Add change_type() directive with reduction-aware overflow checks by alexreinking · Pull Request #9257 · halide/Halide

alexreinking · 2026-07-29T19:07:22Z

Adds a new .change_type() directive to Halide that takes a type S and replaces a func F of type T with:

F : T = e  ~>  F_intm : S = e' ; F : T = cast(T, F_intm)

Where e' : S is a type-adjusted version of e : T such that e = cast(T, e').

We use FuncValueBounds and lossless_cast to ensure that the replaced type will not perturb values in the pipeline. The directive is aware of reductions and will add runtime asserts to ensure that accumulations are not too long if the extent cannot be proven sufficiently short.

When constructing e', change_type might adjust the form to use widening intrinsics. For instance, the result of changing the type of f32(i8a) * f32(i8b) to Int32 would be cast<int32>(widening_mul(i8a, i8b)), which is bitwise exact.

A prototype of this was written over several sessions involving several LLMs. I probably wrote as much prompt as code was produced, and I feel that the ultimate implementation is more mine than any LLM's. The tests were written by machine outright, however.

Breaking changes

None: this is a new directive.

Checklist

Tests added or updated (not required for docs, CI config, or typo fixes)
Documentation updated (if public API changed)
Python bindings updated (if public API changed)
Benchmarks are included here if the change is intended to affect performance.
Commits include AI attribution where applicable (see Code of Conduct)

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

codecov · 2026-07-30T02:32:10Z

Codecov Report

❌ Patch coverage is 74.24547% with 128 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.79%. Comparing base (8cf05ac) to head (9aff833).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
src/Func.cpp	74.38%	32 Missing and 51 partials ⚠️
src/IROperator.cpp	60.52%	8 Missing and 22 partials ⚠️
src/AssociativeOpsTable.cpp	66.66%	2 Missing and 3 partials ⚠️
src/AddTypeChangeChecks.cpp	71.42%	2 Missing and 2 partials ⚠️
src/ConstantBounds.cpp	80.00%	0 Missing and 2 partials ⚠️
src/ConstantInterval.cpp	84.61%	0 Missing and 2 partials ⚠️
src/Lower.cpp	66.66%	0 Missing and 1 partial ⚠️
src/Schedule.cpp	87.50%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9257      +/-   ##
==========================================
- Coverage   70.06%   69.79%   -0.28%     
==========================================
  Files         258      259       +1     
  Lines       78702    79163     +461     
  Branches    19160    19310     +150     
==========================================
+ Hits        55143    55250     +107     
- Misses      17871    17968      +97     
- Partials     5688     5945     +257

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

abadams · 2026-08-03T21:21:06Z

+// guaranteed not to overflow. Safety is monotonic in the term count, so use
+// ConstantInterval's overflow-aware arithmetic in a binary search rather than
+// duplicating its endpoint math here.
+int64_t maximum_safe_term_count(const ConstantInterval &accumulator,


Is this just (limit.min - accumulator.max) / step.max ?

Not quite — accumulator, step, and limit are all general intervals here, not single points, and step's sign isn't fixed (a difference reduction negates the term, and even a single call's term range can straddle zero). That means the binding constraint can be the upper limit, the lower limit, or both, and a single division can't combine both endpoints' worst cases safely — it also breaks if step's interval contains zero. Rather than hand-deriving and separately overflow-hardening the endpoint math for every sign/zero combination, the binary search just reuses ConstantInterval's already-audited overflow-safe +/*, so limit.contains(accumulator + step * ConstantInterval(0, n)) is trivially correct for any sign combination. Added a comment (now on maximum_safe_term_count) explaining this.

^ Quoting Claude here and elsewhere.

Maybe ((limit - accumulator)/step).min then?

Maybe ((limit - accumulator)/step).min then?

No. Here's a concrete input that deviates:

Condition failed: proposed == min_safe Error: maximum_safe_term_count() binary search disagrees with the closed-form bound: proposed = -2147483648 min_safe = 131071 --- inputs --- accumulator = [0, 0] step = [-16256, 16384] limit = [-2147483648, 2147483647]

Is this just (limit.min - accumulator.max) / step.max ?

