Burst compiler can't do "pointer + -1" or "pointer - -1"

Unity Engine
,
1

These two operations are not equivalent when compiled with [BurstCompile]; they are without the attribute.
pointer = pointer + -1;
pointer = pointer - 1;
the same goes for these two:
pointer = pointer - -1;
pointer = pointer + 1;

test code:

        unsafe {
            DebugJob debugJob = new DebugJob();
            System.IntPtr[] ptrs = new System.IntPtr[1000];
            fixed (void* ptr = ptrs) {
                debugJob.pointers = (int**)ptr;
                debugJob.Schedule().Complete();
                Debug.LogWarning($"Ptr 10 -> {ptrs[10].ToInt64()}");
                Debug.LogWarning($"Ptr 20 -> {ptrs[20].ToInt64()}");
                Debug.LogWarning($"Ptr 30 -> {ptrs[30].ToInt64()}");
                Debug.LogWarning($"Ptr 40 -> {ptrs[40].ToInt64()}");
            }
        }

job code:

    [BurstCompile] public unsafe struct DebugJob : IJob
   {
       [NativeDisableUnsafePtrRestriction] public int** pointers;

       [BurstCompile] public unsafe void Execute ()
       {
           pointers[10] = pointers[10] + +1;
           pointers[20] = pointers[20] - +1;
           pointers[30] = pointers[30] - -1;
           pointers[40] = pointers[40] + -1;
       }
   }

When ran, this gives the following result:

Ptr 10 -> 4
Ptr 20 -> -4
Ptr 30 -> -17179869180
Ptr 40 -> 17179869180

Without Burst, you get “4, -4, 4, -4” which is the expected result.

The generated assembly for the above test job is like this:

        mov        rax, qword ptr [rcx]
        add        qword ptr [rax + 80], 4
        add        qword ptr [rax + 160], -4
        movabs        rcx, -17179869180
        add        qword ptr [rax + 240], rcx
        movabs        rcx, 17179869180
        add        qword ptr [rax + 320], rcx

I ran into this bug in a project of mine (at GitHub - pipliz/cpuvox: A C# implementation of voxlap-style rendering, using Unity and their Burst compiler ); there I have a method that is called with a -1 or a 1 via a parameter, which then gets inlined all the way into a “pointer + -1”; which then crashes due to the invalid pointer generated.

1 Like
2

Thanks for this, we have logged an issue and it is being investigated.

1 Like