr, double }
• a later unrelated optional-pointer join

Reproduction

The file already contains RUN: lines for the Enzyme test suite.

Equivalent local reproduction command:

opt < packed_state_outer_guard_undef_tape.ll \
	-load-pass-plugin=/path/to/LLVMEnzyme.so \
	-passes="enzyme,function(sroa,mem2reg,early-cse,simplifycfg,instsimplify,correlated-propagation,simplifycfg,adce)" \
	-S -enzyme-preopt=0 -enzyme-detect-readthrow=0 | \
	FileCheck packed_state_outer_guard_undef_tape.ll

Problematic transformed shape

In the transformed IR, Enzyme emits:

define internal { { ptr, ptr, { double, double, double }, ptr, i1, i1, i1, double, double, ptr, i1, double }, double } @augmented_eval(...)

and the scalarized output still contains undef-fed tape fields such as:

%.sroa.14.0 = phi i1 [ %has_rotation, %with.frame ], [ undef, %entry ]
%.sroa.16.0 = phi i1 [ %has_translation, %with.frame ], [ undef, %entry ]
%.sroa.10.0 = phi ptr [ %subcache, %with.dot ], [ undef, %after.frame ]
%.sroa.26.0 = phi double [ undef, %have.second ], [ %roughness_limit, %no.second ]

Those values are then packed back into the tape via insertvalue.

The attached .ll file checks exactly for this shape.

Why this does not look like a straight duplicate of #2629

• Enzyme miscompiles nested branch with outer: uninitialized taped predicate causes inactive path to execute #2629 was about incorrect reverse CFG reconstruction for nested inactive-outer / active-inner predicates.
• The fix there delayed inner predicate materialization and zero-initialized predicate caches.
• In this reproducer, reverse is still gated by the saved outer state.
• The remaining issue is that the tape payload itself still carries undef through saved fields.

Expected behavior

Enzyme should not emit undef into saved reverse/tape state for semantically "not executed" paths. Those values should have a safe inactive default, or the reverse should be structured so such tape fields are not materialized at all.

Actual behavior

Current main still emits undef-fed saved i1, ptr, and double values in the tape for this attached IR reproducer.

Question

Is this expected / benign IR, or is this still a real remaining bug in Enzyme's tape construction / PHI rematerialization for packed-state nested-guard code?

[minansys]

The following code crashed at velocity_frame[0] += velocity_translational[0]; , where has_translation is print to be false in the forward.

void 
    __attribute__ ((noinline))
    GetFaceFrameVelocity(
        const dsize_t face_index, const Containers::ConstRealMatrixView& face_centroids,
        const Real velocity_translational[SpatialDimension], const Real omega_rot[SpatialDimension],
        const Real axis_origin[SpatialDimension], const bool has_rotation, const bool has_translation,
        Real velocity_frame[SpatialDimension])
    {
      if (has_translation)
      {
          velocity_frame[0] += velocity_translational[0]; // passed with velocity_frame[0] += 1_r;
      }
    }

where velocity_frame is passed through via a struct member function

    template <Bc WallFunction>
    struct WallFunctionBase : BoundaryHelpers
    {
      function () .......

      bool translational_motion = Default();
      Real velocity_translational[SpatialDimension] = {0_r, 0_r, 0_r};

