[release/11.0] [mono][llvm] Fix malformed uaddlp/saddlp intrinsic declarations - #133972
Open
github-actions[bot] wants to merge 1 commit into
Open
github-actions[bot] wants to merge 1 commit into
github-actions[bot] wants to merge 1 commit into
Conversation
) `add_intrinsic ()` computes the source type of a `Widen`-kind intrinsic as `intrin_types [vw][ew - 1]`, but SADDLP/UADDLP were declared with `I1` in their overload spec, so `ew == 0` was reached and `intrin_types [vw][-1]` was read out of bounds. That reads the last element of the previous row, which is a floating point type, so two of the eight registered declarations were malformed: | overload spec | declaration | |----------------|----------------------------------------------------------------| | `V64 \| I1` | `declare <8 x i8> @llvm.aarch64.neon.uaddlp.v8i8.f64(double)` ❌ | | `V64 \| I2` | `declare <4 x i16> @llvm.aarch64.neon.uaddlp.v4i16.v8i8(<8 x i8>)` | | `V64 \| I4` | `declare <2 x i32> @llvm.aarch64.neon.uaddlp.v2i32.v4i16(<4 x i16>)` | | `V64 \| I8` | `declare <1 x i64> @llvm.aarch64.neon.uaddlp.v1i64.v2i32(<2 x i32>)` | | `V128 \| I1` | `declare <16 x i8> @llvm.aarch64.neon.uaddlp.v16i8.v1f64(<1 x double>)` ❌ | | `V128 \| I2` | `declare <8 x i16> @llvm.aarch64.neon.uaddlp.v8i16.v16i8(<16 x i8>)` | | `V128 \| I4` | `declare <4 x i32> @llvm.aarch64.neon.uaddlp.v4i32.v8i16(<8 x i16>)` | | `V128 \| I8` | `declare <2 x i64> @llvm.aarch64.neon.uaddlp.v2i64.v4i32(<4 x i32>)` | The element width in these specs is that of the widened *result*, and there is no `uaddlp`/`saddlp` form with an 8-bit result element, so `I1` doesn't belong there in the first place. SADDLP and UADDLP are the only two `Widen`-kind entries in `llvm-intrinsics.h`, so no other intrinsic is affected. Call sites are unaffected too — `ovr_tag_from_mono_vector_class (ins->klass)` uses the result vector class, which is never an 8-bit element vector for these. The malformed declarations were never called, but starting with **LLVM 23** the IR verifier rejects them, so AOT compiling any assembly that references `AdvSimd.AddPairwiseWidening` fails: ``` intrinsic argument 0 type (overload type 1) expected any vector type, but got double declare <8 x i8> @llvm.aarch64.neon.uaddlp.v8i8.f64(double) intrinsic argument 0 type (overload type 1) expected any vector type, but got double declare <8 x i8> @llvm.aarch64.neon.saddlp.v8i8.f64(double) LLVM ERROR: Broken module found, compilation aborted! ``` The out-of-bounds read has been there since #51993 (2021); it only started failing now because of the LLVM 23 bump. It was found in dotnet/macios, where the untrimmed `dont link` iOS test started failing to AOT compile `System.Private.CoreLib.dll`. Fixes #132743 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 1b1fe653-aecb-469b-b96d-85e0691818de
github-actions
Bot
requested review from
steveisok and
vitek-karas
as code owners
September 15, 2026 18:03
|
Azure Pipelines: Successfully started running 4 pipeline(s). 12 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
vitek-karas
approved these changes
Sep 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #132744 to release/11.0
/cc @rolfbjarne
Customer Impact
The bug can manifest on iOS/tvOS projects if LLVM is enabled (which it is by default for Release builds), and the result is that the build fails (LLVM raises an error).
A mitigating factor is that the bug typically only manifests when certain APIs in System.Private.CoreLib.dll are LLVM-compiled, and won't manifest if those APIs have been trimmed away by the trimmer earlier in the build. OTOH we have no visibility into how often those APIs are trimmed away or not (some apps might not even trim System.Private.CoreLib.dll, in which case they'll certainly encounter this problem).
Regression
Testing
Risk
Low risk:
IMPORTANT: If this backport is for a servicing release, please verify that:
release/X.0-staging, notrelease/X.0.release/X.0(no-stagingsuffix).