[llvm-bugs] [Bug 45952] New: Incorrect instcombine fold of control-flow to umul.with.overflow

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=45952

            Bug ID: 45952
           Summary: Incorrect instcombine fold of control-flow to
                    umul.with.overflow
           Product: libraries
           Version: trunk
          Hardware: All
                OS: All
            Status: NEW
          Keywords: miscompilation
          Severity: normal
          Priority: P
         Component: Scalar Optimizations
          Assignee: unassignedbugs at nondot.org
          Reporter: nunoplopes at sapo.pt
                CC: lebedev.ri at gmail.com, llvm-bugs at lists.llvm.org,
                    regehr at cs.utah.edu, spatel+llvm at rotateright.com

Test: Transforms/PhaseOrdering/unsigned-multiply-overflow-check.ll
Summary: the original code below has a fast-path for %arg1=0 and returns 0 in
that case. The optimized code has no fast-path and so the result is tainted if
%arg=poison.


define i1 @will_not_overflow(i64 %arg, i64 %arg1) {
  %t0 = icmp eq i64 %arg, 0
  br i1 %t0, label %bb5, label %bb2

%bb2:
  %t3 = udiv i64 -1, %arg
  %t4 = icmp ult i64 %t3, %arg1
  br label %bb5

%bb5:
  %t6 = phi i1 [ 0, %bb ], [ %t4, %bb2 ]
  ret i1 %t6
}
=>
define i1 @will_not_overflow(i64 %arg, i64 %arg1) {
  %umul = umul_overflow {i64, i1, i56} %arg, %arg1
  %umul.ov = extractvalue {i64, i1, i56} %umul, 1
  ret i1 %umul.ov
}
Transformation doesn't verify!
ERROR: Target is more poisonous than source

Example:
i64 %arg = #x0000000000000000 (0)
i64 %arg1 = poison

Source:
i1 %t0 = #x1 (1)
i64 %t3 = #xffffffffffffffff (18446744073709551615, -1)
i1 %t4 = poison
i1 %t6 = #x0 (0)

Target:
{i64, i1, i56} %umul = { poison, poison, poison }
i1 %umul.ov = poison
Source value: #x0 (0)
Target value: poison

https://web.ist.utl.pt/nuno.lopes/alive2/index.php?hash=72296a443c683892&test=Transforms%2FPhaseOrdering%2Funsigned-multiply-overflow-check.ll

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20200516/ad9f7c15/attachment.html>