<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Issue</th>
<td>
<a href=https://github.com/llvm/llvm-project/issues/86396>86396</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>
Unreachable IR generated after opt -opaque-pointers --instcombine --simplifycfg
</td>
</tr>
<tr>
<th>Labels</th>
<td>
new issue
</td>
</tr>
<tr>
<th>Assignees</th>
<td>
</td>
</tr>
<tr>
<th>Reporter</th>
<td>
Argithun
</td>
</tr>
</table>
<pre>
* Version: llvm 17.06
* OS: Ubuntu 20.04
* Architecture: x86
We are doing fuzz testing on llvm's optimization module. We generated the following intermediate code through our own constructed mutation strategy:
```llvm
source_filename = "M"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64"
@my_format_str_int = private unnamed_addr constant [4 x i8] c"%d\0A\00", align 1
@my_format_str_float = private unnamed_addr constant [4 x i8] c"%f\0A\00", align 1
define i32 @main() {
BB:
%0 = call i8 @my_func_177(i8 0, i8 0)
%1 = sub i8 -40, %0
br label %new_loop_entry_10
loop_entry_15: ; preds = %new_loop_entry_10, %loop_body_16
%2 = phi i8 [ 13, %new_loop_entry_10 ], [ %6, %loop_body_16 ]
%3 = phi i8 [ %1, %new_loop_entry_10 ], [ %5, %loop_body_16 ]
%B = fadd double 0.000000e+00, 4.940660e-324
%4 = icmp sgt i8 %2, 0
br i1 %4, label %loop_body_16, label %loop_end_17
loop_body_16: ; preds = %loop_entry_15
%5 = sub i8 %3, 1
%6 = sub i8 %2, 1
br label %loop_entry_15
loop_end_17: ; preds = %loop_entry_15
%A = alloca i32, align 8
store i64 1, ptr %A, align 4
%7 = sdiv i8 %3, 53
%C = icmp sle i8 %7, 0
%8 = zext i1 %C to i32
%9 = urem i32 %8, 32
%B1 = ashr i32 65536, %9
%10 = call i32 (ptr, ...) @printf(ptr @my_format_str_int, i32 %8)
%11 = icmp sle i8 -1, 0
%12 = zext i1 %11 to i32
%13 = call i32 (ptr, ...) @printf(ptr @my_format_str_int, i32 %12)
store i32 %B1, ptr %A, align 4
ret i32 0
new_loop_entry_10: ; preds = %new_loop_body_11, %BB
%14 = phi i8 [ 13, %BB ], [ %18, %new_loop_body_11 ]
%15 = icmp sgt i8 %14, 0
br i1 %15, label %new_loop_body_11, label %loop_entry_15
new_loop_body_11: ; preds = %new_loop_entry_10
%16 = sdiv i8 81, 81
%17 = sdiv i8 81, 81
%18 = sub i8 %14, %17
br label %new_loop_entry_10
}
declare i32 @printf(ptr, ...)
