Release-only wrong result in integer `for` loop: local bound inside loop range expression clobbers a local slot
维护者通常 3 天内回复
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 35/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 领域
- compilers
调研方向
Start by locating GenIntegerForLoop in the F# compiler and inspect how it allocates local slots while evaluating loop bounds; the issue identifies that as the source of the clobbering. Use the three repro scripts in the report with optimization both disabled and enabled, especially the case that loops forever. Done when optimized execution matches the unoptimized results without clobbering locals.
由索引模型根据 Issue 内容生成。
描述
Release-only wrong result in integer for loop: local bound inside loop range expression clobbers a local slot
Repro steps
//// repro.fsx ////
// dotnet fsi --optimize- repro.fsx prints: 100
// dotnet fsi --optimize+ repro.fsx prints: 50
let f k =
k + (for _ in max 0 (k - 50) .. 0 do stdout.Write ""
0)
printfn "%d" (f 100)
Expected behavior
The behavior without optimization is correct. f k is equivalent to k+0, so f 100 should be 100.
Actual behavior
With optimization on, the generated IL spills k off the stack into a local variable slot, but then when evaluating the loop start expression, max needs a local to store k - 50.
GenIntegerForLoop puts that local in the same slot. That clobbers k.
In my first example the start expression is the culprit. But the end expression has the same problem when the optimizer rewrites a loop like for i in 0 .. arr.Length - 1 C#-style. The local can take the loop variable's own slot, and the loop never terminates. Example:
//// repro2.fsx ////
// dotnet fsi --optimize- repro2.fsx prints: 0 1 2
// dotnet fsi --optimize+ repro2.fsx prints: 0 0 0 0 0 ... forever
let f (xs: int[]) n =
// this could be any side-effect-free expr that binds a local
for i in 0 .. (if max 0 (n - 1) > 0 then xs else xs).Length - 1 do
printf "%d " i
f [| 1; 2; 3 |] 1
Known workarounds
Bind the loop's start and/or end to locals with let. Use for x in startVar .. endVar do instead of putting complex expressions directly inside the in _ .. _ part of the loop.
Related information
Windows 10, SDK 10.0.401, and reproduced on main at 3917a24af
This bug repros going back at least to SDK 6.0.428. But going from 10.0.202 to 10.0.401, it became more visible as it can affect some usages of Array.init as well. This is how I ran into it.
//// repro3.fsx ////
// dotnet fsi --optimize- repro3.fsx prints: [|0; 1; 2|]
// dotnet fsi --optimize+ repro3.fsx prints: [|2; 1; 0|]
let xs =
Array.init 3 (fun k ->
for _ in max 0 (2 - k) .. 0 do stdout.Write ""
k)
printfn "%A" xs
I will follow up with a small PR to fix this.
Possibly related: dotnet/fsharp#20564 (different symptom, also stack saving around a branch)
- 主要语言
- F#
- 星标
- 4.3k
- 派生
- 881
- 平均合并
- 3 天 22 小时
- 30 天内合并 PR
- 105
环境准备
在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue,再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库,在一个分支上完成修改。
- 提交 Pull Request,并在描述里引用这个 Issue 编号。
dotnet/fsharp 的其他 Issue
-
Bug Needs-Triage
难度 2/5 1-3 小时 新手友好度 64/100
维护者通常 3 天内回复
-
Bug Needs-Triage
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 3 天内回复
-
Documentation: Array.tryPick code example gives an error可能已有人在做 @T-Gro 于 2 天前认领。 未关闭Area-XmlDocs
难度 1/5 1 小时以内 新手友好度 78/100
dotnet/fsharp#20780 · 已指派 1 人 ·
维护者通常 3 天内回复
-
Semantic classification cache for opened documents is never populated (written to the unopened-documents cache)可能已有人在做 @xperiandri 于 44 天前认领。 未关闭Needs-Triage
难度 1/5 1 小时以内 新手友好度 90/100
维护者通常 3 天内回复
-
Needs-Triage
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 3 天内回复
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 88/100
snowballstem/snowball#311 ·
-
难度 2/5 1-3 小时 新手友好度 78/100
JakeChampion/lang#12684 ·
维护者通常 1 天内回复
-
`lvm_compact` has no self-hosted twin, and `docs/158` §5 says every language-face component must未关闭bug sev-3 vm
难度 2/5 1-3 小时 新手友好度 65/100
-
bisect
难度 2/5 1-3 小时 新手友好度 65/100
dtcxzyw/llvm-bisect-service#545 · 1 条评论 ·
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复