<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [polly] miscompile due to missing overflow check for isl expressions"
href="https://bugs.llvm.org/show_bug.cgi?id=38434">38434</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[polly] miscompile due to missing overflow check for isl expressions
</td>
</tr>
<tr>
<th>Product</th>
<td>Polly
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Windows NT
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Optimizer
</td>
</tr>
<tr>
<th>Assignee</th>
<td>polly-dev@googlegroups.com
</td>
</tr>
<tr>
<th>Reporter</th>
<td>efriedma@codeaurora.org
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>Consider the following loop:
void a(int* restrict x,int * restrict x2, long long g, long long g2, int n) {
for (int i = 0; i < n; ++i) {
x[i]++;
if (g < 0x4000000000000000 - g2/8) x2[i]++;
}
}
polly currently miscompiles this loop. It has no runtime check because polly
correctly computes that "g < 0x4000000000000000 - g2/8" can't overflow.
However, isl "simplifies" the condition to "if ((p_0 <= -1 && p_0 + 8 * p_1 <=
36893488147419103224) || (p_0 >= 0 && p_0 + 8 * p_1 <= 36893488147419103231))",
and polly blindly assumes the math will not overflow an i64.
This is a synthetic testcase. (I ran into something sort of similar which
inspired this, but it overflowed in the runtime check instead of miscompiling.)
IR version follows; reproduce with "opt -polly-codegen
-polly-process-unprofitable".
define void @a(i32* noalias nocapture %x, i32* noalias nocapture %x2, i64 %g,
i64 %g2, i32 %n) {
entry:
%cmp10 = icmp sgt i32 %n, 0
br i1 %cmp10, label %for.body.lr.ph, label %for.cond.cleanup
for.body.lr.ph:
%div = sdiv i64 %g2, 8
%sub = sub nsw i64 4611686018427387904, %div
%cmp1 = icmp sgt i64 %sub, %g
%wide.trip.count = zext i32 %n to i64
br label %for.body
for.cond.cleanup:
ret void
for.body:
%indvars.iv = phi i64 [ 0, %for.body.lr.ph ], [ %indvars.iv.next, %for.inc ]
%arrayidx = getelementptr inbounds i32, i32* %x, i64 %indvars.iv
%0 = load i32, i32* %arrayidx, align 4
%inc = add nsw i32 %0, 1
store i32 %inc, i32* %arrayidx, align 4
br i1 %cmp1, label %if.then, label %for.inc
if.then:
%arrayidx3 = getelementptr inbounds i32, i32* %x2, i64 %indvars.iv
%1 = load i32, i32* %arrayidx3, align 4
%inc4 = add nsw i32 %1, 1
store i32 %inc4, i32* %arrayidx3, align 4
br label %for.inc
for.inc:
%indvars.iv.next = add nuw nsw i64 %indvars.iv, 1
%exitcond = icmp eq i64 %indvars.iv.next, %wide.trip.count
br i1 %exitcond, label %for.cond.cleanup, label %for.body
}</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>