isl crash: total dimensionality changed unexpectedly

[Michael Kruse]

Hi,

this is bug report derived from a crash in Polly:
https://github.com/llvm/llvm-project/issues/177808

```sh
$ gcc isltrace.c -o isltrace -I ~/src/isl/include/ ~/src/isl/libisl.a -g
$ ./isltrace
### ISL version : isl-0.27-326-g3dfaad2d-IMath-32-cmake
### at generation: isl-0.27-76-g45617220-IMath-32
[p_0, p_1] -> { [[] -> [i0]] -> Stmt2[o0] : 1 = 0 }
/home/meinersbur/src/isl/isl_map_simplify.c:6373: total dimensionality
changed unexpectedly
Aborted (core dumped)
```

gdb stack trace:

#0 __pthread_kill_implementation (no_tid=0, signo=6,
threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>) at
./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>,
signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3 0x00007fffff5c527e in __GI_raise (sig=sig@entry=6) at
../sysdeps/posix/raise.c:26
#4 0x00007fffff5a88ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x0000000008093ba1 in isl_handle_error (ctx=0x820a390,
error=isl_error_internal, msg=0x81abf68 "total dimensionality changed
unexpectedly", file=0x81abeb8
"/home/meinersbur/src/isl/isl_map_simplify.c", line=6373) at
/home/meinersbur/src/isl/isl_ctx.c:158
#6 0x00000000080e61de in reduce_coefficients (bmap=0x8240880,
data=0x7ffffffe7e50) at
/home/meinersbur/src/isl/isl_map_simplify.c:6373
#7 0x00000000080e64e1 in isl_basic_map_reduce_coefficients
(bmap=0x8240880) at /home/meinersbur/src/isl/isl_map_simplify.c:6474
#8 0x0000000008086f08 in isl_map_coalesce (map=0x8217730) at
/home/meinersbur/src/isl/isl_coalesce.c:4225
#9 0x000000000806f836 in generate_domain (executed=0x8217730,
user=0x7ffffffe8010) at /home/meinersbur/src/isl/isl_ast_codegen.c:223
#10 0x00000000081657cf in call_on_copy (entry=0x820e268,
user=0x7ffffffe7fc0) at /home/meinersbur/src/isl/isl_union_map.c:615
#11 0x000000000809d89f in isl_hash_table_foreach (ctx=0x820a390,
table=0x820ce20, fn=0x8165781 <call_on_copy>, user=0x7ffffffe7fc0) at
/home/meinersbur/src/isl/isl_hash.c:227
#12 0x000000000816588d in isl_union_map_foreach_map (umap=0x820ce10,
fn=0x806f767 <generate_domain>, user=0x7ffffffe8010) at
/home/meinersbur/src/isl/isl_union_map.c:636
#13 0x000000000806fa9a in generate_inner_level (executed=0x820ce10,
build=0x82933a0) at /home/meinersbur/src/isl/isl_ast_codegen.c:313
#14 0x00000000080776f4 in build_ast_from_leaf (build=0x82933a0,
node=0x82a3200, executed=0x820ce10) at
/home/meinersbur/src/isl/isl_ast_codegen.c:5172
#15 0x00000000080787d4 in build_ast_from_schedule_node
(build=0x82933a0, node=0x82a3200, executed=0x820ce10) at
/home/meinersbur/src/isl/isl_ast_codegen.c:5761
#16 0x0000000008078990 in build_ast_from_child (build=0x82933a0,
node=0x82a3200, executed=0x820ce10) at
/home/meinersbur/src/isl/isl_ast_codegen.c:5809
#17 0x000000000806fa31 in generate_inner_level (executed=0x820ce10,
build=0x82933a0) at /home/meinersbur/src/isl/isl_ast_codegen.c:305
#18 0x0000000008077080 in generate_next_level (executed=0x820ce10,
build=0x8255330) at /home/meinersbur/src/isl/isl_ast_codegen.c:4847
#19 0x0000000008071665 in create_node_scaled (executed=0x820ce10,
bounds=0x8242390, domain=0x820ba20, build=0x82f1c90) at
/home/meinersbur/src/isl/isl_ast_codegen.c:1491
#20 0x0000000008071b81 in create_node (executed=0x820ce10,
bounds=0x823d710, domain=0x820ba20, build=0x822b8d0) at
/home/meinersbur/src/isl/isl_ast_codegen.c:1683
#21 0x00000000080720bc in add_node (list=0x82127c0,
executed=0x820ce10, bounds=0x823d710, build=0x822b8d0) at
/home/meinersbur/src/isl/isl_ast_codegen.c:1820
#22 0x00000000080727e6 in generate_sorted_domains
(domain_list=0x820c350, executed=0x820c060, build=0x822b8d0) at
/home/meinersbur/src/isl/isl_ast_codegen.c:2057
#23 0x0000000008072977 in generate_sorted_domains_wrap (scc=0x820c350,
user=0x7ffffffe84c0) at
/home/meinersbur/src/isl/isl_ast_codegen.c:2131
#24 0x0000000008137b6a in isl_basic_set_list_call_on_scc
(list=0x82738d0, pos=0x822dea8, n=1, fn=0x8072917
<generate_sorted_domains_wrap>, user=0x7ffffffe84c0) at
/home/meinersbur/src/isl/isl_list_templ.c:535
#25 0x0000000008137d3a in isl_basic_set_list_foreach_scc
(list=0x82738d0, follows=0x8072868 <shared_outer>,
follows_user=0x7ffffffe84bc, fn=0x8072917
<generate_sorted_domains_wrap>, fn_user=0x7ffffffe84c0) at
/home/meinersbur/src/isl/isl_list_templ.c:588
#26 0x0000000008072ae4 in generate_parallel_domains
(domain_list=0x82738d0, executed=0x820c060, build=0x822b8d0) at
/home/meinersbur/src/isl/isl_ast_codegen.c:2184
#27 0x00000000080748e4 in generate_shifted_component_tree_base
(executed=0x820c060, build=0x822b8d0, isolated=0) at
/home/meinersbur/src/isl/isl_ast_codegen.c:3371
#28 0x0000000008074e9e in generate_shifted_component_tree
(executed=0x820c060, build=0x822b8d0) at
/home/meinersbur/src/isl/isl_ast_codegen.c:3607
#29 0x0000000008075277 in generate_shifted_component
(executed=0x820c060, build=0x822b8d0) at
/home/meinersbur/src/isl/isl_ast_codegen.c:3674
#30 0x00000000080770b0 in generate_next_level (executed=0x820c060,
build=0x822b8d0) at /home/meinersbur/src/isl/isl_ast_codegen.c:4853
#31 0x00000000080779df in build_ast_from_band (build=0x822b8d0,
node=0x822c470, executed=0x820c060) at
/home/meinersbur/src/isl/isl_ast_codegen.c:5262
#32 0x00000000080787f0 in build_ast_from_schedule_node
(build=0x8221540, node=0x822c470, executed=0x8219660) at
/home/meinersbur/src/isl/isl_ast_codegen.c:5763
#33 0x0000000008078990 in build_ast_from_child (build=0x8221540,
node=0x822c470, executed=0x8219660) at
/home/meinersbur/src/isl/isl_ast_codegen.c:5809
#34 0x0000000008078af6 in build_ast_from_domain (build=0x8221540,
node=0x822c470) at /home/meinersbur/src/isl/isl_ast_codegen.c:5864
#35 0x0000000008078c0f in isl_ast_build_node_from_schedule
(build=0x8242e90, schedule=0x8237f90) at
/home/meinersbur/src/isl/isl_ast_codegen.c:5906

