[llvm-dev] [poison] re: is select-of-select to logic+select allowed ?

[Peter Lawrence via llvm-dev]

Nuno,
Sanjoy,
            Can you provide some actual C source code examples that show how
End-to-end-miscompilations have resulted from the presence of “UB” in
Select statements ?

Thanks,
Peter Lawrence.


PS, IMHO “plain asci” isn’t that hard !


Summary table of what each transformation allows for 
        %z = select %c, %x, %y
Each column is a different alternative of semantics for select:


1.   UB if %c poison + conditional poison

2.   UB if %c poison + poison if either %x/%y poison

3.   Conditional poison + non-det choice if %c poison

4.   Conditional poison + poison if %c poison**

5.   Poison if any of %c/%x/%y are poison


            option    1   2   3   4   5

SimplifyCFG           ✓   .   ✓   ✓   .   

Select->control-flow  ✓   ✓   .   .   .

Select->arithmetic    .   ✓   .   .   .

partially             ✓   .   .   .   .

Select removal        ✓   ✓   ✓   ✓   ✓

Select hoist          ✓   ✓   ✓   .   .

Easy movement         .   .   ✓   ✓   ✓


IMHO, the 3rd and 4th options are the ones that work best.  Instructions with UB are usually a pain (for e.g. hoisting out o
f loops).






> On May 24, 2017, at 11:51 AM, via llvm-dev <llvm-dev at lists.llvm.org> wrote:
> 
> Message: 3
> Date: Wed, 24 May 2017 18:55:23 +0100
> From: Nuno Lopes via llvm-dev <llvm-dev at lists.llvm.org <mailto:llvm-dev at lists.llvm.org>>
> To: "'David Menendez'" <davemm at cs.rutgers.edu <mailto:davemm at cs.rutgers.edu>>
> Cc: 'llvm-dev' <llvm-dev at lists.llvm.org <mailto:llvm-dev at lists.llvm.org>>, 'John Regehr'
> 	<regehr at cs.utah.edu <mailto:regehr at cs.utah.edu>>
> Subject: Re: [llvm-dev] [poison] is select-of-select to logic+select
> 	allowed?
> Message-ID: <006001d2d4b6$eb203aa0$c160afe0$@ist.utl.pt <mailto:006001d2d4b6$eb203aa0$c160afe0$@ist.utl.pt>>
> Content-Type: text/plain; charset="utf-8"
> 
> Thanks David for pointing out a mistake in the table! I implemented most of the semantics shown in the table in Alive to test these things, but the bug still slipped through, sorry..
> 
> 
> 
> I’ve updated the table:
> 
> 
> 
> Summary table of what each transformation allows for %z = select %c, %x, %y. Each column is a different alternative of semantics for select:
> 
> 
> 
> 
> 
> 
> UB if %c poison
> 
> + conditional poison
> 
> UB if %c poison + poison if either
> %x/%y poison
> 
> Conditional poison
> 
> + non-det choice if %c poison
> 
> Conditional poison + poison if %c poison**
> 
> Poison if any of
> %c/%x/%y are poison
> 
> 
> SimplifyCFG
> 
> ✓
> 
> 
> 
> ✓
> 
> ✓
> 
> 
> 
> 
> Select->control-flow
> 
> ✓
> 
> ✓
> 
> 
> 
> 
> 
> 
> 
> 
> Select->arithmetic
> 
> 
> 
> ✓
> 
> 
> 
> partially 
> 
> ✓
> 
> 
> Select removal
> 
> ✓
> 
> ✓
> 
> ✓ 
> 
> ✓
> 
> ✓
> 
> 
> Select hoist
> 
> ✓
> 
> ✓
> 
> ✓
> 
> 
> 
> 
> 
> 
> Easy movement
> 
> 
> 
> 
> 
> ✓
> 
> ✓
> 
> ✓
> 
> 
> 
> 
> 
> IMHO, the 3rd and 4th options are the ones that work best.  Instructions with UB are usually a pain (for e.g. hoisting out of loops).
> 
> 
> 
> An advantage of the 4th option is that can partially do select->arithmetic, while the 3rd can’t.  For example, this is valid with the 4th option:
> 
> %13 = mul nuw i2 %0, -1
> 
> %14 = srem i2 %13, -1
> 
> %15 = select i1 %1, i2 1, i2 %14
> 
>  =>
> 
> %15 = zext i1 %1 to i2
> 
> 
> 
> 
> 
> The 4th option, however, can’t do the select->and/or transformations (neither the 3rd can).
> 
> 
> 
> That said, I’m inclined to choose the 4th option (marked with ** in the table).  That’s the one that the online version of Alive implements BTW.
> 
> 
> 
> Nuno

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-dev/attachments/20170606/6669165d/attachment-0001.html>