<html>
<head>
<base href="https://llvm.org/bugs/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - SimplifyCFG and InstCombine interact badly and produce wrong code"
href="https://llvm.org/bugs/show_bug.cgi?id=31632">31632</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>SimplifyCFG and InstCombine interact badly and produce wrong code
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Keywords</th>
<td>miscompilation
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Scalar Optimizations
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>nunoplopes@sapo.pt
</td>
</tr>
<tr>
<th>CC</th>
<td>gil.hur@sf.snu.ac.kr, juneyoung.lee@sf.snu.ac.kr, llvm-bugs@lists.llvm.org, regehr@cs.utah.edu, sanjoy@playingwithpointers.com, spatel+llvm@rotateright.com
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr></table>
<p>
<div>
<pre>The following test case is miscompiled if both SimplifyCFG and InstCombine are
run together:
$ cat select.ll
define i1 @g(i8 %x) {
%add_is_nsw = icmp ne i8 %x, 127
br i1 %add_is_nsw, label %is_nsw, label %may_wrap
is_nsw:
%add = add nsw i8 %x, 1
br label %merge
may_wrap:
br label %merge
merge:
%never_poison = phi i8 [ undef, %may_wrap ], [ %add, %is_nsw ]
%result = icmp sgt i8 %never_poison, %x
ret i1 %result
}
$ opt -S -simplifycfg select.ll
define i1 @g(i8 %x) {
%add_is_nsw = icmp ne i8 %x, 127
%add = add nsw i8 %x, 1
%never_poison = select i1 %add_is_nsw, i8 %add, i8 undef
%result = icmp sgt i8 %never_poison, %x
ret i1 %result
}
and with InstCombine:
$ opt -S -simplifycfg -instcombine select.ll
define i1 @g(i8 %x) {
ret i1 true
}
The original, unoptimized, test case returns 0 for %x==127, while the optimized
version returns 1.
This bug happens because SimplifyCFG and InstCombine assume different semantics
for select with a poison value. SimplifyCFG assumes a select is only poison if
its dynamically chosen value is poison, while InstCombine is assuming that
select is poison if any of its operands is poison.
We have proposed in the mailing list that select should follow SimplifyCFG's
version (search for "Discussion on select" here:
<a href="http://lists.llvm.org/pipermail/llvm-dev/2016-October/106182.html">http://lists.llvm.org/pipermail/llvm-dev/2016-October/106182.html</a>).
Therefore, Alive says that InstCombine is wrong: <a href="http://rise4fun.com/Alive/AI0">http://rise4fun.com/Alive/AI0</a>
(test case from Sanjoy)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>