LLVM Bugzilla is read-only and represents the historical archive of all LLVM issues filled before November 26, 2021. Use github to submit LLVM bugs

Bug 45956 - Jumpthreading introduces jump on poison
Summary: Jumpthreading introduces jump on poison
Status: NEW
Alias: None
Product: libraries
Classification: Unclassified
Component: Scalar Optimizations (show other bugs)
Version: trunk
Hardware: All All
: P normal
Assignee: Unassigned LLVM Bugs
URL:
Keywords: miscompilation
Depends on:
Blocks: 46144
  Show dependency tree
 
Reported: 2020-05-17 05:30 PDT by Nuno Lopes
Modified: 2020-07-26 03:44 PDT (History)
6 users (show)

See Also:
Fixed By Commit(s):


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Nuno Lopes 2020-05-17 05:30:55 PDT
Test: Transforms/JumpThreading/select.ll
Summary: the optimized code has a new jump on `%phitmp`, which is UB if either %y or %z are poison. The original code doesn't have any jump depending on either of these values. A correct version requires introducing of freeze.


define i32 @unfold3(i32 %u, i32 %v, i32 %w, i32 %x, i32 %y, i32 %z, i32 %j) {
%entry:
  %add3 = add nsw i32 %j, 2
  %cmp.i = icmp slt i32 %u, %v
  br i1 %cmp.i, label %.exit, label %cond.false.i

%cond.false.i:
  %cmp4.i = icmp sgt i32 %u, %v
  br i1 %cmp4.i, label %.exit, label %cond.false.6.i

%cond.false.6.i:
  %cmp8.i = icmp slt i32 %w, %x
  br i1 %cmp8.i, label %.exit, label %cond.false.10.i

%cond.false.10.i:
  %cmp13.i = icmp sgt i32 %w, %x
  br i1 %cmp13.i, label %.exit, label %cond.false.15.i

%cond.false.15.i:
  %phitmp = icmp sge i32 %y, %z
  br label %.exit

%.exit:
  %cond23.i = phi i1 [ 0, %entry ], [ 1, %cond.false.i ], [ 0, %cond.false.6.i ], [ %phitmp, %cond.false.15.i ], [ 1, %cond.false.10.i ]
  %j.add3 = select i1 %cond23.i, i32 %j, i32 %add3
  ret i32 %j.add3
}
=>
define i32 @unfold3(i32 %u, i32 %v, i32 %w, i32 %x, i32 %y, i32 %z, i32 %j) {
%entry:
  %add3 = add nsw i32 %j, 2
  %cmp.i = icmp slt i32 %u, %v
  br i1 %cmp.i, label %.exit.thread3, label %cond.false.i

%cond.false.i:
  %cmp4.i = icmp sgt i32 %u, %v
  br i1 %cmp4.i, label %.exit.thread, label %cond.false.6.i

%cond.false.6.i:
  %cmp8.i = icmp slt i32 %w, %x
  br i1 %cmp8.i, label %.exit.thread3, label %cond.false.10.i

%cond.false.10.i:
  %cmp13.i = icmp sgt i32 %w, %x
  br i1 %cmp13.i, label %.exit.thread, label %.exit

%.exit:
  %phitmp = icmp sge i32 %y, %z
  br i1 %phitmp, label %.exit.thread, label %.exit.thread3

%.exit.thread:
  br label %.exit.thread3

%.exit.thread3:
  %0 = phi i32 [ %j, %.exit.thread ], [ %add3, %.exit ], [ %add3, %entry ], [ %add3, %cond.false.6.i ]
  ret i32 %0
}
Transformation doesn't verify!
ERROR: Source is more defined than target

Example:
i32 %u = #x2ba5afc9 (732278729)
i32 %v = #x2ba5afc9 (732278729)
i32 %w = #x400000c1 (1073742017)
i32 %x = #x400000c1 (1073742017)
i32 %y = poison
i32 %z = poison
i32 %j = poison

Source:
i32 %add3 = poison
i1 %cmp.i = #x0 (0)
i1 %cmp4.i = #x0 (0)
i1 %cmp8.i = #x0 (0)
i1 %cmp13.i = #x0 (0)
i1 %phitmp = poison
i1 %cond23.i = poison
i32 %j.add3 = poison

Target:
i32 %add3 = poison
i1 %cmp.i = #x0 (0)
i1 %cmp4.i = #x0 (0)
i1 %cmp8.i = #x0 (0)
i1 %cmp13.i = #x0 (0)
i1 %phitmp = poison
i32 %0 = poison
Comment 1 Juneyoung Lee 2020-07-14 20:05:49 PDT
To fix this, LazyValueInfo should be able to look into freeze to minimize performance degradation.
I'll take a look.