[llvm-bugs] [Bug 49495] New: A miscompilation bug in InstructionSimplify.cpp (select + icmp gep inbounds)

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=49495

            Bug ID: 49495
           Summary: A miscompilation bug in InstructionSimplify.cpp
                    (select + icmp gep inbounds)
           Product: libraries
           Version: trunk
          Hardware: PC
                OS: All
            Status: NEW
          Severity: normal
          Priority: P
         Component: Scalar Optimizations
          Assignee: unassignedbugs at nondot.org
          Reporter: juneyoung.lee at sf.snu.ac.kr
                CC: llvm-bugs at lists.llvm.org

```
$ cat a.ll
define i1 @f(i8* %a, i8* %b) {
  %cond1 = icmp ne i8* %a, %b
  %a2 = getelementptr inbounds i8, i8* %a, i64 -1
  %cond2 = icmp ugt i8* %a2, %b
  %res = select i1 %cond1, i1 %cond2, i1 false
  ret i1 %res
}

$ opt -instsimplify ./a.ll -S -o -
define i1 @f(i8* %a, i8* %b) {
  %a2 = getelementptr inbounds i8, i8* %a, i64 -1
  %cond2 = icmp ugt i8* %a2, %b
  ret i1 %cond2
}
```

This is incorrect: if a = b = null, %res before opt is false whereas the output
after opt is poison.

https://alive2.llvm.org/ce/z/SDy_PX

The reason is that SimplifyWithOpReplaced calls SimplifyCmpInst which folds
`(gep inbounds a, -1) >u a` to `false` even if AllowRefinement is false.

A solution that I came up with is to add 'AllowRefinement' field to
SimplifyQuery as well and let SimplifyICmpInst() stop this folding if the flag
is set, but I found that SimplifyQuery is used in many places other than
InstructionSimplify.
Would it be still a reasonable solution though?

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20210309/60cb44fd/attachment.html>