[LLVMdev] LLVM is doing something a bit weird in this example (which messes up DSA)

[Zvonimir Rakamaric]

Hi all,

I have yet another DSA-related question :), and I would appreciate
your help. Actually, the following example generates some interesting
potential issues in the LLVM IR too.

Here is the example in C:
#define CAS(x,y,z) __atomic_compare_exchange_n(x,&(y),z,true,0,0)

int main() {
  int *x = 0;
  int y = 0;
  int *z = x;
  CAS(&z,x,&y); // if (z == x) z = &y;
  assert(*z == y);
  return 0;
}

Now, when compiled into LLVM IR 3.4 (with -mem2reg), an interesting
thing happens in this LLVM IR excerpt:
  %1 = bitcast i32** %z to i64*
  %2 = bitcast i32** %x to i64*
  %3 = bitcast i32** %.atomictmp to i64*
  %4 = load i64* %2, align 8
  %5 = load i64* %3, align 8
  %6 = cmpxchg i64* %1, i64 %4, i64 %5 monotonic

More specifically, there is this %2 bitcast and the subsequent %4 load
that effectively turned an i32* pointer value into an i64 integer
value without using ptrtoint instruction.
My first question is whether that is even allowed in LLVM IR?
It feels like ptrtoint gets bypassed somehow, which does not seem right.

Now, if this LLVM IR code is indeed fine, then we have a problem with
DSA when it gets to this cmpxchg instruction since DSA then does not
know that the second and third arguments to cmpxchg are in fact
pointers. Messy stuff...

Your help would be greatly appreciated...

Thanks!

Cheers,
-- Zvonimir

--
http://zvonimir.info
http://soarlab.org/