[autodiff] bwd_diff of a [Differentiable] loop with a runtime (non-constant) induction start crashes (SPIR-V ICE / CUDA SIGSEGV)

[nv-slang-bot]

Summary

Reverse-mode autodiff (bwd_diff) of a [Differentiable] function that contains a [MaxIters(N)] loop whose induction start value is a non-constant runtime expression miscompiles. On SPIR-V it is a hard compile-time internal error; on CUDA/HLSL it compiles but emits a use-before-def that crashes at runtime (SIGSEGV). The forward pass is always correct, and a mathematically-identical zero-based rewrite produces correct gradients.

Escalated from shader-slang/slangpy#1051 (external reporter, clean SlangPy repro + bisection). SlangPy delegates all loop reverse-mode differentiation to the compiler's bwd_diff intrinsic; the root cause is in the compiler's autodiff pass, reproduced below in pure Slang with no SlangPy involved.

Minimal reproducer (pure Slang, top-of-tree)

[Differentiable]
float f(float x, no_diff int radius)
{
    float acc = 0.0;
    [MaxIters(17)]
    for (int dx = -radius; dx <= radius; ++dx)   // induction START is a runtime value
        acc += x * float(dx);                    // induction var used in the differentiable body
    return acc;
}
[shader("compute")][numthreads(1,1,1)]
void computeMain(uniform RWStructuredBuffer<float> o, uniform int radius)
{
    var dp = diffPair(2.0f, 0.0f);
    bwd_diff(f)(dp, radius, 1.0);
    o[0] = dp.d;
}

slangc min.slang -target spirv -entry computeMain -stage compute -o out.spv

produces:

error[E99997]: Slang compilation aborted due to an exception of N5Slang13InternalErrorE
  unimplemented: Unhandled global inst in spirv-emit:
  let  %1 : _ = neg(<null>)

-target cuda compiles but emits a reverse function that references the loop's start value from the forward function's scope (use-before-def) → runtime SIGSEGV, matching slangpy#1051's crash on Metal/CUDA/Vulkan.

The trigger is a runtime (non-constant) start — not "negative"

Loop start	SPIR-V result
dx = -2 (constant)	compiles clean
dx = 1 (constant)	compiles clean
dx = -radius (runtime)	ICE: neg(<null>)
dx = radius; dx >= 0; --dx (runtime)	ICE: param

A zero-based rewrite (for (int t = 0; t < 2*radius+1; ++t) { int dx = t - radius; ... }) compiles and gives correct gradients — it makes the start value the constant 0.

Root cause

In source/slang/slang-ir-autodiff-primal-hoist.cpp:

• The reverse pass inserts a synthetic loop counter (lowerIndexedRegion) and checkpoints are sized/indexed by that counter — decoupled from the user's induction variable. So this is not a checkpoint-index/OOB problem.
• An induction variable dx is classified as an affine function of the counter, capturing counterOffset = loopInst->getArg(paramIndex) (~line 1034) — i.e. the loop phi's initial argument, an instruction that lives in the primal init block.
• In the reverse block, applyToInst reconstructs dx as diffCountParam (* counterFactor) + counterOffset and uses inductionValueInfo.counterOffset directly (~lines 1355–1361), with no constant-guard and no remap into the reverse scope. When counterOffset is a module-global constant it is in scope everywhere (constant start → fine); when it is a runtime primal-function instruction (neg(radius), or a param) it is not live in the reverse scope → a dangling cross-scope reference → orphan global inst at emit (SPIR-V ICE) / use-before-def (CUDA).
• The sibling loop-exit-value inference path already guards exactly this: if (!isIntegerConstantValue(inductionValueInfo->counterOffset)) continue; (~line 1153). The reconstruction path lacks the equivalent handling. That asymmetry is the defect.

Suggested direction

• Fix (root cause): the loop-initial counterOffset is loop-invariant, so materialize it in the reverse scope via the existing recompute/clone path (use cloneCtx->cloneEnv.mapOldValToNew if present; note first-block function params are already available in-function) before emitting the reconstruction add. This brings runtime-start loops to parity with the zero-based form and benefits all autodiff consumers.
• Stopgap (optional, pair with the fix): if the offset cannot be made available, emit an actionable diagnostic instead of dangling IR. A bare continue (as in the exit-value path) is not safe here — reconstruction must produce a replacement or the SLANG_ASSERT(replacement) at ~line 1364 fires.

