<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [DebugInfo][Dexter] Speculated store leads to backward steps and stale values"
href="https://bugs.llvm.org/show_bug.cgi?id=38769">38769</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[DebugInfo][Dexter] Speculated store leads to backward steps and stale values
</td>
</tr>
<tr>
<th>Product</th>
<td>new-bugs
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Keywords</th>
<td>wrong-debug
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>new bugs
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>jeremy.morse.llvm@gmail.com
</td>
</tr>
<tr>
<th>CC</th>
<td>aprantl@apple.com, chackz0x12@gmail.com, dblaikie@gmail.com, greg.bedwell@sony.com, international.phantom@gmail.com, jdevlieghere@apple.com, llvm-bugs@lists.llvm.org, paul_robinson@playstation.sony.com
</td>
</tr>
<tr>
<th>Blocks</th>
<td>38768
</td>
</tr></table>
<p>
<div>
<pre>The test below, when stepped through under a debugger, mostly steps backwards
through the "foo" function, and always presents the initial value of the "qux"
variable, never the modified value or "optimised out".
I've used llvm/clang @ r340912 and compiled with "-O0 -g -fno-inline" for
x86_64. (Inlining leads to the whole program being optimised to a return).
Stepping through the "foo" function with both gdb and lldb displays, in order,
the lines for:
* The if-block body
* the if-condition
* qux *= 12
* the if-condition
* return 0
Which involves two backwards steps where the original program had none.
Additionally, on every instruction in "foo", "qux" has the value three (i.e.
it's initial value), the multiplication by 12 never becomes visible, which is
misleading. That multiply is folded into a few other operations; "qux" should
probably be marked as optimised out.
This test was originally supposed to stimulate SimplifyCFGs store speculation,
which merges the stores to *bar into one store.
Found using DExTer ( <a href="https://github.com/SNSystems/dexter">https://github.com/SNSystems/dexter</a> ).
-------->8--------
int
foo(int *bar, int baz, int qux)
{
qux *= 12;
*bar = qux;
if (baz) {
*bar = baz + qux + 3;
}
return 0;
}
int
main()
{
int quux = 1;
foo(&quux, 1, 3);
return quux;
}
--------8<--------</pre>
</div>
</p>
<div id="referenced">
<hr style="border: 1px dashed #969696">
<b>Referenced Bugs:</b>
<ul>
<li>
[<a class="bz_bug_link
bz_status_NEW "
title="NEW - [meta][DebugInfo] Umbrella bug for poor debug experiences"
href="https://bugs.llvm.org/show_bug.cgi?id=38768">Bug 38768</a>] [meta][DebugInfo] Umbrella bug for poor debug experiences
</li>
</ul>
</div>
<br>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>