<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Nuno,<div class=""> we still need some examples showing that the definition</div><div class="">“Branching on poison is immediate-UB” is the best choice,</div><div class=""><div class="">so far we only have arguments against it (the one for loop-switching).</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Excerpts from the Paper [1]</div><div class=""><br class=""></div><div class=""><div class="">Here’s the example you give for GVN</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""> t = x + 1;</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""> if (t == y) {</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""> w = x + 1;</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""> foo(w); </span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""> }</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""> Therefore, GVN can pick y as the representative value and transform the code into:</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""> t = x + 1;</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""> if (t == y) {</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""> foo(y);</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""> }</span></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Menlo; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures;" class=""> However, if y is a poison value and w is not</span></div></div><div class=""><br class=""></div><div class="">This really hinges on an incorrect choice for representative value of w.</div><div class=""><br class=""></div><div class="">Any value with the “poison” attribute is not a valid representative for any</div><div class="">seemingly equivalent value. If GVN is actually doing this it is a bug in GVN.</div><div class=""><br class=""></div><div class="">So this example doesn’t really show anything about branching.</div><div class=""><br class=""></div><div class=""><br class=""></div></div><div class="">Peter Lawrence.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">[1. <a href="http://www.cs.utah.edu/~regehr/papers/undef-pldi17.pdf" class="">http://www.cs.utah.edu/~regehr/papers/undef-pldi17.pdf</a> ]</div><div class=""><br class=""></div></body></html>