A regression test can run without a GPU (-cpu COMPARE_COMPUTE comparing runtime-start vs zero-based gradients, or a -target spirv compile test that must stop ICEing).

_{🤖 Generated by an automated Slang coworker — may be inaccurate. A human maintainer should verify.}

[nv-slang-bot]

Triage verdict — refreshed: fix now in flight as #12299; the bot's draft #12072 is superseded

• Status: Still open and unfixed at master HEAD 53b76e6d3 (re-verified today by direct source read, not from cached notes — see the code trace below). A fix is in flight as #12299 — "Preserve runtime induction values in reverse differentiation" (Fixes #12070), opened 2026-07-30 by the assignee @saipraveenb25. It is non-draft, pr: non-breaking, head cafd4339b6, and CI is green (43/43 checks success, combined status success).
• Correction to my previous comment: that comment said the fix was draft PR Fix reverse-mode autodiff for runtime induction start (#12070) #12072 and only needed a ready-flip. That is now stale. Fix reverse-mode autodiff for runtime induction start (#12070) #12072 should be closed in favour of Preserve runtime induction values in reverse differentiation #12299 — same file and same reconstruction site, but Preserve runtime induction values in reverse differentiation #12299 is the broader and more principled change, and it is the assignee's own. I've left a note on Fix reverse-mode autodiff for runtime induction start (#12070) #12072 to that effect; closing it is a maintainer action, not mine.
• Verdict (root cause unchanged, and Preserve runtime induction values in reverse differentiation #12299's analysis agrees): in source/slang/slang-ir-autodiff-primal-hoist.cpp, collectInductionValues records info.counterOffset = loopInst->getArg(paramIndex) (L1034 at this HEAD) — the loop phi's initial argument, an instruction living in the primal region. The reverse-region reconstruction in applyToInst then feeds it straight into emitAdd (L1355–1361) with no clone-mapping lookup, no checkpoint registration, and no constant guard. A compile-time-constant offset is module-scope and therefore in scope everywhere (constant start, even -2, is fine); a runtime offset (neg(radius), or a bare param) dangles once the unzip pass splits primal/reverse into separate functions → SPIR-V orphaned-global ICE (neg(<null>)) / CUDA·HLSL·Metal use-before-def → SIGSEGV. The asymmetry is the tell: the sibling exit-value path does guard this exact condition at L1154 (if (!isIntegerConstantValue(inductionValueInfo->counterOffset)) continue;); the reconstruction path never got the equivalent. All three sites are unchanged at 53b76e6d3, and tests/autodiff/ still contains no runtime-induction-start coverage.
• How Preserve runtime induction values in reverse differentiation #12299 differs from the superseded draft: the draft added an unconditional storeSet.add(counterOffset) at the reconstruction site (15 lines, 1 test). Preserve runtime induction values in reverse differentiation #12299 instead registers the offset as a synthetic checkpoint dependency in processFunc, so the existing policy decides recompute-vs-store, then consumes the policy's answer at reconstruction (clone mapping when recomputed; left for ensurePrimalAvailability when stored). It also fixes a second, independent defect the draft missed — the synthetic reverse count is always int, so affine arithmetic on an int16_t/int64_t induction variable formed a mixed-width add (invalid SPIR-V); Preserve runtime induction values in reverse differentiation #12299 converts the count to the induction type before the factor/offset ops and drops the now-dead trailing cast. Five files, +240/−10, with four new tests (runtime start, nested, non-unit strides, scalar widths) against the draft's one. I have read both diffs; I have not run an independent correctness review of Preserve runtime induction values in reverse differentiation #12299.
• Next action / blocker: review and merge Preserve runtime induction values in reverse differentiation #12299 — it is mergeable: true but mergeable_state: blocked, i.e. waiting on an approving human review (no reviewer is currently requested; the only reviews on it are automated plus the author's own). Nothing else blocks it. Downstream, this issue's origin slangpy#1051 and the SlangPy-side xfail regression test slangpy#1053 both stay parked on this merge; the reporter's zero-based-rewrite workaround remains valid until then.

_{🤖 Generated by an automated Slang coworker — may be inaccurate. A human maintainer should verify.}