[llvm-dev] Dereferenceable load semantics & LICM

[Sanjoy Das via llvm-dev]

Hi Piotr,

On April 6, 2017 at 2:36:53 AM, Piotr Padlewski
(piotr.padlewski at gmail.com) wrote:
> I disagree, I find it different than the patch you mentioned. We don't have
> any problems with code like this:
>
> ptr = load i8*, i8** %ptrptr, !dereferenceable !{i64 8}
> if (false) {
>
> // ptr is not actually dereferenceable, even the load above has UB
> // (since the metadata is "wrong"), but it is never executed so all is
> well.
> int val = *ptr;
> }

I was not talking about code like that.  The problem is code like this:

if (false) {
  ptr = load i8*, i8** %ptrptr, !dereferenceable !{i64 8, !"GlobalProperty}
  // ptr is not actually dereferenceable, even the load above has UB
  // (since the metadata is "wrong"), but it is never executed so all is well.
  int val = *ptr;
}

I did not mention this earlier, but I've assumed that %ptrptr itself
is dereferenceable, which means you can hoist the load of ptr.  Since
because of !"GlobalProperty" you don't strip the !dereferenceable,
you'll also be able to hoist the load of val, which would segfault
because ptr was not dereferenceable.

That is, with the !"GlobalProperty" bit in the picture, it is possible
to make "if (false) { X }" introduce UB in a program for certain
values of X.

-- Sanjoy