[llvm] r362976 - [Tests] Add tests for D62939 (miscompiles around dead pointer IVs)
Philip Reames via llvm-commits
llvm-commits at lists.llvm.org
Mon Jun 10 12:45:59 PDT 2019
Author: reames
Date: Mon Jun 10 12:45:59 2019
New Revision: 362976
URL: http://llvm.org/viewvc/llvm-project?rev=362976&view=rev
Log:
[Tests] Add tests for D62939 (miscompiles around dead pointer IVs)
Flesh out a collection of tests for switching to a dead IV within LFTR, both for the current miscompile, and for some cases which we should be able to handle via simple reasoning.
Added:
llvm/trunk/test/Transforms/IndVarSimplify/lftr-dead-ivs.ll
Added: llvm/trunk/test/Transforms/IndVarSimplify/lftr-dead-ivs.ll
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Transforms/IndVarSimplify/lftr-dead-ivs.ll?rev=362976&view=auto
==============================================================================
--- llvm/trunk/test/Transforms/IndVarSimplify/lftr-dead-ivs.ll (added)
+++ llvm/trunk/test/Transforms/IndVarSimplify/lftr-dead-ivs.ll Mon Jun 10 12:45:59 2019
@@ -0,0 +1,228 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
+; RUN: opt -S -indvars < %s | FileCheck %s
+
+; Tests in this file are specifically about correctly handling possibly poison
+; producing flags when converting from one IV to another. In particular, there
+; is a risk that the IV we chose to switch to is dynamically dead (i.e. there
+; is no side effect which dependents on the computation thereof). Such an IV
+; can produce poison on one or more iterations without triggering UB. When we
+; add an additional use to such an IV, we need to ensure that our new use does
+; not trigger UB where none existed in the original program.
+
+; Provide legal integer types.
+target datalayout = "n8:16:32:64"
+
+ at data = common global [240 x i8] zeroinitializer, align 16
+
+;; In this example, the pointer IV is dynamicaly dead. As such, the fact that
+;; inbounds produces poison *does not* trigger UB in the original loop. As
+;; such, the pointer IV can be poison and adding a new use of the pointer
+;; IV which dependends on that poison computation in a manner which might
+;; trigger UB would be incorrect.
+;; FIXME: This currently shows a miscompile!
+define void @neg_dynamically_dead_inbounds(i8* %a, i8** %x, i1 %always_false) #0 {
+; CHECK-LABEL: @neg_dynamically_dead_inbounds(
+; CHECK-NEXT: entry:
+; CHECK-NEXT: br label [[LOOP:%.*]]
+; CHECK: loop:
+; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), [[ENTRY:%.*]] ], [ [[TMP3:%.*]], [[CONT:%.*]] ]
+; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1
+; CHECK-NEXT: br i1 [[ALWAYS_FALSE:%.*]], label [[NEVER_EXECUTED:%.*]], label [[CONT]]
+; CHECK: never_executed:
+; CHECK-NEXT: store volatile i8 0, i8* [[TMP3]]
+; CHECK-NEXT: br label [[CONT]]
+; CHECK: cont:
+; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8* [[TMP3]], getelementptr (i8, i8* getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), i64 246)
+; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]]
+; CHECK: exit:
+; CHECK-NEXT: ret void
+;
+entry:
+ br label %loop
+
+loop:
+ %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %cont ]
+ %p.0 = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), %entry ], [ %tmp3, %cont ]
+ %tmp3 = getelementptr inbounds i8, i8* %p.0, i64 1
+ br i1 %always_false, label %never_executed, label %cont
+
+never_executed:
+ store volatile i8 0, i8* %tmp3
+ br label %cont
+
+cont:
+ %tmp4 = add i8 %i.0, 1
+ %tmp5 = icmp ult i8 %tmp4, -10
+ br i1 %tmp5, label %loop, label %exit
+
+exit:
+ ret void
+}
+
+; Similiar to above, but shows how we currently guard non-constant
+; memory operands in a manner which hides the latent miscompile.
