isl crash: Assertion "pivot >= 0" failed

[Michael Kruse]

Hi

this is a bug report derived from a crash in Polly:
https://github.com/llvm/llvm-project/issues/179993

```
$ gcc isltrace.c -o isltrace -I ~/src/isl/include/
~/src/isl/.libs/libisl.a -lgmp -g
$ ./isltrace
### ISL version : isl-0.27-78-gfc484e00-GMP
### at generation: isl-0.27-78-gfc484e00-IMath-32
isl_mat.c:1147: Assertion "pivot >= 0" failed
Aborted (core dumped)
```

gdb stack trace:

#0 __pthread_kill_implementation (no_tid=0, signo=6,
threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>) at
./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>,
signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3 0x00007fffff5c527e in __GI_raise (sig=sig@entry=6) at
../sysdeps/posix/raise.c:26
#4 0x00007fffff5a88ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x0000000008061851 in isl_handle_error (ctx=0x81df390,
error=isl_error_unknown, msg=0x8185346 "Assertion \"pivot >= 0\"
failed", file=0x81850c8 "/home/meinersbur/src/isl/isl_mat.c",
line=1147) at /home/meinersbur/src/isl/isl_ctx.c:158
#6 0x00000000080b1161 in isl_mat_right_inverse (mat=0x81e9bd0) at
/home/meinersbur/src/isl/isl_mat.c:1147
#7 0x000000000805a2c6 in isl_set_wrap_facet (set=0x81e4220,
facet=0x81ee380, ridge=0x81ee3b0) at
/home/meinersbur/src/isl/isl_convex_hull.c:335
#8 0x000000000804e23b in add_wrap (wraps=0x7ffffffeb5f0, w=1,
bound=0x81ec7e0, ineq=0x81ee3b0, len=6, set=0x81ed9b0, negate=1) at
/home/meinersbur/src/isl/isl_coalesce.c:1306
#9 0x000000000804e563 in add_selected_wraps (wraps=0x7ffffffeb5f0,
info=0x81eeb90, bound=0x81ec7e0, set=0x81ed9b0, add_valid=0) at
/home/meinersbur/src/isl/isl_coalesce.c:1393
#10 0x000000000804e60f in add_wraps (wraps=0x7ffffffeb5f0,
info=0x81eeb90, bound=0x81ec7e0, set=0x81ed9b0) at
/home/meinersbur/src/isl/isl_coalesce.c:1432
#11 0x000000000804f282 in can_wrap_in_facet (i=2, j=5, k=0,
info=0x81eeaa0, wrap_facet=0) at
/home/meinersbur/src/isl/isl_coalesce.c:1798
#12 0x000000000805066f in check_ineq_adj_eq (i=2, j=5, info=0x81eeaa0)
at /home/meinersbur/src/isl/isl_coalesce.c:2282
#13 0x00000000080515a8 in coalesce_local_pair_reuse (i=2, j=5,
info=0x81eeaa0) at /home/meinersbur/src/isl/isl_coalesce.c:2608
#14 0x0000000008052c0f in coalesce_expand_tab_divs (bmap=0x81ea7c0,
i=2, j=5, info=0x81eeaa0, div=0x81e02c0, exp=0x81e6b80) at
/home/meinersbur/src/isl/isl_coalesce.c:3328
#15 0x0000000008052f5d in coalesce_with_expanded_divs (bmap=0x81ea7c0,
i=2, j=5, info=0x81eeaa0, div=0x81e02c0, exp=0x81e6b80) at
/home/meinersbur/src/isl/isl_coalesce.c:3408
#16 0x000000000805314f in coalesce_after_aligning_divs
(bmap_i=0x81e0fd0, i=2, j=5, info=0x81eeaa0) at
/home/meinersbur/src/isl/isl_coalesce.c:3473
#17 0x00000000080534b8 in coalesce_divs (i=2, j=5, info=0x81eeaa0) at
/home/meinersbur/src/isl/isl_coalesce.c:3579
#18 0x0000000008054473 in coalesce_pair (i=2, j=5, info=0x81eeaa0) at
/home/meinersbur/src/isl/isl_coalesce.c:4032
#19 0x00000000080545b4 in coalesce_range (ctx=0x81df390,
info=0x81eeaa0, start1=2, end1=4, start2=4, end2=6) at
/home/meinersbur/src/isl/isl_coalesce.c:4077
#20 0x00000000080546f7 in coalesce (ctx=0x81df390, n=6,
info=0x81eeaa0) at /home/meinersbur/src/isl/isl_coalesce.c:4116
#21 0x0000000008054ea8 in isl_map_coalesce (map=0x81ec410) at
/home/meinersbur/src/isl/isl_coalesce.c:4249
#22 0x0000000008054f3e in isl_set_coalesce (set=0x81eb710) at
/home/meinersbur/src/isl/isl_coalesce.c:4269
#23 0x000000000800b566 in main () at isltrace.c:1632

