[llvm] [TailDuplicator] Fix miss-compile with PHI referencing each other in TailBB (PR #194832)
via llvm-commits
llvm-commits at lists.llvm.org
Wed Apr 29 03:55:50 PDT 2026
https://github.com/Ralender created https://github.com/llvm/llvm-project/pull/194832
Here is an example of when it happens
```
PredBB:
A = add P0, 1
...
BR TailBB
TailBB:
P0 = PHI [A, PredBB]...
P1 = PHI [P0, PredBB] ...
BR PredBB, ...
```
when re-writing the PHIs, P1 would be replaced in TailBB with A instead of P0 at the entry of PredBB
>From 88e3c4bdcd9adb6ca795ec5e806ee4afebf19abe Mon Sep 17 00:00:00 2001
From: tyker <tyker1 at outlook.com>
Date: Wed, 29 Apr 2026 12:29:16 +0200
Subject: [PATCH 1/2] [TailDuplicator] Add test showing bug
---
.../CodeGen/X86/tail-dup-cross-phi-source.ll | 116 ++++++++++++++++++
1 file changed, 116 insertions(+)
create mode 100644 llvm/test/CodeGen/X86/tail-dup-cross-phi-source.ll
diff --git a/llvm/test/CodeGen/X86/tail-dup-cross-phi-source.ll b/llvm/test/CodeGen/X86/tail-dup-cross-phi-source.ll
new file mode 100644
index 0000000000000..d2df5192dfd7e
--- /dev/null
+++ b/llvm/test/CodeGen/X86/tail-dup-cross-phi-source.ll
@@ -0,0 +1,116 @@
+; NOTE: Assertions have been autogenerated by utils/update_mir_test_checks.py
+; RUN: llc -mtriple=x86_64-linux -stop-after=early-tailduplication \
+; RUN: -verify-machineinstrs < %s | FileCheck %s
+
+; TailDuplicator miscompile when TailBB has two PHIs and one PHI's source
+; from a non-duplicated pred is the other PHI's def.
+
+define fastcc void @misscompile_early_taildup(i32 %Value415, ptr %Ptr) {
+ ; CHECK-LABEL: name: misscompile_early_taildup
+ ; CHECK: bb.0.Block306:
+ ; CHECK-NEXT: successors: %bb.5(0x2a3677d4), %bb.1(0x2a3677d4), %bb.7(0x00000000), %bb.3(0x2a3677d4), %bb.6(0x015c9883)
+ ; CHECK-NEXT: liveins: $edi, $rsi
+ ; CHECK-NEXT: {{ $}}
+ ; CHECK-NEXT: [[COPY:%[0-9]+]]:gr64 = COPY $rsi
+ ; CHECK-NEXT: [[COPY1:%[0-9]+]]:gr32 = COPY $edi
+ ; CHECK-NEXT: [[MOV32r0_:%[0-9]+]]:gr32 = MOV32r0 implicit-def dead $eflags
+ ; CHECK-NEXT: MOV32mr [[COPY]], 1, $noreg, 0, $noreg, [[COPY1]] :: (volatile store (s32) into %ir.Ptr)
+ ; CHECK-NEXT: [[MOV32rm:%[0-9]+]]:gr32 = MOV32rm [[COPY]], 1, $noreg, 0, $noreg :: (volatile load (s32) from %ir.Ptr)
+ ; CHECK-NEXT: [[SUBREG_TO_REG:%[0-9]+]]:gr64_nosp = SUBREG_TO_REG [[MOV32rm]], %subreg.sub_32bit
+ ; CHECK-NEXT: [[COPY2:%[0-9]+]]:gr32 = COPY [[COPY1]]
+ ; CHECK-NEXT: JMP64m $noreg, 8, [[SUBREG_TO_REG]], %jump-table.0, $noreg :: (load (s64) from jump-table)
+ ; CHECK-NEXT: {{ $}}
+ ; CHECK-NEXT: bb.1.Block307:
