Add AMDGPU m019 high-bit xor miscompile

Author: jlebar

amdgpu/README.md

@@ -81,6 +81,15 @@ are local artifacts and are ignored by git; set `FUZZX_RUNTIME_ROOT`,
 `CORPUS_ROOT`, `LOG_DIR`, `ARTIFACT_ROOT`, or `FUZZX_FINDINGS_DIR` to override
 the default local runtime paths.
 
+### Known-Bug Suppression
+
+Known bug patterns are suppressed by default so continued fuzzing does not keep
+rediscovering the same issue.
+
+| Flag | Default | Meaning |
+| --- | --- | --- |
+| `FUZZX_ALLOW_M019_HIGHBIT_OR_XOR=1` | unset | Re-enable the outer high-bit `(x | C) ^ x` shape for [m019](known-miscompiles/m019-highbit-or-xor/NOTES.md). |
+
 ## Layout
 
 | Path | Purpose |
@@ -131,6 +140,7 @@ Tested toolchains as of 2026-05-16:
 | [m016-scalar-fshl-one](known-miscompiles/m016-scalar-fshl-one/NOTES.md) | ✅ | ❌ | ❌ | `-O0` lowers scalar `fshl.i32(x, y, 1)` through a 64-bit shift-by-`-1` sequence that returns only bit 31. |
 | [m017-vector-and-lane0-clear-xor](known-miscompiles/m017-vector-and-lane0-clear-xor/NOTES.md) | ❌ | ✅ | ✅ | ROCm 7.2.3 `-O0` drops a vector lane-0 `and`/`extractelement` clear before `xor`; LLVM HEAD and ROCm HEAD already pass. |
 | [m018-two-private-memory-ops](known-miscompiles/m018-two-private-memory-ops/NOTES.md) | ❌ | ✅ | ✅ | ROCm 7.2.3 `-O0` intermittently reads stale scratch data across two private-memory sequences; LLVM HEAD and ROCm HEAD pass 50 repeated combined runs. |
+| [m019-highbit-or-xor](known-miscompiles/m019-highbit-or-xor/NOTES.md) | ❌ | ❌ | ❌ | `-O0` combines a high-bit `(x | C) ^ x` expression into `v_bitop3_b32` with the wrong truth table or operands. |
 
 *Human-written note:* Up through bug m016 I was testing against upstream LLVM.  But then it became clear that the ROCm 7.2.3 release doesn't have most of the bugs that are appearing in upstream.  I'm more interested in bugs that appear in the release, so after this, I started testing against 7.2.3 (built from source).
 

amdgpu/fuzzer/llvm_amdgpu_diff_fuzzer.cpp

@@ -99,6 +99,15 @@ uint64_t randomInteresting64(std::minstd_rand &Gen) {
   }
 }
 
+bool envFlag(const char *Name, bool Default) {
+  const char *Value = std::getenv(Name);
+  if (!Value || !*Value)
+    return Default;
+  return std::strcmp(Value, "0") != 0 && std::strcmp(Value, "false") != 0 &&
+         std::strcmp(Value, "False") != 0 && std::strcmp(Value, "no") != 0 &&
+         std::strcmp(Value, "off") != 0;
+}
+
 std::array<uint32_t, InputCount> makeInputs(const uint8_t *Data, size_t Size) {
   std::array<uint32_t, InputCount> Inputs{};
   std::array<uint32_t, 8> Edges = {0,          1,          0x7fffffffu,
@@ -454,7 +463,33 @@ void scrubPoisonAnnotations(Module &M) {
   }
 }
 
+bool isHighBitI32Constant(const Value *V) {
+  const auto *CI = dyn_cast<ConstantInt>(V);
+  return CI && CI->getType()->isIntegerTy(32) &&
+         (CI->getZExtValue() & 0x80000000ull) != 0;
+}
+
+bool isOrWithHighBitConstantOf(const Value *MaybeOr, const Value *Other) {
+  const auto *BO = dyn_cast<BinaryOperator>(MaybeOr);
+  if (!BO || BO->getOpcode() != Instruction::Or)
+    return false;
+  return (BO->getOperand(0) == Other &&
+          isHighBitI32Constant(BO->getOperand(1))) ||
+         (BO->getOperand(1) == Other &&
+          isHighBitI32Constant(BO->getOperand(0)));
+}
+
+bool triggersM019HighBitOrXor(const Instruction &I) {
+  const auto *BO = dyn_cast<BinaryOperator>(&I);
+  if (!BO || BO->getOpcode() != Instruction::Xor ||
+      !BO->getType()->isIntegerTy(32))
+    return false;
+  return isOrWithHighBitConstantOf(BO->getOperand(0), BO->getOperand(1)) ||
+         isOrWithHighBitConstantOf(BO->getOperand(1), BO->getOperand(0));
+}
+
 bool validateIRCorpusModule(Module &M) {
+  bool AllowM019 = envFlag("FUZZX_ALLOW_M019_HIGHBIT_OR_XOR", false);
   Function *Kernel = findIRKernel(M);
   if (!Kernel)
     return false;
@@ -467,7 +502,8 @@ bool validateIRCorpusModule(Module &M) {
         return false;
       for (BasicBlock &BB : F)
         for (Instruction &I : BB)
-          if (!isAllowedIRInstruction(I))
+          if (!isAllowedIRInstruction(I) ||
+              (!AllowM019 && triggersM019HighBitOrXor(I)))
             return false;
       continue;
     }