No. Here's a concrete input that deviates:

Condition failed: proposed == min_safe Error: maximum_safe_term_count() binary search disagrees with the closed-form bound: proposed = -131072 min_safe = 131071 --- inputs --- accumulator = [0, 0] step = [-16256, 16384] limit = [-2147483648, 2147483647]

abadams · 2026-08-10T19:09:41Z

+// Prove that the first update executes at least once for every pure coordinate,
+// as required when translating an identity that does not round-trip through the
+// target type. Symbolic extents produce a runtime precondition.
+std::optional<std::string> nonempty_dense_update_precondition(const Function &fn,


For example, consider a min-histogram, in which you want to know the min value associated with each bucket instead of a count of the values that fall into each bucket. E.g. for every pixel in an image, for each possible value or r, what is the smallest value of g? Computed as float, you would initialize the histogram to inf. You might want to retype this to int if the values you are considering are ints. But as an int, there's no way to distinguish between "this bucket was never touched", and "the min value associated with this bucket was some sentinel integer (e.g. 255)". So we must add as a predicate that we know every bucket was touched.

abadams · 2026-08-10T19:10:33Z

+            if (*ext <= 0) {
+                return "the first update has an empty reduction domain";
+            }
+        } else if (optional<uint64_t> ext = as_const_uint(extent)) {


I didn't think reduction domain bounds could be uints

abadams · 2026-08-10T19:19:57Z

+        // below; every other combiner can grow it faster than a single term's
+        // range in a way we don't model -- a product reduction most importantly,
+        // or an unrecognized shape -- so reject it rather than silently overflow.
+        if (!op || (*op != IRNodeType::Add && *op != IRNodeType::Sub)) {


Maybe add a TODO for saturating add. I'm thinking we want roughly the same list as the VectorReduce op enum, and I think saturating add is the only thing missing.

abadams · 2026-08-10T19:25:24Z

 }

+void Function::clear_definition() {
+    contents->output_types.clear();


Consider *contents = FunctionContents{}

(So that new members of FunctionContents aren't missed)

I think that new members need consideration in either direction, but I implemented it as a "what to keep" rather than "what to clear".

abadams · 2026-08-10T19:29:27Z

+Expr make_binary_op(IRNodeType t, const Expr &a, const Expr &b) {
+    switch (t) {
+    case IRNodeType::Add:
+        return a + b;


I think these should probably use the ::make methods to avoid all the type coercion logic. Or might you want type coercion somewhere here?

abadams · 2026-08-10T19:32:10Z

+
+/** Build a binary expression of node type `t` from operands `a` and `b`, using
+ * the corresponding operator overload (so the usual type matching and constant
+ * folding apply). `t` must be a binary operator; it is an internal error otherwise. */


I don't think there's any constant folding (so at least fix the comment if you still want type coercion)

abadams · 2026-08-10T19:33:31Z

I think this needs a fuzzer but it could be a follow-up PR. This is a new feature so we're not going to break anyone if there's a subtle bug in it.

abadams

lgtm once segfault is fixed

Add Func::change_type(Type, unsafe), which changes the type at which a Func computes and stores its values. It works eagerly at schedule time by splitting the Func in two: a returned intermediate that copies the Func's definitions but accumulates at the new type (inserting casts, preferring integer forms like widening_mul over float round-trips), and the original Func, rewritten in place into an inline wrapper that casts the intermediate's result back to the original type so every existing consumer is unaffected. Safety is validated with the bounds machinery: for an integer target, change_type() bounds the accumulator by combining the per-term value range (constant_integer_bounds augmented by FuncValueBounds) with the reduction extent. Statically-safe cases pass silently; a case provable only under a runtime precondition (symbolic RDom extent) records that condition, which a new lowering pass (add_type_change_checks, modeled on add_split_factor_checks) injects into the pipeline's assertion block and no_asserts strips. Otherwise change_type() errors unless unsafe=true. Supporting changes: Function::clear_definition() to redefine a Func in place as the wrapper; FuncSchedule carries the injected type_change_checks; get_associative_identity() for retyped reduction identities; StrictifyFloat treats int<->float casts as strict so change_type() won't strip a user's strict_cast. Adds as_binary_operands()/make_binary_op() and select_binary_operand() as reusable binary-operator helpers, placed early in Func.cpp (alongside project_rdom()) so hoist_invariants() can reuse all three without redefining them. Adds a Python binding.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

change_type_prove_safe() was only invoked for integer targets, so retyping a reduction to a float type got no safety check at all. Run it for float targets too, bounding the accumulation against the largest integer the target can represent exactly (e.g. 2048 for float16) rather than its full dynamic range. Also fixes bounds_of() to recover the exact integer value of a leaf that retype_leaf() constant-folded directly into a float literal (e.g. a seed of 0), which it previously treated as unbounded. Adds test coverage for float targets, and for sum-then-clamp, sum-scan, and histogram reductions confirming the existing extent-based bound is conservative for those shapes too.

