<html>
    <head>
      <base href="https://bugs.llvm.org/">
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW - Wrong code generated from instcombine"
   href="https://bugs.llvm.org/show_bug.cgi?id=46940">46940</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>Wrong code generated from instcombine
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>libraries
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>trunk
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>PC
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>Linux
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>NEW
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>normal
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>P
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>Scalar Optimizations
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>unassignedbugs@nondot.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>kazu@google.com
          </td>
        </tr>

        <tr>
          <th>CC</th>
          <td>llvm-bugs@lists.llvm.org
          </td>
        </tr></table>
      <p>
        <div>
        <pre>I'm seeing what appears to be miscompilation after:

<a href="https://github.com/llvm/llvm-project/commit/00472067c34ccbceb2fad4b905524f3c780bb7d5">https://github.com/llvm/llvm-project/commit/00472067c34ccbceb2fad4b905524f3c780bb7d5</a>

Consider:

target triple = "x86_64-grtev4-linux-gnu"

define i1 @foo(i32 %arg) {
entry:
  %cmp1 = icmp eq i32 %arg, 37
  br i1 %cmp1, label %bb_then, label %bb_else

bb_then:
  call void @bar()
  br label %bb_exit

bb_else:
  %cmp2 = icmp slt i32 %arg, 17
  br label %bb_exit

bb_exit:
  %phi1 = phi i1 [ true, %bb_else ], [ false, %bb_then ]
  %phi2 = phi i1 [ %cmp2, %bb_else ], [ undef, %bb_then ]
  %and1 = and i1 %phi2, %phi1
  ret i1 %and1
}

declare void @bar()

Note that for every control flow, the return value is well defined.

arg == 37 -> return false
arg <  17 -> return true
otherwise -> return false

Then

$ ./build/bin/opt -instcombine -S ~/undef2.ll -o ~/undef2-opt.ll

modifies bb_exit like so:

bb_exit:                                          ; preds = %bb_else, %bb_then
  %phi2 = phi i1 [ %cmp2, %bb_else ], [ undef, %bb_then ]
  ret i1 %phi2

Notice undef in the phi node.

FWIW, immediately after SimplifyUsingControlFlow and replaceInstUsesWith
run on phi1, we have:

bb_exit:                                          ; preds = %bb_else, %bb_then
  %phi1 = phi i1 [ true, %bb_else ], [ false, %bb_then ]
  %phi2 = phi i1 [ %cmp2, %bb_else ], [ undef, %bb_then ]
  %0 = xor i1 %cmp1, true
  %and1 = and i1 %phi2, %0
  ret i1 %and1</pre>
        </div>
      </p>


      <hr>
      <span>You are receiving this mail because:</span>

      <ul>
          <li>You are on the CC list for the bug.</li>
      </ul>
    </body>
</html>