amdgpu/known-miscompiles/m019-highbit-or-xor/NOTES.md

@@ -0,0 +1,61 @@
+# m019: high-bit `(x | C) ^ x` is miscompiled through `v_bitop3_b32`
+
+Found while fuzzing the ROCm 7.2.3 source build with the LLVM-bitcode C++
+fuzzer.
+
+```bash
+known-miscompiles/run_ll_reproducer.sh \
+  known-miscompiles/m019-highbit-or-xor/reduced.ll
+```
+
+Observed result:
+
+```text
+input=0x00000000
+O0=0x80000000
+O2=0x00000000
+mismatch=true
+```
+
+## Reduction
+
+The reduced IR computes:
+
+```llvm
+%salt = xor i32 %workitem.id.x, 0x80000000
+%mix = xor i32 %load, %salt
+%and = and i32 %mix, %salt
+%or = or i32 %and, 0x80000000
+%xor = xor i32 %or, %and
+```
+
+For the single executed work-item and input `0`, `%salt` and `%and` are both
+`0x80000000`, so `%xor` should be zero.
+
+## Root Cause Notes
+
+At `-O2`, the expression is simplified to `load & 0x80000000`, which returns
+zero for the reproducer input.
+
+At `-O0`, instruction selection combines the bit expression into:
+
+```asm
+v_bitop3_b32 v2, v2, v3, s2 bitop3:0x62
+```
+
+where `v2` is the loaded input, `v3` is the work-item id, and `s2` is
+`0x80000000`. For work-item zero and input zero this instruction produces
+`0x80000000`, but the LLVM IR expression is defined and evaluates to zero.
+
+## Toolchain Results
+
+| Toolchain | Result |
+| --- | --- |
+| ROCm 7.2.3 source build from tag `rocm-7.2.3`, commit `f58b06dce1f9c15707c5f808fd002e18c2accf7e`, `Release`, sanitizer coverage, no ASan | Reproduces. |
+| LLVM HEAD, commit `10756d32f96154f0889eda159ea9a26bc4188bda` | Reproduces. |
+| ROCm HEAD, commit `9115c466b3577830455f70c4f492429bf6c64b25` | Reproduces. |
+
+## Fuzzer Follow-Up
+
+The IR-bitcode fuzzer now suppresses the outer high-bit `(x | C) ^ x` idiom by
+default. Set `FUZZX_ALLOW_M019_HIGHBIT_OR_XOR=1` to re-enable this shape.

amdgpu/known-miscompiles/m019-highbit-or-xor/reduced.ll

@@ -0,0 +1,33 @@
+; RUN-INPUTS: 0x0
+; RUN-COMBINED: 1
+; RUN-LLVM-BUILD: build/rocm-7.2.3-llvm-cov-release
+
+target datalayout = "e-p:64:64-p1:64:64-p2:32:32-p3:32:32-p4:64:64-p5:32:32-p6:32:32-p7:160:256:256:32-p8:128:128:128:48-p9:192:256:256:32-i64:64-v16:16-v24:32-v32:32-v48:64-v96:128-v192:256-v256:256-v512:512-v1024:1024-v2048:2048-n32:64-S32-A5-G1-ni:7:8:9"
+target triple = "amdgcn-amd-amdhsa"
+
+define protected amdgpu_kernel void @fuzz_kernel(ptr addrspace(1) %in, ptr addrspace(1) %out, i32 %n) #0 {
+entry:
+  %wi = call i32 @llvm.amdgcn.workitem.id.x()
+  %ok = icmp ult i32 %wi, %n
+  br i1 %ok, label %body, label %exit
+
+body:
+  %idx64 = zext i32 %wi to i64
+  %in.ptr = getelementptr i32, ptr addrspace(1) %in, i64 %idx64
+  %v = load i32, ptr addrspace(1) %in.ptr, align 4
+  %salt = xor i32 %wi, -2147483648
+  %mix = xor i32 %v, %salt
+  %and = and i32 %mix, %salt
+  %or = or i32 %and, -2147483648
+  %xor = xor i32 %or, %and
+  %out.ptr = getelementptr i32, ptr addrspace(1) %out, i64 %idx64
+  store i32 %xor, ptr addrspace(1) %out.ptr, align 4
+  br label %exit
+
+exit:
+  ret void
+}
+
+declare i32 @llvm.amdgcn.workitem.id.x()
+
+attributes #0 = { convergent nounwind "amdgpu-flat-work-group-size"="1,256" "target-cpu"="gfx950" "uniform-work-group-size"="true" }