<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/143397>143397</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Incorrect optimization of multiple __builtin_unreachable() conditions leads to logic errors in control flow
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          hutuhutong
      </td>
    </tr>
</table>

<pre>
    this problems exist in X86_64 clang 18/20。
clang exhibits incorrect optimization behavior when handling multiple (>2) __builtin_unreachable() statements.

When only a single __builtin_unreachable() is used, or when compiling with -O0, the code executes correctly. However, when two or more __builtin_unreachable() statements are present, the program behaves correctly under -O0, but under -O1/O2/O3/Os, clang incorrectly folds the entire test_builtin_unreachable() function, leading to an infinite loop at runtime.

This suggests that the optimizer does not correctly account for the interactions of multiple unreachable paths during optimization.

========the code========
#include <stdio.h>
#include <stdlib.h>

void test_output() {
    printf("the code is executing\n");
}

void test_builtin_unreachable() {
    int bb = 2;
    if ((bb & ~3) != 0)
        __builtin_unreachable();
    if ((bb & 1) == 0)
        __builtin_unreachable();
    if (bb == 2)
        printf("the value of bb is: %d\n", bb);
}

int main() {
    test_output();
    test_builtin_unreachable();
    return 0;
}

========the  output========
$ clang -O0 test.c -o test
$ ./test
the code is executing
the value of bb is: 2

$ clang -O1 test.c -o test
$ ./test
the code is executing
the code is executing
Segmentation fault (core dumped)

========the assembly code=========
when use the -O1， we can see the function test_builtin_unreachable is none, so the test_output always be executing:

test_output:
        lea     rdi, [rip + .Lstr]
        jmp     puts@PLT

test_builtin_unreachable:

main:
        push    rax
        lea     rdi, [rip + .Lstr]
        call    puts@PLT

.Lstr:
        .asciz  "the code is executing"
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJykVlFvozgQ_jXOy6gRmJDAAw9p2uhOWmlPupXu3ioDA3hlbGSPk2Yf7refDKTJtmlOuq0qaD3j-b6Z-TxGOCdbjViw9JGlTwvhqTO26Dz5zpPR7aI09amgTjoYrCkV9g7wVToCqeHvbP2yXkGlhG4hzhjf84g9JyyLWMZZtJ0M-NrJUpIDqStjLVYEZiDZyx-CpNFQYicO0lg4dqihE7pWUrfQe0VyUAiMZyx55ozn8PJSeqlI6hevLYqqE6XCYOc5OBKEPWpySxZtWbT9K4QzWp1AgJO6VXh3v3TgHdaM7-DMpTL9IEcyR0kdPHyNgpU6hMrUCPiKlSd0MKelTkv4zRzxgDb4jSHoaEK43tj76Bf2ICzCYNGhpjPcYE1rRT-V6hoQvK7RnpmVnt4WYsb3X3l4JOHhgn3qx1sb1Akao2o3QqAmaREIHd2h2XhdhaaFaApFHWpDBoQGqRupJSEoYwYQBNZrkj3OzfgWFOR826KjAChoRJ2FgBZqgw60oavcRFUZrwkaY0dnqQmtGPEdmOaikCueMAjqHNTeBmrXOpuJsOTp5u-5q5_Zw1aeSF0pXyOwZOeolmbZseT5lknJ8s0WbQ9G1lNpjafB01xNtnlk0RYAYLBSUzMu8zd9STdLTOqWpTvNeDgELAmb2ObpfejPu3bBkZqgLIElT8CnQONqMx4yngUTX8M_ybiLx8EvCpiTX_i5I-LPA8ZjvLGOvxBvIj5x_ynG--odhPIYFFKWIB1LtsB4Wr-VcAdl-bGQoTS9kPpDzT707cLrft0vfhbJWw3RO8h7WoQZ8Z4cz6P34Ws0UllW8GDGv2bzkvH9_O9tVU3rH-vFZ4JXEPEvQdxa_xPbMPGmW6ARXlHochVGZe37Iczi_L8LJZzDvlSn-6d3rNg4kb3DcZqEEfm8Z487lu3giFAJDQ4n23nMfdrgkIo2GoOYnBn3XMkEhDqKk4MSr_JNtlMu13Ia184qVijGt61lCMvSRysHYPwRll8cWZY-XTl_74dJ-p4cW0V_fPl2Ff2WIs_wo8R_wh2860Zc8fp_2VRCqVtsJtef0JbCVfIHwKeDjvNFXSR1nuRigUW8WeWrjOc8XXRF3MRYVShEnOZpHOfJpmkQVyXmieDZOlvIgkc8jdZRHqc8W62WyTrZVPmmXuerzSpLE7aKsBdSLZU69Etj24V0zmMRr5Ik3yyUKFG588eQLYLXQ-nbkJSSjtxlH0lSWPx--5Pm-nK6d-tXRtdyus_CberCXapMKytAa40Nn0zBh6xR0ChzXHirio5oCIeU8T3j-1ZS58tlZXrG94Hd_HoYrPmOFTG-H1N0jO_nLA8F_zcAAP__toAZGw">