+ ; CHECK-NEXT: successors: %bb.4(0x40000000), %bb.2(0x40000000)
+ ; CHECK-NEXT: {{ $}}
+ ; CHECK-NEXT: [[PHI:%[0-9]+]]:gr32 = PHI %2, %bb.4, [[COPY2]], %bb.0, %16, %bb.5, %20, %bb.2
+ ; CHECK-NEXT: [[PHI1:%[0-9]+]]:gr32 = PHI %1, %bb.4, [[MOV32r0_]], %bb.0, %28, %bb.5, %19, %bb.2
+ ; CHECK-NEXT: [[SUB32rm:%[0-9]+]]:gr32 = SUB32rm [[PHI]], [[COPY]], 1, $noreg, 0, $noreg, implicit-def $eflags :: (volatile load (s32) from %ir.Ptr)
+ ; CHECK-NEXT: JCC_1 %bb.4, 4, implicit $eflags
+ ; CHECK-NEXT: JMP_1 %bb.2
+ ; CHECK-NEXT: {{ $}}
+ ; CHECK-NEXT: bb.2.Block308:
+ ; CHECK-NEXT: successors: %bb.5(0x2a3677d4), %bb.1(0x2a3677d4), %bb.7(0x00000000), %bb.3(0x2a3677d4), %bb.6(0x015c9883)
+ ; CHECK-NEXT: {{ $}}
+ ; CHECK-NEXT: [[MOV32r0_1:%[0-9]+]]:gr32 = MOV32r0 implicit-def dead $eflags
+ ; CHECK-NEXT: MOV32mr [[COPY]], 1, $noreg, 0, $noreg, [[MOV32r0_1]] :: (volatile store (s32) into %ir.Ptr)
+ ; CHECK-NEXT: [[MOV32rm1:%[0-9]+]]:gr32 = MOV32rm [[COPY]], 1, $noreg, 0, $noreg :: (volatile load (s32) from %ir.Ptr)
+ ; CHECK-NEXT: [[SUBREG_TO_REG1:%[0-9]+]]:gr64_nosp = SUBREG_TO_REG [[MOV32rm1]], %subreg.sub_32bit
+ ; CHECK-NEXT: [[COPY3:%[0-9]+]]:gr32 = COPY [[PHI]]
+ ; CHECK-NEXT: [[COPY4:%[0-9]+]]:gr32 = COPY [[MOV32r0_1]]
+ ; CHECK-NEXT: JMP64m $noreg, 8, [[SUBREG_TO_REG1]], %jump-table.0, $noreg :: (load (s64) from jump-table)
+ ; CHECK-NEXT: {{ $}}
+ ; CHECK-NEXT: bb.3.Block311:
+ ; CHECK-NEXT: successors: %bb.4(0x80000000)
+ ; CHECK-NEXT: {{ $}}
+ ; CHECK-NEXT: [[PHI2:%[0-9]+]]:gr32 = PHI %2, %bb.4, [[COPY2]], %bb.0, %16, %bb.5, [[COPY4]], %bb.2
+ ; CHECK-NEXT: [[INC32r:%[0-9]+]]:gr32 = INC32r [[PHI2]], implicit-def dead $eflags
+ ; CHECK-NEXT: [[COPY5:%[0-9]+]]:gr32 = COPY [[PHI2]]
+ ; CHECK-NEXT: [[COPY6:%[0-9]+]]:gr32 = COPY [[INC32r]]
+ ; CHECK-NEXT: {{ $}}
+ ; CHECK-NEXT: bb.4..backedge:
+ ; CHECK-NEXT: successors: %bb.5(0x2a3677d4), %bb.1(0x2a3677d4), %bb.7(0x00000000), %bb.3(0x2a3677d4), %bb.6(0x015c9883)
+ ; CHECK-NEXT: {{ $}}
+ ; CHECK-NEXT: [[PHI3:%[0-9]+]]:gr32 = PHI [[COPY6]], %bb.3, [[PHI]], %bb.1
+ ; CHECK-NEXT: [[PHI4:%[0-9]+]]:gr32 = PHI [[INC32r]], %bb.3, [[PHI1]], %bb.1
+ ; CHECK-NEXT: MOV32mr [[COPY]], 1, $noreg, 0, $noreg, [[PHI4]] :: (volatile store (s32) into %ir.Ptr)
+ ; CHECK-NEXT: [[MOV32rm2:%[0-9]+]]:gr32 = MOV32rm [[COPY]], 1, $noreg, 0, $noreg :: (volatile load (s32) from %ir.Ptr)
+ ; CHECK-NEXT: [[SUBREG_TO_REG2:%[0-9]+]]:gr64_nosp = SUBREG_TO_REG killed [[MOV32rm2]], %subreg.sub_32bit
+ ; CHECK-NEXT: JMP64m $noreg, 8, [[SUBREG_TO_REG2]], %jump-table.0, $noreg :: (load (s64) from jump-table)
+ ; CHECK-NEXT: {{ $}}
