<html>
<head>
<base href="https://llvm.org/bugs/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - Dead store elimination incorrectly removes store to function pointer in struct"
href="https://llvm.org/bugs/show_bug.cgi?id=27005">27005</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Dead store elimination incorrectly removes store to function pointer in struct
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>3.8
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Backend: X86
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>maniandram01+bugzilla@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=16057" name="attach_16057" title="Code that causes the miscompilation">attachment 16057</a> <a href="attachment.cgi?id=16057&action=edit" title="Code that causes the miscompilation">[details]</a></span>
Code that causes the miscompilation
In the attached code incorrect_dse.ll, the dead store elimination optimization
incorrectly removes in create() a store instruction to a function pointer in
the structure {void()*}, even though that pointer is load'ed later in main().
This may be due to the bitcast to the structure {} later. This removal of the
store instruction does not occur if the function is replaced with an i32. Note
that one can add a dummy i32 to both {} and {void()*} structures, but the big
still occurs (it has nothing to do with {} being empty).
The end result of this miscompilation is a segmentation fault. However, if one
uses -O2 and -O3 levels, LLVM recognizes that the function being load'ed is
undefined and hence optimizes away main() to `ret undef`.
You can reproduce the problem with: opt bugpoint-tooptimize.bc -dse
I am using the Clang 3.8 binaries for Ubuntu 15.10 downloaded from llvm.org.
bugpoint_out.txt is from running:
~/clang+llvm-3.8.0-x86_64-linux-gnu-ubuntu-15.10/bin$ ./bugpoint -llc-safe -dse
~/incorrect_dse.ll > bugpoint_out.txt
I have also attached the bitcode files bugpoint-tonotoptimize.bc and
bugpoint-tooptimize.bc generated by bugpoint.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>