LLVM Bugzilla is read-only and represents the historical archive of all LLVM issues filled before November 26, 2021. Use github to submit LLVM bugs

Bug 44533 - StraightLineStrengthReduce can introduce UB when optimizing 2-dim array gep
Summary: StraightLineStrengthReduce can introduce UB when optimizing 2-dim array gep
Status: NEW
Alias: None
Product: libraries
Classification: Unclassified
Component: Scalar Optimizations (show other bugs)
Version: trunk
Hardware: PC All
: P enhancement
Assignee: Unassigned LLVM Bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-01-13 00:12 PST by Juneyoung Lee
Modified: 2020-09-24 11:11 PDT (History)
5 users (show)

See Also:
Fixed By Commit(s):


Attachments
Input (453 bytes, text/plain)
2020-01-13 00:12 PST, Juneyoung Lee
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Juneyoung Lee 2020-01-13 00:12:20 PST
Created attachment 23013 [details]
Input

```
$ cat slsr-gep.ll 
target datalayout = "e-i64:64-v16:16-v32:32-n16:32:64-p:64:64:64-p1:32:32:32"

define void @f([10 x [5 x i32]]* %input, i64 %s, i64 %t) {
  %p0 = getelementptr inbounds [10 x [5 x i32]], [10 x [5 x i32]]* %input, i64 0, i64 %s, i64 %t
  call void @foo(i32* %p0)

  %s2 = shl nsw i64 %s, 1
  %p1 = getelementptr inbounds [10 x [5 x i32]], [10 x [5 x i32]]* %input, i64 0, i64 %s2, i64 %t
  call void @foo(i32* %p1)

  ret void
}

declare void @foo(i32*)

$ opt -slsr -S -o - slsr-gep.ll
; ModuleID = 'slsr-gep.ll'
target datalayout = "e-i64:64-v16:16-v32:32-n16:32:64-p:64:64:64-p1:32:32:32"
define void @f([10 x [5 x i32]]* %input, i64 %s, i64 %t) {
  %p0 = getelementptr inbounds [10 x [5 x i32]], [10 x [5 x i32]]* %input, i64 0, i64 %s, i64 %t
  call void @foo(i32* %p0)
  %1 = mul i64 %s, 5
  %p1 = getelementptr inbounds i32, i32* %p0, i64 %1
  call void @foo(i32* %p1)
  ret void
}
declare void @foo(i32*)
```

(the test excerpted from Transforms/StraightLineStrengthReduce/slsr-gep.ll)

This is incorrect when input[s][t] is not inbounds but input[s2][t] is inbounds.
For example, if s = 1, s2 = 2, and t = -6, it can happen.
After optimization, %p1 becomes poison.

One possible solution for this is to allow the transformation when %s and %t have a same sign bit. Will this solution be effective enough?
Comment 1 Nuno Lopes 2020-09-24 11:11:31 PDT
An alternative fix would be to remove inbounds from the base pointer, thus allowing it to overflow.