[llvm-bugs] [Bug 45220] New: JumpThreading transformation breaks MemorySanitizer

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=45220

            Bug ID: 45220
           Summary: JumpThreading transformation breaks MemorySanitizer
           Product: libraries
           Version: trunk
          Hardware: PC
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: Scalar Optimizations
          Assignee: unassignedbugs at nondot.org
          Reporter: eugeni.stepanov at gmail.com
                CC: llvm-bugs at lists.llvm.org

Created attachment 23243
  --> https://bugs.llvm.org/attachment.cgi?id=23243&action=edit
C source

JumpThreading may introduce use-of-uninitialized value where the original
program did not have one.

To reproduce with the attached source,
  clang -O2 1.c -S -emit-llvm

Note the source snippet:
  if (error == 0 && optype == 4 && s.v == -123)
    error = 22;

It is transformed into:
  %2 = phi i32 [ %.pre, %if.end.if.end9_crit_edge ], [ %dev, %if.else2 ]
  %error.1 = phi i32 [ 17, %if.end.if.end9_crit_edge ], [ %error.0, %if.else2 ]
  %optype.0 = phi i32 [ 4, %if.end.if.end9_crit_edge ], [ 417, %if.else2 ]
  %cmp10 = icmp eq i32 %error.1, 0
  %cmp11 = icmp eq i32 %optype.0, 4
  %or.cond = and i1 %cmp10, %cmp11
  %cmp14 = icmp eq i32 %2, -123
  br i1 %cmp14, label %3, label %4

The check for (s.v == -123) is executed before the two other checks.
This is wrong, because it is OK for s.v to be uninitialized when the && is
short-circuited.

This transformation happens in the jump threading pass.
Attaching IR before and after, test with
$ opt 1.ll -jump-threading -S -o -

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20200317/440c8ea9/attachment.html>