    }

Here are the IR difference

crashed here

7F43E055F601: 41 0F 11 86 A0 07 00 00       movups %xmm0, 0x7a0(%r14)
7F43E055F609: 48 8B 84 24 C8 09 00 00       movq   0x9c8(%rsp), %rax
7F43E055F611: 49 89 86 18 02 00 00          movq   %rax, 0x218(%r14)
7F43E055F618: 48 8B 84 24 D0 09 00 00       movq   0x9d0(%rsp), %rax
7F43E055F620: 49 89 86 98 05 00 00          movq   %rax, 0x598(%r14)
7F43E055F627: 8B 84 24 D8 09 00 00          movl   0x9d8(%rsp), %eax
7F43E055F62E: 41 89 86 3C 05 00 00          movl   %eax, 0x53c(%r14)
7F43E055F635: 8B 84 24 E0 09 00 00          movl   0x9e0(%rsp), %eax
7F43E055F63C: 41 89 86 84 07 00 00          movl   %eax, 0x784(%r14)
7F43E055F643: 8B 84 24 E8 09 00 00          movl   0x9e8(%rsp), %eax
7F43E055F64A: 41 89 86 74 07 00 00          movl   %eax, 0x774(%r14)
7F43E055F651: 48 8B 84 24 F8 09 00 00       movq   0x9f8(%rsp), %rax
7F43E055F659: 49 89 86 48 07 00 00          movq   %rax, 0x748(%r14)
7F43E055F660: 48 8B 84 24 00 0A 00 00       movq   0xa00(%rsp), %rax
7F43E055F668: 49 89 86 20 07 00 00          movq   %rax, 0x720(%r14)
7F43E055F66F: 48 8B 84 24 08 0A 00 00       movq   0xa08(%rsp), %rax
7F43E055F677: 49 89 86 BC 06 00 00          movq   %rax, 0x6bc(%r14)
7F43E055F67E: 48 8B 84 24 70 0A 00 00       movq   0xa70(%rsp), %rax
7F43E055F686: 49 89 86 88 06 00 00          movq   %rax, 0x688(%r14)
7F43E055F68D: 8B 84 24 90 0A 00 00          movl   0xa90(%rsp), %eax
7F43E055F694: 41 89 86 60 06 00 00          movl   %eax, 0x660(%r14)
7F43E055F69B: 8B 84 24 40 11 00 00          movl   0x1140(%rsp), %eax
7F43E055F6A2: 41 89 86 40 06 00 00          movl   %eax, 0x640(%r14)
7F43E055F6A9: 48 8B 84 24 98 0A 00 00       movq   0xa98(%rsp), %rax
7F43E055F6B1: 49 89 86 94 08 00 00          movq   %rax, 0x894(%r14)
7F43E055F6B8: 48 8B 84 24 A8 0A 00 00       movq   0xaa8(%rsp), %rax
7F43E055F6C0: 49 89 86 44 08 00 00          movq   %rax, 0x844(%r14)
7F43E055F6C7: 48 8B 84 24 B0 0A 00 00       movq   0xab0(%rsp), %rax
7F43E055F6CF: 49 89 86 F4 07 00 00          movq   %rax, 0x7f4(%r14)
7F43E055F6D6: 0F 28 84 24 10 12 00 00       movaps 0x1210(%rsp), %xmm0
7F43E055F6DE: 41 0F 11 86 90 07 00 00       movups %xmm0, 0x790(%r14)
7F43E055F6E6: 48 8B 84 24 40 09 00 00       movq   0x940(%rsp), %rax
7F43E055F6EE: 48 8B 8C 24 F0 09 00 00       movq   0x9f0(%rsp), %rcx
7F43E055F6F6: 48 89 0C E8                   movq   %rcx, (%rax,%rbp,8)
7F43E055F6FA: F2 0F 10 84 24 A8 12 00 00    movsd  0x12a8(%rsp), %xmm0
7F43E055F703: 48 8B 84 24 D8 1E 00 00       movq   0x1ed8(%rsp), %rax
7F43E055F70B: 48 8B 8C 24 38 21 00 00       movq   0x2138(%rsp), %rcx
7F43E055F713: 48 01 D9                      addq   %rbx, %rcx
7F43E055F716: F2 0F 11 04 E9                movsd  %xmm0, (%rcx,%rbp,8)
7F43E055F71B: 48 8B 8C 24 48 09 00 00       movq   0x948(%rsp), %rcx
7F43E055F723: 48 89 04 E9                   movq   %rax, (%rcx,%rbp,8)
7F43E055F727: F2 0F 10 84 24 B0 12 00 00    movsd  0x12b0(%rsp), %xmm0
7F43E055F730: 48 8B 84 24 E8 1E 00 00       movq   0x1ee8(%rsp), %rax
7F43E055F738: 48 8B 8C 24 48 21 00 00       movq   0x2148(%rsp), %rcx
7F43E055F740: 48 01 D9                      addq   %rbx, %rcx
7F43E055F743: F2 0F 11 04 E9                movsd  %xmm0, (%rcx,%rbp,8)
7F43E055F748: 48 8B 8C 24 50 09 00 00       movq   0x950(%rsp), %rcx
7F43E055F750: 48 89 04 E9                   movq   %rax, (%rcx,%rbp,8)
7F43E055F754: 48 8B 84 24 B8 1E 00 00       movq   0x1eb8(%rsp), %rax
7F43E055F75C: 48 8B 8C 24 38 09 00 00       movq   0x938(%rsp), %rcx
7F43E055F764: 48 89 04 E9                   movq   %rax, (%rcx,%rbp,8)
7F43E055F768: 48 8B 84 24 18 21 00 00       movq   0x2118(%rsp), %rax
7F43E055F770: 48 85 C0                      testq  %rax, %rax
7F43E055F773: 48 8B 8C 24 30 09 00 00       movq   0x930(%rsp), %rcx
7F43E055F77B: 0F 94 04 29                   sete   (%rcx,%rbp)
7F43E055F77F: 0F 84 DB E9 FF FF             je     0x7f43e055e160  ; <+464>
7F43E055F785: F2 0F 10 84 24 B8 12 00 00    movsd  0x12b8(%rsp), %xmm0
7F43E055F78E: 48 01 D8                      addq   %rbx, %rax
7F43E055F791: F2 0F 11 04 E8                movsd  %xmm0, (%rax,%rbp,8)
7F43E055F796: E9 C5 E9 FF FF                jmp    0x7f43e055e160  ; <+464>
7F43E055F79B: 48 8B 94 24 58 09 00 00       movq   0x958(%rsp), %rdx
7F43E055F7A3: 48 89 D6                      movq   %rdx, %rsi
7F43E055F7A6: 48 F7 D6                      notq   %rsi
7F43E055F7A9: 4C 01 EE                      addq   %r13, %rsi
7F43E055F7AC: 48 89 D0                      movq   %rdx, %rax
7F43E055F7AF: 48 F7 D8                      negq   %rax
7F43E055F7B2: 48 89 84 24 58 12 00 00       movq   %rax, 0x1258(%rsp)
7F43E055F7BA: 49 69 C5 D0 08 00 00          imulq  $0x8d0, %r13, %rax  ; imm = 0x8D0 
7F43E055F7C1: 49 FF CD                      decq   %r13
7F43E055F7C4: 48 69 CA D0 08 00 00          imulq  $0x8d0, %rdx, %rcx  ; imm = 0x8D0 
7F43E055F7CB: 48 29 C8                      subq   %rcx, %rax
7F43E055F7CE: 48 8B 8C 24 B8 0A 00 00       movq   0xab8(%rsp), %rcx
7F43E055F7D6: 4C 8D 34 08                   leaq   (%rax,%rcx), %r14
7F43E055F7DA: 49 81 C6 30 F7 FF FF          addq   $-0x8d0, %r14  ; imm = 0xF730 
7F43E055F7E1: 48 8B 84 24 40 09 00 00       movq   0x940(%rsp), %rax
7F43E055F7E9: 48 29 D8                      subq   %rbx, %rax
7F43E055F7EC: 48 89 84 24 50 12 00 00       movq   %rax, 0x1250(%rsp)
7F43E055F7F4: 48 8B 84 24 48 09 00 00       movq   0x948(%rsp), %rax
7F43E055F7FC: 48 29 D8                      subq   %rbx, %rax
7F43E055F7FF: 48 89 84 24 48 12 00 00       movq   %rax, 0x1248(%rsp)
7F43E055F807: 48 8B 84 24 50 09 00 00       movq   0x950(%rsp), %rax
7F43E055F80F: 48 29 D8                      subq   %rbx, %rax
7F43E055F812: 48 89 84 24 40 12 00 00       movq   %rax, 0x1240(%rsp)
7F43E055F81A: 48 8B 84 24 38 09 00 00       movq   0x938(%rsp), %rax
7F43E055F822: 48 29 D8                      subq   %rbx, %rax
7F43E055F825: 48 89 84 24 30 12 00 00       movq   %rax, 0x1230(%rsp)
7F43E055F82D: 48 8B 84 24 30 09 00 00       movq   0x930(%rsp), %rax
7F43E055F835: 48 29 D0                      subq   %rdx, %rax
7F43E055F838: 48 89 84 24 38 12 00 00       movq   %rax, 0x1238(%rsp)
7F43E055F840: E9 6B 18 00 00                jmp    0x7f43e05610b0  ; <+12576>
7F43E055F845: 66 66 2E 0F 1F 84 00 00 00 >  nopw   %cs:(%rax,%rax)
7F43E055F850: 48 8B 84 24 40 12 00 00       movq   0x1240(%rsp), %rax
7F43E055F858: 4A 8B 04 E8                   movq   (%rax,%r13,8), %rax
7F43E055F85C: F2 0F 10 04 C8                movsd  (%rax,%rcx,8), %xmm0

