<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - SimplifyCFG's -switch-to-lookup is incorrect w.r.t undef"
href="https://bugs.llvm.org/show_bug.cgi?id=42617">42617</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>SimplifyCFG's -switch-to-lookup is incorrect w.r.t undef
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Scalar Optimizations
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>nunoplopes@sapo.pt
</td>
</tr>
<tr>
<th>CC</th>
<td>hans@hanshq.net, llvm-bugs@lists.llvm.org, regehr@cs.utah.edu, spatel+llvm@rotateright.com
</td>
</tr></table>
<p>
<div>
<pre>The test case in Transforms/SimplifyCFG/rangereduce.ll shows that SimplifyCFG's
-switch-to-lookup incorrectly handles undef inputs and produces shifts with
large RHS (which is poison).
Counterexample from Alive2 (see the value of %switch.shiftamt):
define i8 @test7(i8 %a) {
%0:
switch i8 %a, label %def [
i8 220, label %one
i8 224, label %two
i8 228, label %three
i8 232, label %three
]
%def:
ret i8 163
%one:
ret i8 208
%two:
ret i8 119
%three:
ret i8 199
}
=>
define i8 @test7(i8 %a) {
%0:
%1 = sub i8 %a, 220
%2 = lshr i8 %1, 2
%3 = shl i8 %1, 6
%4 = or i8 %2, %3
%5 = icmp ult i8 %4, 4
br i1 %5, label %switch.lookup, label %def
%switch.lookup:
%switch.cast = zext i8 %4 to i32
%switch.shiftamt = mul i32 %switch.cast, 8
%switch.downshift = lshr i32 3351738320, %switch.shiftamt
%switch.masked = trunc i32 %switch.downshift to i8
ret i8 %switch.masked
%def:
ret i8 163
}
Transformation doesn't verify!
ERROR: Target is more poisonous than source
Example:
i8 %a = undef
Source:
Target:
i8 %1 = undef
i8 %2 = #x09 (9) [based on undef value]
i8 %3 = #x00 (0) [based on undef value]
i8 %4 = undef
i1 %5 = undef
i32 %switch.cast = #x00000009 (9) [based on undef value]
i32 %switch.shiftamt = #x00000048 (72) [based on undef value]
i32 %switch.downshift = poison
i8 %switch.masked = poison
Source value: #xa3 (163, -93) [based on undef value]
Target value: poison
I can see 3 ways for fixing this bug:
1) Truncate shift amount. Pay the price for the potential perf degradation.
2) Add freeze(%a) to get rid of the undef
3) Get rid of undef (slighter longer-term plan)</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>