+ ; CHECK-NEXT: bb.5.Block312:
+ ; CHECK-NEXT: successors: %bb.5(0x2a3677d4), %bb.1(0x2a3677d4), %bb.7(0x00000000), %bb.3(0x2a3677d4), %bb.6(0x015c9883)
+ ; CHECK-NEXT: {{ $}}
+ ; CHECK-NEXT: [[PHI5:%[0-9]+]]:gr32 = PHI [[PHI4]], %bb.4, [[COPY2]], %bb.0, %16, %bb.5, [[COPY4]], %bb.2
+ ; CHECK-NEXT: [[MOV32rm3:%[0-9]+]]:gr32 = MOV32rm [[COPY]], 1, $noreg, 0, $noreg :: (volatile load (s32) from %ir.Ptr)
+ ; CHECK-NEXT: MOV32mr [[COPY]], 1, $noreg, 0, $noreg, [[MOV32rm3]] :: (volatile store (s32) into %ir.Ptr)
+ ; CHECK-NEXT: [[MOV32rm4:%[0-9]+]]:gr32 = MOV32rm [[COPY]], 1, $noreg, 0, $noreg :: (volatile load (s32) from %ir.Ptr)
+ ; CHECK-NEXT: [[SUBREG_TO_REG3:%[0-9]+]]:gr64_nosp = SUBREG_TO_REG [[MOV32rm4]], %subreg.sub_32bit
+ ; CHECK-NEXT: [[COPY7:%[0-9]+]]:gr32 = COPY [[MOV32rm3]]
+ ; CHECK-NEXT: JMP64m $noreg, 8, [[SUBREG_TO_REG3]], %jump-table.0, $noreg :: (load (s64) from jump-table)
+ ; CHECK-NEXT: {{ $}}
+ ; CHECK-NEXT: bb.6.Block313:
+ ; CHECK-NEXT: RET 0
+ ; CHECK-NEXT: {{ $}}
+ ; CHECK-NEXT: bb.7.Block319:
+Block306:
+ br label %.backedge
+
+Block307: ; preds = %.backedge
+ %Value2 = load volatile i32, ptr %Ptr
+ %Value367 = icmp eq i32 %Value409, %Value2
+ br i1 %Value367, label %.backedge.backedge, label %Block308
+
+Block308: ; preds = %Block307
+ br label %.backedge.backedge
+
+Block311: ; preds = %.backedge
+ %Value410 = add i32 %Value409, 1
+ br label %.backedge.backedge
+
+.backedge: ; preds = %.backedge.backedge, %Block306
+ %Value403 = phi i32 [ 0, %Block306 ], [ %Value409, %.backedge.backedge ]
+ %Value409 = phi i32 [ %Value415, %Block306 ], [ %.be75, %.backedge.backedge ]
+ store volatile i32 %Value409, ptr %Ptr
+ %choice = load volatile i32, ptr %Ptr
+ switch i32 %choice, label %Block319 [
+ i32 1, label %Block307
+ i32 0, label %Block312
+ i32 19, label %Block313
+ i32 18, label %Block311
+ ]
+
+Block312: ; preds = %.backedge
+ %Val = load volatile i32, ptr %Ptr
+ br label %.backedge.backedge
+
+Block313: ; preds = %.backedge
+ ret void
+
+Block319: ; preds = %.backedge
+ unreachable
+
+.backedge.backedge: ; preds = %Block312, %Block311, %Block308, %Block307
+ %.be75 = phi i32 [ %Val, %Block312 ], [ %Value410, %Block311 ], [ %Value403, %Block307 ], [ 0, %Block308 ]
+ br label %.backedge
+}
>From 89553acac5567b845acac0a1d50f3c1a5d66fc37 Mon Sep 17 00:00:00 2001
From: tyker <tyker1 at outlook.com>
Date: Wed, 29 Apr 2026 12:37:44 +0200
Subject: [PATCH 2/2] [TailDuplicator] Fix miss-compile with PHI referencing
each other in TailBB
Here is an example of when it happens
```
PredBB:
A = add P0, 1
...