update from coploit

Root Cause
The root cause is a failed-only Enzyme-generated partial copy of the shadow OperationWF object in the reverse wrapper, not the fadd itself.

In the crashing IR, the reverse wrapper copies the shadow op tail starting at offset 456 for only 40 bytes at fail1.ll. In the passing IR, the same copy is 152 bytes at pass1.ll. That means the failed build leaves bytes 496..607 of the local shadow op %14 uninitialized.

Those omitted bytes begin exactly where the frame fields start in the source layout at WallFcnCommon.h:248: has_frame_motion, rotational_motion, translational_motion, omega_rot, velocity_translational, axis_origin. In the failed wrapper, the short 40-byte copy reaches only through the omega_rot region and stops just before velocity_translational.

The generated IR then immediately uses later fields from that not-fully-copied shadow op anyway:
fail1.ll
fail1.ll
fail1.ll
fail1.ll

and loads pointers from those uncopied fields at:
fail1.ll
fail1.ll
fail1.ll
fail1.ll

Those pointers are then cached into per-iteration replay arrays, alongside the 2256-byte taped record allocation at fail1.ll. Later, the reverse replay loop around fail1.ll dereferences those cached pointer arrays.

That matches your crash assembly exactly:

0x8d0 is 2256, the Enzyme tape-record stride
movq (%rax,%r13,8), %rax is loading a cached pointer-table entry
movsd (%rax,%rcx,8), %xmm0 is dereferencing the pointed-to double buffer
So the proximate crash is: Enzyme stored garbage pointers into the replay cache because it never fully initialized the shadow op tail before reading fields from it.

Why 1_r Passes
At the helper level, the failed reverse helper at fail1.ll has an extra adjoint write back through the translation shadow pointer. The passed helper at pass1.ll does not.

That source change in Geometry.h:65 changes Enzyme’s activity analysis enough that the passed build emits the full 152-byte tail copy, while the failed build emits the broken 40-byte tail copy. The literal version passes because the later replayed pointer fields are actually initialized.

The Enzyme bug is therefore more specific than “reverse CFG is wrong”: it emits a self-inconsistent reverse wrapper. It truncates the shadow-struct tail copy, then later reads pointer fields from the omitted region and replays through them.