<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [polly] Miscompile with missing runtime check for overflowing multiply"
href="https://bugs.llvm.org/show_bug.cgi?id=36405">36405</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[polly] Miscompile with missing runtime check for overflowing multiply
</td>
</tr>
<tr>
<th>Product</th>
<td>Polly
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Optimizer
</td>
</tr>
<tr>
<th>Assignee</th>
<td>polly-dev@googlegroups.com
</td>
</tr>
<tr>
<th>Reporter</th>
<td>efriedma@codeaurora.org
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>Reproduce with "clang a.c -O2 -mllvm -polly -mllvm
-polly-process-unprofitable". Following testcase should print "1"; prints "0"
instead:
#include <stdio.h>
void a(int *y, int a) {
int i = 0;
do {
y[i] += 1;
++i;
} while (i != (int)(((unsigned)a)*2));
}
void (*volatile aa)(int*,int) = a;
int main() {
int x[128] = {};
aa(x, 0x80000002);
printf("%d\n", x[0]); return 0;
}
As far as I can tell, the problem has to do with hasNSWAddRecForLoop: the
infinite loop check overlaps the multiply's overflow check. When we drop the
infinite loop check, we also effectively drop the overflow check because we
intersect the overflow check with the domain.
Zino and I have been trying to figure out if there's some way to save the
hasNSWAddRecForLoop check in some form, but currently we don't have any good
ideas.
For reference, the scop (note in particular the invalid context):
Function: a
Region: %do.body---%do.end
Max Loop Depth: 1
Invariant Accesses: {
}
Context:
[p_0] -> { : -2147483648 <= p_0 <= 2147483647 }
Assumed Context:
[p_0] -> { : }
Invalid Context:
[p_0] -> { : p_0 >= 1073741824 }
p0: %a
Arrays {
i32 MemRef0[*]; // Element size 4
}
Arrays (Bounds as pw_affs) {
i32 MemRef0[*]; // Element size 4
}
Alias Groups (0):
n/a
Statements {
Stmt0
Domain :=
[p_0] -> { Stmt0[i0] : 0 <= i0 < 2p_0 };
Schedule :=
[p_0] -> { Stmt0[i0] -> [i0] };
ReadAccess := [Reduction Type: +] [Scalar: 0]
[p_0] -> { Stmt0[i0] -> MemRef0[i0] };
MustWriteAccess := [Reduction Type: +] [Scalar: 0]
[p_0] -> { Stmt0[i0] -> MemRef0[i0] };
}
:: isl ast :: a :: %do.body---%do.end
[p_0] -> { : -2147483648 <= p_0 <= 2147483647 }
{ domain: "[p_0] -> { Stmt0[i0] : 0 <= i0 < 2p_0 }", child: { schedule: "[p_0]
-> [{ Stmt0[i0] -> [(i0)] }]" } }
if (1 && 0 == p_0 >= 1073741824)
for (int c0 = 0; c0 < 2 * p_0; c0 += 1)
Stmt0(c0);
else
{ /* original code */ }</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>