[llvm-bugs] [Bug 32964] New: load from @i hoisted before store to @i by -speculative-execution

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=32964

            Bug ID: 32964
           Summary: load from @i hoisted before store to @i by
                    -speculative-execution
           Product: new-bugs
           Version: unspecified
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: new bugs
          Assignee: unassignedbugs at nondot.org
          Reporter: mikael.holmen at ericsson.com
                CC: llvm-bugs at lists.llvm.org

Created attachment 18415
  --> https://bugs.llvm.org/attachment.cgi?id=18415&action=edit
reproducer

opt -S -speculative-execution -o - spec.ll

In the input we have:

entry:
  %0 = load i8, i8* @i
  %tobool = icmp eq i8 %0, 0
  br i1 %tobool, label %if.end, label %if.then

if.then:                                          ; preds = %entry
  store i8 0, i8* @i
  %.pre = load i8, i8* @i
  br label %if.end

and in the output we get:

entry:
  %0 = load i8, i8* @i
  %tobool = icmp eq i8 %0, 0
  %.pre = load i8, i8* @i
  br i1 %tobool, label %if.end, label %if.then

if.then:                                          ; preds = %entry
  store i8 0, i8* @i
  br label %if.end

so

  %.pre = load i8, i8* @i

has been moved before

  store i8 0, i8* @i

and we'll load the old (wrong) value.

This started going wrong after commit

 SpeculativeExecution: Stop using whitelist for costs

but I suppose that is because costs in general went down
with that patch so it triggers in more cases.

This seems very broken to me and I see these errors a lot in our out-of-tree
backend.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20170508/01907c38/attachment.html>