[LLVMbugs] [Bug 20199] New: An integer overflow bug in InstructionSimplify.cpp:SimplifyICmpInst introduced in r208999: sdiv const, value

[bugzilla-daemon at llvm.org]

http://llvm.org/bugs/show_bug.cgi?id=20199

            Bug ID: 20199
           Summary: An integer overflow bug in
                    InstructionSimplify.cpp:SimplifyICmpInst introduced in
                    r208999: sdiv const, value
           Product: libraries
           Version: trunk
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: Global Analyses
          Assignee: unassignedbugs at nondot.org
          Reporter: vslugovsky at gmail.com
                CC: llvmbugs at cs.uiuc.edu
    Classification: Unclassified

If a first sdiv argument + 1 overflows, a wrong range is calculated.

A test case (should be compiled with clang with -O1):

extern void abort(void);

int main (void)
{
    volatile long int n;
    n = -2;

    if ((-2147483647L - 1L) / (-n) != -1073741824L)
        abort ();
    return 0;
}

A simple overflow check at around the following lines should fix the issue:

    } else if (match(LHS, m_SDiv(m_ConstantInt(CI2), m_Value()))) {
      // 'sdiv CI2, x' produces [-|CI2|, |CI2|].
      Upper = CI2->getValue().abs() + 1;
      Lower = (-Upper) + 1;

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20140703/00e9982c/attachment.html>