<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Unexpected LCV type promotion in HardwareLoops"
href="https://bugs.llvm.org/show_bug.cgi?id=49884">49884</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Unexpected LCV type promotion in HardwareLoops
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Loop Optimizer
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>j-nagurne@ti.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvm-bugs@lists.llvm.org
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=24731" name="attach_24731" title="Test file exhibiting the unexpected promotion">attachment 24731</a> <a href="attachment.cgi?id=24731&action=edit" title="Test file exhibiting the unexpected promotion">[details]</a></span>
Test file exhibiting the unexpected promotion
Compilation:
- Attached test file with '-Wall -Wextra -c -std=c++11 -O1 --target=ppc'
- Compiler Explorer: <a href="https://godbolt.org/z/vb7Y1dMh8">https://godbolt.org/z/vb7Y1dMh8</a>
Expectation:
The loop control variable 'count' is purposefully underflowed, decrementing
from 0x0 to 0xff. The loop is then executed exactly 256 times, leaving pointer
'p' 1 element past the end of array 'buffer'.
Problem:
The loop control variable 'count' is promoted to an i32 through the
HardwareLoops pass, leading to the following PowerPC assembly:
mr 30, 3
…
mtctr 30
.LBB0_1: # =>This Inner Loop Header: Depth=1
bdnz .LBB0_1
1. r3 (count) is placed into r30
2. The memset (*p++ = 0) portion of the loop is factored out into an
actual call to memset
3. r30 (count) is placed into the CTR
4. The CTR is used in bdnz
a. With a quick glance at the definition of that instruction, the
decrement happens before the compare. This means that the CTR may underflow,
and will end up as either 0xffffffff or 0xffffffffffffffff
b. The CTR will be compared to 0 and, now being a large positive value,
will not be 0
c. The branch will occur, repeating 4a-4c until 'p' passes the end of the
buffer. Since the failure case is seemingly optimized out as undefined
behavior, the loop will continue a finite but undesirable number of times.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>