Reproduced with isl-0.27-76-g45617220 and isl-0.27 .

Debugging the issue, during the call of
isl_basic_map_reduce_coefficients, the function
exploit_opposite_constraints calls isl_basic_map_set_to_empty which
resets the n_div dimensions to zero. In a subsequent call of
reduce_coefficients, the number of dimensions stored in
isl_reduce_coefficients_data's `total` member has diverged, causing
the consistency check to fail.

Instead of the entire sequence of isl API calls, I also tried dumping
the argument of isl_map_coalesce that causes the crash and create the
following reproducer:

```c
int main() {
printf("starting..%s\n", isl_version());

isl_ctx *ctx = isl_ctx_alloc();
isl_options_set_on_error(ctx, ISL_ON_ERROR_ABORT);
isl_map *map = isl_map_read_from_str(ctx, "[p_0, p_1] -> { [[] ->
[i0]] -> Stmt2[o0] : (exists (e0 = floor((2 + p_0)/4), e1 = floor((p_0
- p_1)/4): o0 = i0 and p_0 >= -2147483648 and p_0 <= 2147483647 and
p_1 >= p_0 and p_1 >= -2147483648 and p_1 <= 2147483647 and i0 >= 0
and 4e0 > p_0 and 4e0 <= 4 + p_0 - i0 and 4e0 <= 2 + p_0 and 4e1 >= -3
+ p_0 - p_1 and 4e1 < p_0 - p_1)) or (exists (e0 = floor((2 + p_0)/4),
e1 = floor((-1 - p_1)/4), e2 = floor((p_0 - p_1)/4): o0 = i0 and 4e1 =
-4 + p_0 - p_1 - 4e0 and p_0 >= -2147483648 and p_0 <= 2147483647 and
p_1 >= p_0 and p_1 >= -2147483648 and p_1 <= 2147483647 and i0 >= 0
and 4e0 > p_0 and 4e0 <= p_0 - i0 and 4e0 <= 2 + p_0 and 4e2 >= -3 +
p_0 - p_1 and 4e2 < p_0 - p_1)) or (exists (e0 = floor((2 + p_0)/4),
e1 = floor((1 - p_1)/4), e2 = floor((p_0 - p_1)/4): o0 = i0 and 4e1 =
p_0 - p_1 - 4e0 and p_0 >= -2147483648 and p_0 <= 2147483647 and p_1
>= p_0 and p_1 >= -2147483648 and p_1 <= 2147483647 and i0 >= 0 and
4e0 > p_0 and 4e0 <= 4 + p_0 - i0 and 4e0 <= 2 + p_0 and 4e2 < p_0 -
p_1 and 4e2 >= -3 + p_0 - p_1)) }");
map = isl_map_coalesce(map);

isl_map_dump(map);
printf("..success\n");
return 0;
}
```

unfortunately this one does not crash.


Michael

--
Tardyzentrismus verboten!

[Sven Verdoolaege]

On Sun, Jan 25, 2026 at 01:50:20AM +0100, Michael Kruse wrote:
> Hi,
>
> this is bug report derived from a crash in Polly:
> https://github.com/llvm/llvm-project/issues/177808
>
> ```sh
> $ gcc isltrace.c -o isltrace -I ~/src/isl/include/ ~/src/isl/libisl.a -g
> $ ./isltrace
> ### ISL version : isl-0.27-326-g3dfaad2d-IMath-32-cmake
> ### at generation: isl-0.27-76-g45617220-IMath-32
> [p_0, p_1] -> { [[] -> [i0]] -> Stmt2[o0] : 1 = 0 }
> /home/meinersbur/src/isl/isl_map_simplify.c:6373: total dimensionality
> changed unexpectedly

Thanks for the report. I can reproduce the problem and I'll have a look.

skimo