<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - StraightLineStrengthReduce can introduce UB when optimizing 2-dim array gep"
href="https://bugs.llvm.org/show_bug.cgi?id=44533">44533</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>StraightLineStrengthReduce can introduce UB when optimizing 2-dim array gep
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Scalar Optimizations
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>juneyoung.lee@sf.snu.ac.kr
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=23013" name="attach_23013" title="Input">attachment 23013</a> <a href="attachment.cgi?id=23013&action=edit" title="Input">[details]</a></span>
Input
```
$ cat slsr-gep.ll
target datalayout = "e-i64:64-v16:16-v32:32-n16:32:64-p:64:64:64-p1:32:32:32"
define void @f([10 x [5 x i32]]* %input, i64 %s, i64 %t) {
%p0 = getelementptr inbounds [10 x [5 x i32]], [10 x [5 x i32]]* %input, i64
0, i64 %s, i64 %t
call void @foo(i32* %p0)
%s2 = shl nsw i64 %s, 1
%p1 = getelementptr inbounds [10 x [5 x i32]], [10 x [5 x i32]]* %input, i64
0, i64 %s2, i64 %t
call void @foo(i32* %p1)
ret void
}
declare void @foo(i32*)
$ opt -slsr -S -o - slsr-gep.ll
; ModuleID = 'slsr-gep.ll'
target datalayout = "e-i64:64-v16:16-v32:32-n16:32:64-p:64:64:64-p1:32:32:32"
define void @f([10 x [5 x i32]]* %input, i64 %s, i64 %t) {
%p0 = getelementptr inbounds [10 x [5 x i32]], [10 x [5 x i32]]* %input, i64
0, i64 %s, i64 %t
call void @foo(i32* %p0)
%1 = mul i64 %s, 5
%p1 = getelementptr inbounds i32, i32* %p0, i64 %1
call void @foo(i32* %p1)
ret void
}
declare void @foo(i32*)
```
(the test excerpted from Transforms/StraightLineStrengthReduce/slsr-gep.ll)
This is incorrect when input[s][t] is not inbounds but input[s2][t] is
inbounds.
For example, if s = 1, s2 = 2, and t = -6, it can happen.
After optimization, %p1 becomes poison.
One possible solution for this is to allow the transformation when %s and %t
have a same sign bit. Will this solution be effective enough?</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>