<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [InstCombine] Miscompile of (x & (~(-1 << x))) << x"
href="https://bugs.llvm.org/show_bug.cgi?id=49778">49778</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[InstCombine] Miscompile of (x & (~(-1 << x))) << x
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Scalar Optimizations
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>meheff@google.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>This expression is miscompiled in the case where x is zext of a single bit
value. Here's before and after from a single instcombine transform extracted
using debug_counter and fed to Alive:
----------------------------------------
define i32 @src(i1 %x2) {
%0:
%x13 = zext i1 %x2 to i32
%_7 = shl i32 4294967295, %x13
%mask = xor i32 %_7, 4294967295
%_8 = and i32 %mask, %x13
%_9 = shl i32 %_8, %x13
ret i32 %_9
}
=>
define i32 @tgt(i1 %x2) {
%0:
%x13 = zext i1 %x2 to i32
%1 = shl i32 %x13, %x13
%_9 = and i32 %1, 0
ret i32 %_9
}
Transformation doesn't verify!
ERROR: Value mismatch
Example:
i1 %x2 = #x1 (1)
Source:
i32 %x13 = #x00000001 (1)
i32 %_7 = #xfffffffe (4294967294, -2)
i32 %mask = #x00000001 (1)
i32 %_8 = #x00000001 (1)
i32 %_9 = #x00000002 (2)
Target:
i32 %x13 = #x00000001 (1)
i32 %1 = #x00000002 (2)
i32 %_9 = #x00000000 (0)
Source value: #x00000002 (2)
Target value: #x00000000 (0)
I suspect the problematic transform is this one:
<a href="https://github.com/llvm/llvm-project/blob/c06a8f9caa51c7ea71dac716e0a35f5e343e4546/llvm/lib/Transforms/InstCombine/InstCombineShifts.cpp#L168">https://github.com/llvm/llvm-project/blob/c06a8f9caa51c7ea71dac716e0a35f5e343e4546/llvm/lib/Transforms/InstCombine/InstCombineShifts.cpp#L168</a>
Looks like maybe(?) NewMask is incorrectly being computed as zero:
<a href="https://github.com/llvm/llvm-project/blob/c06a8f9caa51c7ea71dac716e0a35f5e343e4546/llvm/lib/Transforms/InstCombine/InstCombineShifts.cpp#L317">https://github.com/llvm/llvm-project/blob/c06a8f9caa51c7ea71dac716e0a35f5e343e4546/llvm/lib/Transforms/InstCombine/InstCombineShifts.cpp#L317</a></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>