define internal i8 @my_func_177(i8 %0, i8 %1) {
my_block_177:
%A3 = alloca ptr, align 8
store i64 1, ptr %A3, align 4
%A = alloca float, align 8
store i64 1, ptr %A, align 4
%2 = urem i1 true, false
%G3 = getelementptr i32, ptr %A3, i1 %2
%L = load i32, ptr %A, align 4
%3 = urem i32 %L, 4
%G1 = getelementptr ptr, ptr %G3, i32 %3
store i64 1, ptr %G1, align 4
%B = fsub float 0x47EFFFFFE0000000, 0x47EFFFFFE0000000
%4 = call i32 (ptr, ...) @printf(ptr @my_format_str_float, float %B)
%my_new_inst_178 = sub i8 %0, %1
%G2 = getelementptr i8, ptr %G1, i32 %4
store float %B, ptr %A, align 4
store ptr %G2, ptr %A3, align 8
ret i8 %my_new_inst_178
}
```
Then we use the opt tool to optimize this file. This is the command we use:
```bash
opt -opaque-pointers --instcombine --simplifycfg before.ll -o after
llvm-dis after
```
This generates an optimized .ll file:
```llvm
source_filename = "M"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64"
@my_format_str_int = private unnamed_addr constant [4 x i8] c"%d\0A\00", align 1
@my_format_str_float = private unnamed_addr constant [4 x i8] c"%f\0A\00", align 1
define i32 @main() {
BB:
%0 = call i8 @my_func_177(i8 0, i8 0)
%1 = sub i8 -40, %0
br label %new_loop_entry_10
loop_entry_15: ; preds = %new_loop_entry_10, %loop_body_16
%2 = phi i8 [ 13, %new_loop_entry_10 ], [ %6, %loop_body_16 ]
%3 = phi i8 [ %1, %new_loop_entry_10 ], [ %5, %loop_body_16 ]
%4 = icmp sgt i8 %2, 0
br i1 %4, label %loop_body_16, label %loop_end_17
loop_body_16: ; preds = %loop_entry_15
%5 = add i8 %3, -1
%6 = add i8 %2, -1
br label %loop_entry_15
loop_end_17: ; preds = %loop_entry_15
%C = icmp slt i8 %3, 53
%7 = zext i1 %C to i32
%8 = call i32 (ptr, ...) @printf(ptr noundef nonnull @my_format_str_int, i32 %7)
%9 = call i32 (ptr, ...) @printf(ptr noundef nonnull @my_format_str_int, i32 1)
ret i32 0
new_loop_entry_10: ; preds = %new_loop_body_11, %BB
%10 = phi i8 [ 13, %BB ], [ %12, %new_loop_body_11 ]
%11 = icmp sgt i8 %10, 0
br i1 %11, label %new_loop_body_11, label %loop_entry_15
new_loop_body_11: ; preds = %new_loop_entry_10
%12 = add i8 %10, -1
br label %new_loop_entry_10
}
declare i32 @printf(ptr, ...)
define internal i8 @my_func_177(i8 %0, i8 %1) {
my_block_177:
unreachable
}
```
Let‘s pay attention to the changes in the code in my_func_177: after optimization, my_block_177 that could have been reached during execution is made **Unreachable**.
Some other interesting facts：
* When we changed our command to 'opt -opaque-pointers --simplifycfg --instcombine before.ll -o after', this problem would not exist.
* When we tried to do the same thing on Aarch64. Before.ll would crash when executed after being compiled, but after optimization, it could execute normally and printed the expected results.
