[llvm-bugs] [Bug 42617] New: SimplifyCFG's -switch-to-lookup is incorrect w.r.t undef

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=42617

            Bug ID: 42617
           Summary: SimplifyCFG's -switch-to-lookup is incorrect w.r.t
                    undef
           Product: libraries
           Version: trunk
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: Scalar Optimizations
          Assignee: unassignedbugs at nondot.org
          Reporter: nunoplopes at sapo.pt
                CC: hans at hanshq.net, llvm-bugs at lists.llvm.org,
                    regehr at cs.utah.edu, spatel+llvm at rotateright.com

The test case in Transforms/SimplifyCFG/rangereduce.ll shows that SimplifyCFG's
-switch-to-lookup incorrectly handles undef inputs and produces shifts with
large RHS (which is poison).

Counterexample from Alive2 (see the value of %switch.shiftamt):

define i8 @test7(i8 %a) {
%0:
  switch i8 %a, label %def [
    i8 220, label %one
    i8 224, label %two
    i8 228, label %three
    i8 232, label %three
  ]

%def:
  ret i8 163

%one:
  ret i8 208

%two:
  ret i8 119

%three:
  ret i8 199
}
=>
define i8 @test7(i8 %a) {
%0:
  %1 = sub i8 %a, 220
  %2 = lshr i8 %1, 2
  %3 = shl i8 %1, 6
  %4 = or i8 %2, %3
  %5 = icmp ult i8 %4, 4
  br i1 %5, label %switch.lookup, label %def

%switch.lookup:
  %switch.cast = zext i8 %4 to i32
  %switch.shiftamt = mul i32 %switch.cast, 8
  %switch.downshift = lshr i32 3351738320, %switch.shiftamt
  %switch.masked = trunc i32 %switch.downshift to i8
  ret i8 %switch.masked

%def:
  ret i8 163
}
Transformation doesn't verify!
ERROR: Target is more poisonous than source

Example:
i8 %a = undef

Source:

Target:
i8 %1 = undef
i8 %2 = #x09 (9)        [based on undef value]
i8 %3 = #x00 (0)        [based on undef value]
i8 %4 = undef
i1 %5 = undef
i32 %switch.cast = #x00000009 (9)       [based on undef value]
i32 %switch.shiftamt = #x00000048 (72)  [based on undef value]
i32 %switch.downshift = poison
i8 %switch.masked = poison
Source value: #xa3 (163, -93)   [based on undef value]
Target value: poison


I can see 3 ways for fixing this bug:
 1) Truncate shift amount. Pay the price for the potential perf degradation.
 2) Add freeze(%a) to get rid of the undef
 3) Get rid of undef (slighter longer-term plan)

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20190714/2e6977ad/attachment.html>