IGC heap corruption compiling findmax's reduction kernel on Julia 1.12 with --check-bounds=yes #691

On Julia 1.12, the GPUArrays testsuite's gpuarrays/indexing find test kills its worker while compiling a kernel:

free(): invalid next size (fast)

[108861] signal 6 (-6): Aborted
__libc_free at /lib/x86_64-linux-gnu/libc.so.6
unknown function at .../libigc.so
...
IGC::IgcOclTranslationCtx<0ul>::Impl::Translate(...) at .../libigc.so
L0::ModuleTranslationUnit::compileGenBinary(...) at .../libze_intel_gpu.so.1
L0::zeModuleCreate(...)
link_kernel at src/compiler/compilation.jl:366
...
mapreduce_1d_gpu at AcceleratedKernels/src/reduce/mapreduce_1d_gpu.jl:109
...
findmax at GPUArrays/src/host/indexing.jl:309
GPUArrays/test/testsuite/indexing.jl:234

Sometimes it's a segfault in libigc.so instead of the abort; it's heap corruption. This has failed the Julia 1.12 job on main since #665 (GPUArrays 12, which routes findmax through AcceleratedKernels' _mapreduce_block!): 1785, 1799, 1800. The 1.10, 1.11, 1.13 and nightly jobs pass, and pull requests don't run 1.12, so it didn't show up before the merge. It also reproduces locally on main (fa0f23a) on an Iris Xe (TGL), with NEO 26.18.38308 and libigc 2.34.4+3.

Reproducer

It needs Julia 1.12 and --check-bounds=yes, as the test runner uses:

# julia +1.12 --check-bounds=yes
using oneAPI
x = oneArray(randn(Float32, 100))
findmax(abs, x)

Without --check-bounds=yes it works. The element types the test runner adds don't matter: the failing test uses Float32.

Cause

This is an IGC bug that is already fixed upstream. The first pass of _mapreduce_block! gets a loop whose induction variable increments are turned into llvm.uadd.with.overflow.i64 (OpIAddCarry in the SPIR-V), and IGC's optimizer then folds the extractvalues of two of those calls into a PHI of the whole {i64, i1} struct. IGC's LegalizationPass lowers *.with.overflow intrinsics by replacing their extractvalue users and erasing the call. It only expects extractvalue users (a debug build asserts "Did not expect anything but an extract after uadd_with_overflow"; release builds skip the assertion), so the PHI is left using a deleted instruction. The IGC IR dump after LegalizationPass (IGC_ShaderDumpEnableAll=1) shows phi { i64, i1 } [ <badref>, ... ], and the compiler crashes in a later pass or in free.

The SPIR-V is valid (spirv-val passes). It reproduces offline with ocloc, so the GPU and the driver aren't involved. A reduced kernel:

               OpCapability Kernel
               OpCapability Addresses
               OpCapability Int64
          %1 = OpExtInstImport "OpenCL.std"
               OpMemoryModel Physical64 OpenCL
               OpEntryPoint Kernel %kernel "kernel"
               OpExecutionMode %kernel ContractionOff
               OpSource OpenCL_CPP 100000
      %ulong = OpTypeInt 64 0
       %bool = OpTypeBool
       %void = OpTypeVoid
         %15 = OpTypeFunction %void %ulong %bool
 %_struct_16 = OpTypeStruct %ulong %ulong
         %17 = OpConstantNull %ulong
%ulong_18446744073709551615 = OpConstant %ulong 18446744073709551615
    %ulong_1 = OpConstant %ulong 1
     %kernel = OpFunction %void None %15
          %n = OpFunctionParameter %ulong
          %c = OpFunctionParameter %bool
      %entry = OpLabel
               OpSwitch %n %outer_preheader 0 %exit 1 %exit
%outer_preheader = OpLabel
         %23 = OpIAdd %ulong %n %ulong_18446744073709551615
               OpBranch %outer
      %outer = OpLabel
               OpBranchConditional %c %inner_preheader %exit_loopexit1
%inner_preheader = OpLabel
               OpBranch %inner
      %inner = OpLabel
         %24 = OpPhi %ulong %23 %inner_preheader %25 %inner_cont
         %26 = OpIAddCarry %_struct_16 %24 %ulong_1
         %25 = OpCompositeExtract %ulong %26 0
         %27 = OpCompositeExtract %ulong %26 1
         %28 = OpINotEqual %bool %27 %17
               OpBranchConditional %28 %latch %inner_cont
 %inner_cont = OpLabel
               OpBranchConditional %c %inner %exit_loopexit
%exit_loopexit = OpLabel
               OpBranch %exit
%exit_loopexit1 = OpLabel
               OpBranch %exit
       %exit = OpLabel
               OpReturn
      %latch = OpLabel
               OpBranch %outer
               OpFunctionEnd

$ spirv-as --target-env spv1.4 repro.spvasm -o repro.spv
$ ocloc compile -spirv_input -file repro.spv -device tgllp
Segmentation fault

It crashes with libigc 2.34.4+1, +2 and +3 (so it isn't related to our backports) and with libigc 2.22.2.

Fix

intel/intel-graphics-compiler@522dc70 ("Add support for non-extract users of llvm.*.with.overflow intrinsics", first in v2.42.0) rebuilds the struct with insertvalue for any user that isn't an extractvalue. Its test covers freeze users, but the change handles PHI users the same way. The patch applies cleanly to v2.34.4, so it could be backported to libigc_jll like #670 and #678, ideally with a LIT test for the PHI case.