I tried to reduce this to the failing isl_set_coalesce call, which
unfortunately does not crash:
```
#include <isl/ctx.h>
#include <isl/set.h>
#include <isl/options.h>
#include <isl/version.h>

int main() {
printf("starting..%s\n", isl_version());

isl_ctx *ctx = isl_ctx_alloc();
isl_set *set = isl_set_read_from_str(ctx, "[g, arg] -> { [i0, i1] :
(exists (e0 = floor((1 + g)/2): i0 = 0 and 2e0 = 1 + g and i1 > 0 and
i1 <= -arg)) or (exists (e0 = floor((g)/2): i0 = 0 and 2e0 = g and i1
> 0 and i1 <= -arg)) or (exists (e0 = floor((1 + g)/2): i0 = 0 and i1
= 0 and 2e0 = 1 + g)) or (exists (e0 = floor((g)/2): i0 = 0 and i1 = 0
and 2e0 = g)) or (exists (e0 = floor((1 + g)/2): i0 = 0 and 2e0 = 1 +
g and i1 > 0 and i1 <= -arg)) or (exists (e0 = floor((1 + g)/2): i0 =
0 and i1 = 0 and 2e0 = 1 + g)) }");
set = isl_set_coalesce(set);

isl_set_dump(set);
printf("..success\n");
return 0;
}
```

Michael

--
Tardyzentrismus verboten!

[Sven Verdoolaege]

On Sun, Feb 08, 2026 at 02:08:08AM +0100, Michael Kruse wrote:
> Hi
>
> this is a bug report derived from a crash in Polly:
> https://github.com/llvm/llvm-project/issues/179993
>
> ```
> $ gcc isltrace.c -o isltrace -I ~/src/isl/include/
> ~/src/isl/.libs/libisl.a -lgmp -g

It looks like you forgot attaching isltrace.c.

skimo

[Michael Kruse]

Here is the file.

Sorry for forgetting.

Michael

Am So., 8. Feb. 2026 um 15:30 Uhr schrieb Sven Verdoolaege
<sven.ver...@telenet.be>:

--
Tardyzentrismus verboten!

[Michael Kruse]

I was able to significantly reduce the reproducer size. Please see the
attachment. This was reduced by a script, it was not possible to
reduce the number of calls any further,

Michael

Am So., 8. Feb. 2026 um 19:04 Uhr schrieb Michael Kruse
<Michae...@meinersbur.de>:

--
Tardyzentrismus verboten!

[Sven Verdoolaege]

On Fri, Feb 13, 2026 at 07:40:00PM +0100, Michael Kruse wrote:
> I was able to significantly reduce the reproducer size. Please see the
> attachment. This was reduced by a script, it was not possible to
> reduce the number of calls any further,

Thanks. That's very useful for a regression test.
I have a fix locally, but it has some fall-out.
I'm trying to see if I can avoid some of that.

skimo