[llvm-bugs] [Bug 48435] New: [InstCombine] Miscompile (?) of select with poison case

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=48435

            Bug ID: 48435
           Summary: [InstCombine] Miscompile (?) of select with poison
                    case
           Product: libraries
           Version: trunk
          Hardware: PC
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: Scalar Optimizations
          Assignee: unassignedbugs at nondot.org
          Reporter: meheff at google.com
                CC: llvm-bugs at lists.llvm.org

I'm not totally sure this is a bug as I don't know the semantics of a select
which has a poison value in the non-selected position. Anyway, the input is
basically a shift followed by select with some other cruft. The select guards
against use of an overshifted value by selecting zero in the case of overshift.

Input:

define i1 @test() local_unnamed_addr {
so_basic:
  %x5 = call i32 @f(i32 100)
  %ne_42 = icmp ne i32 %x5, 0
  %_z3 = zext i32 %x5 to i64
  %_z4 = icmp uge i64 %_z3, 64
  %_z5 = lshr i64 256, %_z3
  %_z6 = trunc i64 %_z5 to i32
  %x15 = select i1 %_z4, i32 0, i32 %_z6
  %ne_44 = icmp ne i32 %x15, 0
  %x18 = or i1 %ne_42, %ne_44
  ret i1 %x18
}

define i32 @f(i32 %x) {
  ret i32 %x
}


Result of opt -O2:


define i1 @test() local_unnamed_addr #0 {
so_basic:
  ret i1 poison
}


Looks like the problematic xform replaces the select(p, false, x) with
and(not(p), x) where x is poison in this case.


Alive:

----------------------------------------
define i1 @src() {
%0:
  %x5 = call i32 @f(i32 100)
  %ne_42 = icmp ne i32 %x5, 0
  %_z3 = zext i32 %x5 to i64
  %_z4 = icmp ugt i32 %x5, 63
  %_z5 = lshr i64 256, %_z3
  %_z6 = trunc i64 %_z5 to i32
  %ne_441 = icmp ne i32 %_z6, 0
  %not._z4 = xor i1 %_z4, 1
  %ne_44 = and i1 %not._z4, %ne_441
  %x18 = or i1 %ne_42, %ne_44
  ret i1 %x18
}
=>
define i1 @tgt() {
%0:
  ret i1 poison
}
Transformation doesn't verify!
ERROR: Target is more poisonous than source

Example:

Source:
i32 %x5 = #x00000000 (0)
i1 %ne_42 = #x0 (0)
i64 %_z3 = #x0000000000000000 (0)
i1 %_z4 = #x0 (0)
i64 %_z5 = #x0000000000000100 (256)
i32 %_z6 = #x00000100 (256)
i1 %ne_441 = #x1 (1)
i1 %not._z4 = #x1 (1)
i1 %ne_44 = #x1 (1)
i1 %x18 = #x1 (1)

SOURCE MEMORY STATE
===================
NON-LOCAL BLOCKS:
Block 0 >       size: 0 align: 1        alloc type: 0
Block 1 >       size: 0 align: 2        alloc type: 0

Target:
Source value: #x1 (1)
Target value: poison

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20201208/62c23a89/attachment.html>