LLVM Bugzilla is read-only and represents the historical archive of all LLVM issues filled before November 26, 2021. Use github to submit LLVM bugs

Bug 42618 - CVP: adding nuw flags not correct in the presence of undef
Summary: CVP: adding nuw flags not correct in the presence of undef
Status: RESOLVED FIXED
Alias: None
Product: libraries
Classification: Unclassified
Component: Scalar Optimizations (show other bugs)
Version: trunk
Hardware: All All
: P normal
Assignee: Unassigned LLVM Bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-07-14 08:07 PDT by Nuno Lopes
Modified: 2020-03-31 07:46 PDT (History)
5 users (show)

See Also:
Fixed By Commit(s):

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Nuno Lopes 2019-07-14 08:07:45 PDT 
The following unit test shows incorrect behavior regarding undef inputs:
$ opt -correlated-propagation -cvp-dont-add-nowrap-flags=false Transforms/CorrelatedValuePropagation/sub.ll

The issue is the branch on undef, which if we assume is a non-deterministic jump, leads to branch %then, which then does a 'sub nuw' on an undef (which is poison).

Possible solutions: same as in #42617.


define i32 @test11(* %p, i32 %i) {
  %limit = load i32, * %p, align 4
  %range_l#0%limit = icmp sge i32 %limit, 0
  %range_h#0%limit = icmp slt i32 %limit, 2147483647
  %range#0%limit = and i1 %range_l#0%limit, %range_h#0%limit
  assume_non_poison i1 %range#0%limit
  %within.1 = icmp slt i32 %limit, %i
  %i.minus.7 = add i32 %i, 4294967289
  %within.2 = icmp slt i32 %limit, %i.minus.7
  %within = and i1 %within.1, %within.2
  br i1 %within, label %then, label %else

%then:
  %i.minus.6 = sub i32 %i, 6
  ret i32 %i.minus.6

%else:
  ret i32 0
}
=>
define i32 @test11(* %p, i32 %i) {
  %limit = load i32, * %p, align 4
  %range_l#0%limit = icmp sge i32 %limit, 0
  %range_h#0%limit = icmp slt i32 %limit, 2147483647
  %range#0%limit = and i1 %range_l#0%limit, %range_h#0%limit
  assume_non_poison i1 %range#0%limit
  %within.1 = icmp slt i32 %limit, %i
  %i.minus.7 = add i32 %i, 4294967289
  %within.2 = icmp slt i32 %limit, %i.minus.7
  %within = and i1 %within.1, %within.2
  br i1 %within, label %then, label %else

%then:
  %i.minus.6 = sub nsw nuw i32 %i, 6
  ret i32 %i.minus.6

%else:
  ret i32 0
}
Transformation doesn't verify!
ERROR: Target is more poisonous than source

Example:
* %p = #x2dc920000000
i32 %i = undef

Source:
i32 %limit = #x00000000 (0)
i1 %range_l#0%limit = #x1 (1)
i1 %range_h#0%limit = #x1 (1)
i1 %range#0%limit = #x1 (1)
i1 %within.1 = undef
i32 %i.minus.7 = undef
i1 %within.2 = undef
i1 %within = undef
i32 %i.minus.6 = undef

Target:
i32 %limit = #x00000000 (0)
i1 %range_l#0%limit = #x1 (1)
i1 %range_h#0%limit = #x1 (1)
i1 %range#0%limit = #x1 (1)
i1 %within.1 = undef
i32 %i.minus.7 = undef
i1 %within.2 = undef
i1 %within = undef
i32 %i.minus.6 = poison
Source value: undef
Target value: poison
Comment 1 Nuno Lopes 2020-03-31 07:46:23 PDT 
We now have langref stating that jump on undef is UB. So this one is good.