[llvm-dev] funnel shift, select, and poison

[Sanjay Patel via llvm-dev]

There's a question about the behavior of funnel shift [1] + select and
poison here that reminds me of previous discussions about select and poison
[2]:
https://github.com/AliveToolkit/alive2/pull/32#discussion_r257528880

Example:
define i8 @fshl_zero_shift_guard(i8 %x, i8 %y, i8 %sh) {
%c = icmp eq i8 %sh, 0
%f = fshl i8 %x, i8 %y, i8 %sh
%s = select i1 %c, i8 %x, i8 %f ; shift amount is 0 returns x (same as fshl)
ret i8 %s
}
=>
define i8 @fshl_zero_shift_guard(i8 %x, i8 %y, i8 %sh) {
%f = fshl i8 %x, i8 %y, i8 %sh
ret i8 %f
}
Transformation doesn't verify!
ERROR: Target is more poisonous than source

----------------------------------------------------------------------------

The problem is that if %y is poison and we assume that funnel shift uses
all of its operands unconditionally, the reduced code sees poison while the
original code is protected by the "conditional poison" (terminology?)
property of a select op and is safe.

If we treat funnel shift more like a select based on its operation (when
the shift amount is 0, we know that the output is exactly 1 of the inputs),
then the transform should be allowed?

This transform was implemented in instcombine [3] with the motivation of
reducing UB-safe rotate code in C to the LLVM intrinsic [4]. So a potential
sidestep of the problem would be to limit that transform to a rotate
pattern (single value is being shifted) rather than the more general funnel
pattern (two values are being shifted).

[1] https://llvm.org/docs/LangRef.html#llvm-fshl-intrinsic
[2] http://llvm.1065342.n5.nabble.com/poison-and-select-td72262.html
[3] https://reviews.llvm.org/D54552
[4] https://bugs.llvm.org/show_bug.cgi?id=34924
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-dev/attachments/20190225/14c9adab/attachment.html>