[llvm-bugs] [Bug 31633] New: InstCombine can't fold "select %c, undef, %foo" to %foo (miscompile)

via llvm-bugs llvm-bugs at lists.llvm.org
Fri Jan 13 09:25:33 PST 2017


            Bug ID: 31633
           Summary: InstCombine can't fold "select %c, undef, %foo" to
                    %foo  (miscompile)
           Product: libraries
           Version: trunk
          Hardware: All
                OS: All
            Status: NEW
          Keywords: miscompilation
          Severity: normal
          Priority: P
         Component: Scalar Optimizations
          Assignee: unassignedbugs at nondot.org
          Reporter: nunoplopes at sapo.pt
                CC: david.majnemer at gmail.com, gil.hur at sf.snu.ac.kr,
                    juneyoung.lee at sf.snu.ac.kr, llvm-bugs at lists.llvm.org,
                    regehr at cs.utah.edu, sanjoy at playingwithpointers.com,
                    spatel+llvm at rotateright.com
    Classification: Unclassified

InstCombine currently folds  "select %c, undef, %foo" into %foo, because it
assumes that undef can take any value that %foo may take.
This is not correct since %foo may be poison.
This problem has long been know, but I'm adding now an end-to-end
miscompilation example triggered by this bug.

$ cat select-undef.ll
define i1 @f(i1 %c, i32 %y) {
  %y2 = add nsw i32 %y, 1
  %s = select i1 %c, i32 undef, i32 %y2
  %r = icmp sgt i32 %s, %y
  ret i1 %r

$ opt -S select-undef.ll -instcombine
define i1 @f(i1 %c, i32 %y) {
  ret i1 true

Which is wrong for the case %y=0x7FFFFFFF and %c=true. %y2 overflows and
becomes poison, but the select should return undef only, not poison.
Alive report: http://rise4fun.com/Alive/XGW

Related with PR31632.

You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20170113/075b1b36/attachment-0001.html>

More information about the llvm-bugs mailing list