[PATCH] D125933: [ConstantRange] Improve the implementation of binaryOr

[Mitch Phillips via Phabricator via llvm-commits]

hctim added a comment.

relevant old IR:

  116:                                              ; preds = %111, %land.lhs.true35
    %117 = load i8, ptr %arrayidx36, align 1, !dbg !59, !tbaa !22
    call void @__sanitizer_cov_trace_const_cmp1(i8 82, i8 %117), !dbg !60
    %cmp38 = icmp eq i8 %117, 82, !dbg !60
    br i1 %cmp38, label %if.then39, label %land.lhs.true35.if.end41_crit_edge, !dbg !61
  
  land.lhs.true35.if.end41_crit_edge:               ; preds = %116
    %118 = load i8, ptr getelementptr inbounds ([21 x i8], ptr @__sancov_gen_, i64 0, i64 17), align 1, !dbg !61, !nosanitize !16
    %119 = add i8 %118, 1, !dbg !61
    store i8 %119, ptr getelementptr inbounds ([21 x i8], ptr @__sancov_gen_, i64 0, i64 17), align 1, !dbg !61, !nosanitize !16
    br label %if.end41, !dbg !61
  
  if.then39:                                        ; preds = %116
    %120 = load i8, ptr getelementptr inbounds ([21 x i8], ptr @__sancov_gen_, i64 0, i64 18), align 1, !dbg !62, !nosanitize !16
    %121 = add i8 %120, 1, !dbg !62
    store i8 %121, ptr getelementptr inbounds ([21 x i8], ptr @__sancov_gen_, i64 0, i64 18), align 1, !dbg !62, !nosanitize !16
    %or40 = or i32 %bits.4, 32, !dbg !62
    br label %if.end41, !dbg !63
  
  if.end41:                                         ; preds = %land.lhs.true35.if.end41_crit_edge, %if.end33.if.end41_crit_edge, %if.end25.if.end41_crit_edge, %if.end17.if.end41_crit_edge, %if.then39
    %bits.5 = phi i32 [ %or40, %if.then39 ], [ %bits.4, %land.lhs.true35.if.end41_crit_edge ], [ %bits.4, %if.end33.if.end41_crit_edge ], [ %bits.3, %if.end25.if.end41_crit_edge ], [ %bits.2, %if.end17.if.end41_crit_edge ], !dbg !28
    call void @__sanitizer_cov_trace_const_cmp4(i32 63, i32 %bits.5), !dbg !64
    %cmp42 = icmp eq i32 %bits.5, 63, !dbg !64
    br i1 %cmp42, label %if.then43, label %if.end41.if.end44_crit_edge, !dbg !65

new IR:

  116:                                              ; preds = %111, %land.lhs.true35
    %117 = load i8, ptr %arrayidx36, align 1, !dbg !59, !tbaa !22
    call void @__sanitizer_cov_trace_const_cmp1(i8 82, i8 %117), !dbg !60
    %cmp38 = icmp eq i8 %117, 82, !dbg !60
    br i1 %cmp38, label %if.end41, label %land.lhs.true35.if.end44_crit_edge, !dbg !61
  
  land.lhs.true35.if.end44_crit_edge:               ; preds = %116
    %118 = load i8, ptr getelementptr inbounds ([20 x i8], ptr @__sancov_gen_, i64 0, i64 17), align 1, !dbg !61, !nosanitize !16
    %119 = add i8 %118, 1, !dbg !61
    store i8 %119, ptr getelementptr inbounds ([20 x i8], ptr @__sancov_gen_, i64 0, i64 17), align 1, !dbg !61, !nosanitize !16
    br label %if.end44, !dbg !61
  
  if.end41:                                         ; preds = %116
    %120 = and i32 %bits.4, -33, !dbg !62
    call void @__sanitizer_cov_trace_const_cmp4(i32 31, i32 %120), !dbg !62
    %cmp42 = icmp eq i32 %120, 31, !dbg !62
    br i1 %cmp42, label %if.then43, label %if.end41.if.end44_crit_edge, !dbg !63

deleted parts of `if.then39` references `!dbg !62`, which is `!62 = !DILocation(line: 19, column: 12, scope: !13)`.

references this line in `compiler-rt/test/fuzzer/FullCoverageSetTest.cpp`:

  if (bits == 63) {
           ^ this equality comparison.

after this patch, the compiler is smart enough to realise that, for the given code:

  if (Size > 5 && Data[5] == 'R') bits |= 32;
  if (bits == 63) {
    std::cerr <<  "BINGO!\n";
    exit(1);
  }

`if (Size > 5 && Data[5] == 'R')` then, we always enter the `if (bits == 63)` branch. Therefore, we pruned an additional branch, and so there's one less sancov block.

I'll update the golden file for the test.


Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D125933/new/

https://reviews.llvm.org/D125933