+define void @neg_dynamically_dead_inbounds2(i8* %a, i1 %always_false) #0 {
+; CHECK-LABEL: @neg_dynamically_dead_inbounds2(
+; CHECK-NEXT: entry:
+; CHECK-NEXT: br label [[LOOP:%.*]]
+; CHECK: loop:
+; CHECK-NEXT: [[I_0:%.*]] = phi i8 [ 0, [[ENTRY:%.*]] ], [ [[TMP4:%.*]], [[CONT:%.*]] ]
+; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ [[A:%.*]], [[ENTRY]] ], [ [[TMP3:%.*]], [[CONT]] ]
+; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1
+; CHECK-NEXT: br i1 [[ALWAYS_FALSE:%.*]], label [[NEVER_EXECUTED:%.*]], label [[CONT]]
+; CHECK: never_executed:
+; CHECK-NEXT: store volatile i8 0, i8* [[TMP3]]
+; CHECK-NEXT: br label [[CONT]]
+; CHECK: cont:
+; CHECK-NEXT: [[TMP4]] = add nuw i8 [[I_0]], 1
+; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8 [[TMP4]], -10
+; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]]
+; CHECK: exit:
+; CHECK-NEXT: ret void
+;
+entry:
+ br label %loop
+
+loop:
+ %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %cont ]
+ %p.0 = phi i8* [ %a, %entry ], [ %tmp3, %cont ]
+ %tmp3 = getelementptr inbounds i8, i8* %p.0, i64 1
+ br i1 %always_false, label %never_executed, label %cont
+
+never_executed:
+ store volatile i8 0, i8* %tmp3
+ br label %cont
+
+cont:
+ %tmp4 = add i8 %i.0, 1
+ %tmp5 = icmp ult i8 %tmp4, -10
+ br i1 %tmp5, label %loop, label %exit
+
+exit:
+ ret void
+}
+
+define void @dom_store(i8* %a) #0 {
+; CHECK-LABEL: @dom_store(
+; CHECK-NEXT: entry:
+; CHECK-NEXT: br label [[LOOP:%.*]]
+; CHECK: loop:
+; CHECK-NEXT: [[I_0:%.*]] = phi i8 [ 0, [[ENTRY:%.*]] ], [ [[TMP4:%.*]], [[LOOP]] ]
+; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ [[A:%.*]], [[ENTRY]] ], [ [[TMP3:%.*]], [[LOOP]] ]
+; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1
+; CHECK-NEXT: store volatile i8 0, i8* [[TMP3]]
+; CHECK-NEXT: [[TMP4]] = add nuw i8 [[I_0]], 1
+; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8 [[TMP4]], -10
+; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]]
+; CHECK: exit:
+; CHECK-NEXT: ret void
+;
+entry:
+ br label %loop
+
+loop:
+ %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %loop ]
+ %p.0 = phi i8* [ %a, %entry ], [ %tmp3, %loop ]
+ %tmp3 = getelementptr inbounds i8, i8* %p.0, i64 1
+ store volatile i8 0, i8* %tmp3
+ %tmp4 = add i8 %i.0, 1
+ %tmp5 = icmp ult i8 %tmp4, -10
+ br i1 %tmp5, label %loop, label %exit
+
+exit:
+ ret void
+}
+
+define i8 @dom_load(i8* %a) #0 {
+; CHECK-LABEL: @dom_load(
+; CHECK-NEXT: entry:
+; CHECK-NEXT: br label [[LOOP:%.*]]
+; CHECK: loop:
+; CHECK-NEXT: [[I_0:%.*]] = phi i8 [ 0, [[ENTRY:%.*]] ], [ [[TMP4:%.*]], [[LOOP]] ]
+; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ [[A:%.*]], [[ENTRY]] ], [ [[TMP3:%.*]], [[LOOP]] ]
+; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1
+; CHECK-NEXT: [[V:%.*]] = load i8, i8* [[TMP3]]
+; CHECK-NEXT: [[TMP4]] = add nuw i8 [[I_0]], 1
+; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8 [[TMP4]], -10
+; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]]
+; CHECK: exit:
+; CHECK-NEXT: [[V_LCSSA:%.*]] = phi i8 [ [[V]], [[LOOP]] ]
+; CHECK-NEXT: ret i8 [[V_LCSSA]]
+;
+entry:
+ br label %loop
+
+loop:
+ %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %loop ]
+ %p.0 = phi i8* [ %a, %entry ], [ %tmp3, %loop ]
+ %tmp3 = getelementptr inbounds i8, i8* %p.0, i64 1
+ %v = load i8, i8* %tmp3
+ %tmp4 = add i8 %i.0, 1
+ %tmp5 = icmp ult i8 %tmp4, -10
+ br i1 %tmp5, label %loop, label %exit
+
+exit:
+ ret i8 %v
+}
+
+define i64 @dom_div(i64 %a) #0 {
+; CHECK-LABEL: @dom_div(
+; CHECK-NEXT: entry:
+; CHECK-NEXT: br label [[LOOP:%.*]]
+; CHECK: loop:
+; CHECK-NEXT: [[I_0:%.*]] = phi i8 [ 0, [[ENTRY:%.*]] ], [ [[TMP4:%.*]], [[LOOP]] ]
+; CHECK-NEXT: [[I_1:%.*]] = phi i64 [ [[A:%.*]], [[ENTRY]] ], [ [[TMP3:%.*]], [[LOOP]] ]
+; CHECK-NEXT: [[TMP3]] = add nuw nsw i64 [[I_1]], 1
+; CHECK-NEXT: [[V:%.*]] = udiv i64 5, [[TMP3]]
+; CHECK-NEXT: [[TMP4]] = add nuw i8 [[I_0]], 1
+; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8 [[TMP4]], -10
+; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]]
+; CHECK: exit:
+; CHECK-NEXT: [[V_LCSSA:%.*]] = phi i64 [ [[V]], [[LOOP]] ]
+; CHECK-NEXT: ret i64 [[V_LCSSA]]
+;
+entry:
+ br label %loop
+
+loop:
+ %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %loop ]
+ %i.1 = phi i64 [ %a, %entry ], [ %tmp3, %loop ]
+ %tmp3 = add nsw nuw i64 %i.1, 1
+ %v = udiv i64 5, %tmp3
+ %tmp4 = add i8 %i.0, 1
+ %tmp5 = icmp ult i8 %tmp4, -10
+ br i1 %tmp5, label %loop, label %exit
+
+exit:
+ ret i64 %v
+}
+
+; For integer IVs, we handle this trigger case by stripping the problematic
+; flags which removes the potential introduction of UB.
+define void @neg_dead_int_iv(i64 %a) #0 {
+; CHECK-LABEL: @neg_dead_int_iv(
+; CHECK-NEXT: entry:
+; CHECK-NEXT: br label [[LOOP:%.*]]
+; CHECK: loop:
+; CHECK-NEXT: [[I_1:%.*]] = phi i64 [ -2, [[ENTRY:%.*]] ], [ [[TMP3:%.*]], [[LOOP]] ]
+; CHECK-NEXT: [[TMP3]] = add nsw i64 [[I_1]], 1
+; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i64 [[TMP3]], 244
+; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]]
+; CHECK: exit:
+; CHECK-NEXT: ret void
+;
+entry:
+ br label %loop
+
+loop:
+ %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %loop ]
+ %i.1 = phi i64 [ -2, %entry ], [ %tmp3, %loop ]
+ %tmp3 = add nsw nuw i64 %i.1, 1
+ %tmp4 = add i8 %i.0, 1
+ %tmp5 = icmp ult i8 %tmp4, -10
+ br i1 %tmp5, label %loop, label %exit
+
+exit:
+ ret void
+}
+
More information about the llvm-commits
mailing list