So is this phenomenon a feature or a bug? We are all new to llvm and would like some enthusiasts to help confirm this issue.
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzsWd-P27gR_mu4LwMbEvXD8oMf7Gw2KJCiQHPXPBqUNLLYo0iVpPZH_vqClOylbO-t02txvUOMQGuTH4ffcMhPMyEzhh8k4oZkO5Ld37HBtkpvtvrAbTvIu1LVLxtCt_AP1IYrSZItCPHYQbxaRjmJ7km0dd1_--J6fi4HaQeg0TJKX_u2umq5xcoOGh3quTgO9M-vCEwj1IrLAzTDt29g0Vj3Q0k_F6ErA6q3vOPfmOVKQqfqQeASviIcUKJmFmuwLUKjhFBPbiyXFnWHNWcWoVI1gm21Gg4tqEGDepJQKWmsHio3thvsaNlYZ-zwQpKJHcmj8Z9n4puMGnSF-4YLlKxDIMk9EEr_SigdAZbpA1qomWWCvajBHiG46EiyxUVPVxFJtgn1D_cznv903_LUPxb8-KUp3KCYFgtZuC_5cUyeLr7EtDif32reixO95yLf5-kJMz3TqHvZN0p3zO6N1XsuR7K95o9u5QbpXKz3rK71uGLMIbJdCs_AC5LdQ-Vs0qwm2Ydo6x6Rb_gATPCDhPiNmRqh2H86V_POXP5ZY8MlAk8ouMkZl8St0RrIajcidrtTmAEIzSJPp2JCAC9gYjzIah-vVoQWvIDIzTX-XQcDYz_QDKXrW6Qe5ewdIaUGwUoUrlHi014o1e9RWv2yj6OQc9iRubNyw4ckO-g11maK9JUZRjq-zR3ofZwH5OkYhJZ7p7MdxMk04MIQkOze92U7159fMewhr8aTc-NutW40n71vfufNN6yuoVZDKRCiZeQ_SOgu8p6ny3Ua5XmEi4SmwdjUj-VV14M5WM-PZn4zhXHjsce65lMIZwt50YGy3seri6ge8bcF9TKq863x6kYW7j234o5RHADyMwCdAcKteWWK2bb0ft3I_3YHth7AhFAVc6f19TgXR5SxSiPwPAW_d3qr_cBXZBjX1ehvzR_DFcmSAPIhCL3ACbaahZ7QrPCob_hsp13wAazyDF8xa48ZNHaj0NCscGZmmN0oD8y02oPyLEuOR2emIqH-eGNFb7UDLpdLL1xp1GsubTP2wDX19gJ1YjIzH194vYjPfY7pudNxfOl1nPx3mcY0oDoFe-zZvRdwjdZjZzJ6qYDv79q3ZXQ8uUfV2u3ChUjfFM_d7kzO4uJc9ybDZ5oWZ9eEKU6vK1OczRToGun3z_fFqBsO-Q2vncCnfHYoC8-rCFUqXr2LKM6EbFwSP_Z7XrSr-3mWUAmmT2lCuGtf9_O1tMLll5K9mSn41_-YLIyvvCDv6F72pVDVLx49y0C2SSiGE4fbxDC5roYzdfU512_VVxpIXgxWD-hwDRMGA9Sn0ZMDWhTYobTO6KTuM8rjNg7V5bMfKRSrzwdcJ5RcaPBn_94P2cRX2EzLOxn_lASClPz6ynyKrzOZ0hG3Rcf0NnpOVx8f3OfjmJb4PXGl9Twt-Q3SegrylGHTbDd_EXQve3c2uDR2H6_OT9UxWwyP3id6LZjFxYpMq5fOVy_k8auxHOFHi5db5WzXeukvrnh0ftCPJVx4jH9qUcITwmDQV46qt2CVEu5lN9WaroMbcHXeEn5yX7nx2Ep1HZP1NPyyVCyZaccmZ3WhevavARe98pphYLFwRCvVlU5IFgvDu17w5qVqDlBiozQuhYCFAtZY1FMGJh67Rc1N2PaGX9ycimIDTJ68qcGZdd68Mv5R4v4ocX-UuP_XJe6fqkx1hXpQlC0u69RXBJ0jfv9CdVY12jeLy9UNZWPxnS95qQZZYwNSSTkI8V49tZqf3fX_cLY4mOp3rsWi76jF6I21WHy1FoveqMXiP0QtRs8O2ujO9ZP2hyuiBqmRVS0rBd6SBn5GSz5SUkRkXRjo2Qswa1H6uwCrxmyvZfKABrickr_aEYeQbLId87LZLYUjHpIE2zILlRpEDS17RCgRJXi2WEM9aC4PgM9YDX52bqBjNQKhW0K3Pwdu-YZl6MUX1SEo26Iel3S6P2lYZQ35-EB2H8j6mA7RLXydct_Rs9rfiBxzWquA0NUbeWuYqc6z2Ct5K_X_oeZT6F6rUmAHT955qSzgMzd2eUnJao6eRD0uvnHZp22n26At01Wbp0vYnaYbTVaamRaenJFxBbGeIlKiG1uprucCa8eoHOwb0eLH8Ew2QDrJE-IF3Mr4XT3dM-Fzj_7iSKMZhDVn0RgLBed4i1J1KJUEBg0yO2gEpYFBORxI8gDT5ZeTZolPznF_u-arC09F8F8QjIsvStsOhjNjjcO1KHqXQjZcd-Nk3JgBl3f1JqnXyZrd4SZexTGNkmxN79pN2dTrAgusy2SdRU2crXGV5-s0qsuaYp3f8Q2NaBolNInTeJ3RZZpl66ZqkiIuk6bBiKQRdoyLpeO4VPpw56fcFHmyzu-8Zhh_kUipc8Z3uuQ1u7_TG1_BlMPBkDQS3FjzasVyK3ATbHH4y9-Di71TsL6rlLobtNi01vbGqQN9IPTB32mWy0p1hD6MN4v-z6LX6p9YWUIfPGdD6IP36d8BAAD__7_NHl0">