[llvm-bugs] [Bug 31633] New: InstCombine can't fold "select %c, undef, %foo" to %foo (miscompile)

[via llvm-bugs]

https://llvm.org/bugs/show_bug.cgi?id=31633

            Bug ID: 31633
           Summary: InstCombine can't fold "select %c, undef, %foo" to
                    %foo  (miscompile)
           Product: libraries
           Version: trunk
          Hardware: All
                OS: All
            Status: NEW
          Keywords: miscompilation
          Severity: normal
          Priority: P
         Component: Scalar Optimizations
          Assignee: unassignedbugs at nondot.org
          Reporter: nunoplopes at sapo.pt
                CC: david.majnemer at gmail.com, gil.hur at sf.snu.ac.kr,
                    juneyoung.lee at sf.snu.ac.kr, llvm-bugs at lists.llvm.org,
                    regehr at cs.utah.edu, sanjoy at playingwithpointers.com,
                    spatel+llvm at rotateright.com
    Classification: Unclassified

InstCombine currently folds  "select %c, undef, %foo" into %foo, because it
assumes that undef can take any value that %foo may take.
This is not correct since %foo may be poison.
This problem has long been know, but I'm adding now an end-to-end
miscompilation example triggered by this bug.

$ cat select-undef.ll
define i1 @f(i1 %c, i32 %y) {
  %y2 = add nsw i32 %y, 1
  %s = select i1 %c, i32 undef, i32 %y2
  %r = icmp sgt i32 %s, %y
  ret i1 %r
}

$ opt -S select-undef.ll -instcombine
define i1 @f(i1 %c, i32 %y) {
  ret i1 true
}

Which is wrong for the case %y=0x7FFFFFFF and %c=true. %y2 overflows and
becomes poison, but the select should return undef only, not poison.
Alive report: http://rise4fun.com/Alive/XGW

Related with PR31632.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20170113/075b1b36/attachment-0001.html>