BR TailBB
TailBB:
P0 = PHI [A, PredBB]...
P1 = PHI [P0, PredBB] ...
BR PredBB, ...
```
when re-writing the PHIs, P1 would be replaced with A instead of P0 at the entry of PredBB
---
llvm/lib/CodeGen/TailDuplicator.cpp | 10 +++++++++-
llvm/test/CodeGen/X86/tail-dup-cross-phi-source.ll | 2 +-
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/llvm/lib/CodeGen/TailDuplicator.cpp b/llvm/lib/CodeGen/TailDuplicator.cpp
index b059f28e3c9b3..ba95eac3146a1 100644
--- a/llvm/lib/CodeGen/TailDuplicator.cpp
+++ b/llvm/lib/CodeGen/TailDuplicator.cpp
@@ -372,8 +372,16 @@ void TailDuplicator::processPHI(
if (isDefLiveOut(DefReg, TailBB, MRI) || RegsUsedByPhi.count(DefReg))
addSSAUpdateEntry(DefReg, NewDef, PredBB);
- if (!Remove)
+ if (!Remove) {
+ // If SrcReg is another PHI in TailBB, MachineSSAUpdater can update this
+ // operand with the wrong PHI. So we update it correctly here.
+ MachineInstr *SrcDefMI = MRI->getVRegDef(SrcReg);
+ if (SrcDefMI && SrcDefMI->isPHI() && SrcDefMI->getParent() == TailBB) {
+ MI->getOperand(SrcOpIdx).setReg(NewDef);
+ MI->getOperand(SrcOpIdx).setSubReg(0);
+ }
return;
+ }
MI->removePHIIncomingValueFor(*PredBB);
diff --git a/llvm/test/CodeGen/X86/tail-dup-cross-phi-source.ll b/llvm/test/CodeGen/X86/tail-dup-cross-phi-source.ll
index d2df5192dfd7e..0727ba46965d8 100644
--- a/llvm/test/CodeGen/X86/tail-dup-cross-phi-source.ll
+++ b/llvm/test/CodeGen/X86/tail-dup-cross-phi-source.ll
@@ -51,7 +51,7 @@ define fastcc void @misscompile_early_taildup(i32 %Value415, ptr %Ptr) {
; CHECK-NEXT: bb.4..backedge:
; CHECK-NEXT: successors: %bb.5(0x2a3677d4), %bb.1(0x2a3677d4), %bb.7(0x00000000), %bb.3(0x2a3677d4), %bb.6(0x015c9883)
; CHECK-NEXT: {{ $}}
- ; CHECK-NEXT: [[PHI3:%[0-9]+]]:gr32 = PHI [[COPY6]], %bb.3, [[PHI]], %bb.1
+ ; CHECK-NEXT: [[PHI3:%[0-9]+]]:gr32 = PHI [[COPY5]], %bb.3, [[PHI]], %bb.1
; CHECK-NEXT: [[PHI4:%[0-9]+]]:gr32 = PHI [[INC32r]], %bb.3, [[PHI1]], %bb.1
; CHECK-NEXT: MOV32mr [[COPY]], 1, $noreg, 0, $noreg, [[PHI4]] :: (volatile store (s32) into %ir.Ptr)
; CHECK-NEXT: [[MOV32rm2:%[0-9]+]]:gr32 = MOV32rm [[COPY]], 1, $noreg, 0, $noreg :: (volatile load (s32) from %ir.Ptr)
More information about the llvm-commits
mailing list