…_integer_bounds Replace the eager cache_call_bounds() prewarming pass with an optional FuncValueBounds parameter on constant_integer_bounds() and lossless_cast(), consulted lazily when either function hits a Call::Halide node. Also add a codegen test verifying that a change_type() retype from float to Int(32) reaches CodeGen_ARM's dot-product instruction selection. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

alexreinking force-pushed the alexreinking/change-type branch 2 times, most recently from 75752de to 6f0a76e Compare July 29, 2026 19:59

alexreinking force-pushed the alexreinking/change-type branch 3 times, most recently from f352290 to 0fdc17c Compare July 30, 2026 15:20

abadams reviewed Jul 30, 2026

View reviewed changes

Comment thread src/Func.h

alexreinking force-pushed the alexreinking/change-type branch from 53d147e to 085bf96 Compare July 30, 2026 20:11

alexreinking force-pushed the alexreinking/change-type branch from 085bf96 to 9458298 Compare July 31, 2026 15:49

alexreinking force-pushed the alexreinking/change-type branch from 5376049 to daf9049 Compare July 31, 2026 21:30

alexreinking marked this pull request as ready for review August 1, 2026 03:18

abadams reviewed Aug 3, 2026

View reviewed changes

Comment thread src/Func.h

abadams reviewed Aug 3, 2026

View reviewed changes

Comment thread src/Func.cpp

alexreinking force-pushed the alexreinking/change-type branch from daf9049 to 4e4989d Compare August 4, 2026 19:39

alexreinking force-pushed the alexreinking/change-type branch from 4e4989d to 4237483 Compare August 4, 2026 21:37

alexreinking force-pushed the alexreinking/change-type branch from 4237483 to db7edbe Compare August 4, 2026 22:13

alexreinking added the release_notes For changes that may warrant a note in README for official releases. label Aug 5, 2026

alexreinking force-pushed the alexreinking/change-type branch from db7edbe to fc7e2ad Compare August 7, 2026 07:52

abadams reviewed Aug 7, 2026

View reviewed changes

Comment thread test/correctness/change_type.cpp

abadams reviewed Aug 7, 2026

View reviewed changes

Comment thread src/ConstantInterval.cpp

abadams reviewed Aug 7, 2026

View reviewed changes

Comment thread src/Func.cpp Outdated

abadams reviewed Aug 10, 2026

View reviewed changes

alexreinking force-pushed the alexreinking/change-type branch 2 times, most recently from be4b51f to 70a3120 Compare August 13, 2026 14:23

abadams approved these changes Aug 13, 2026

View reviewed changes

alexreinking and others added 18 commits August 15, 2026 14:26

Add tests for change_type() directive

db74af9

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Fix change_type soundness checks

953d72e

Refactor get_associative_identity

f9a24ff

Appease clang-tidy

02ff163

Add narrow-blocks test

054bdda

Drop stale TODO

437e957

Serialize type-change checks

fc5af09

Add follow_global_wrappers arguments

f72bf43

Implement covering_constant_interval with constant_integer_bounds

c2da8c6

Improve comment on int-to-float cast-stripping

232c410

Make retype_value not-recursive, clarify comment.

46279db

Drop impossible uint case for RVar extent

e5e7aa7

Use Op::make rather than Op's operator overload

eff2cef

Clarify comment for nonempty_dense_update_precondition

7c1854e

Add TODO for saturating_add/sub

9aff833

alexreinking force-pushed the alexreinking/change-type branch from 70a3120 to 9aff833 Compare August 15, 2026 18:26

alexreinking merged commit cf57c70 into main Aug 16, 2026
27 checks passed

Uh oh!

Conversation

alexreinking commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Breaking changes

Checklist

Uh oh!

codecov Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

abadams Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

abadams commented Aug 10, 2026

Uh oh!

abadams left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

alexreinking commented Jul 29, 2026 •

edited

Loading

codecov Bot commented Jul 30, 2026 •

edited

Loading

abadams Aug 10, 2026 •

edited

Loading