<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - LIVM introduces load in writeonly function (UB)"
href="https://bugs.llvm.org/show_bug.cgi?id=51906">51906</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>LIVM introduces load in writeonly function (UB)
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Keywords</th>
<td>miscompilation
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Loop Optimizer
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>nunoplopes@sapo.pt
</td>
</tr>
<tr>
<th>CC</th>
<td>aeubanks@google.com, alina.sbirlea@gmail.com, llvm-bugs@lists.llvm.org, nikita.ppv@gmail.com, regehr@cs.utah.edu, Vsevolod.Livinskij@frtk.ru, whitneyt@ca.ibm.com
</td>
</tr></table>
<p>
<div>
<pre>LICM transforms this:
for (i=0; i < 4; i += 4)
store @glb, some-expr
=>
tmp = load @lgb
compute some-expr
for (i=0; i < 4; i += 4)
tmp = expr
store @glb, tmp
For functions that are writeonly this introduces UB as the original function
had no load and the optimized now has a load from global memory.
The second issue is the store introduction. I didn't check if the store is
introduced for loops that are not guaranteed to execute, but if that's the case
that may violate C++'s memory model (where I believe you cannot introduce
stores).
@glb = external global i8, align 1
define void @test(i8 %var) writeonly {
entry:
br label %for.cond
for.cond:
%i = phi i64 [ 0, %entry ], [ %add, %cond.end ]
%cmp = icmp ult i64 %i, 4
br i1 %cmp, label %for.body39, label %for.end
for.body39:
%div = sdiv i8 %var, 3
%cmp2 = icmp slt i8 %div, 0
br i1 %cmp2, label %cond.true, label %cond.false
cond.true:
br label %cond.end
cond.false:
br label %cond.end
cond.end:
%merge = phi i8 [ %div, %cond.true ], [ 0, %cond.false ]
store i8 %merge, i8* @glb, align 1
%add = add i64 %i, 4
br label %for.cond
for.end:
ret void
}
After LICM:
define void @test(i8 %var) #0 {
entry:
%div = sdiv i8 %var, 3
%cmp2 = icmp slt i8 %div, 0
%glb.promoted = load i8, i8* @glb, align 1
br label %for.cond
for.cond: ; preds = %cond.end, %entry
%merge1 = phi i8 [ %glb.promoted, %entry ], [ %merge, %cond.end ]
%i = phi i64 [ 0, %entry ], [ %add, %cond.end ]
%cmp = icmp ult i64 %i, 4
br i1 %cmp, label %for.body39, label %for.end
for.body39: ; preds = %for.cond
br i1 %cmp2, label %cond.true, label %cond.false
cond.true: ; preds = %for.body39
br label %cond.end
cond.false: ; preds = %for.body39
br label %cond.end
cond.end: ; preds = %cond.false,
%cond.true
%merge = phi i8 [ %div, %cond.true ], [ 0, %cond.false ]
%add = add i64 %i, 4
br label %for.cond
for.end: ; preds = %for.cond
%merge1.lcssa = phi i8 [ %merge1, %for.cond ]
store i8 %merge1.lcssa, i8* @glb, align 1
ret void
}
Reduced test case from John Regehr & Vsevolod Livinskii.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>