https://bugs.llvm.org/show_bug.cgi?id=49495
Bug ID: 49495
Summary: A miscompilation bug in InstructionSimplify.cpp
(select + icmp gep inbounds)
Product: libraries
Version: trunk
Hardware: PC
OS: All
Status: NEW
Severity: normal
Priority: P
Component: Scalar Optimizations
Assignee: unassignedb...@nondot.org
Reporter: juneyoung....@sf.snu.ac.kr
CC: llvm-bugs@lists.llvm.org
```
$ cat a.ll
define i1 @f(i8* %a, i8* %b) {
%cond1 = icmp ne i8* %a, %b
%a2 = getelementptr inbounds i8, i8* %a, i64 -1
%cond2 = icmp ugt i8* %a2, %b
%res = select i1 %cond1, i1 %cond2, i1 false
ret i1 %res
}
$ opt -instsimplify ./a.ll -S -o -
define i1 @f(i8* %a, i8* %b) {
%a2 = getelementptr inbounds i8, i8* %a, i64 -1
%cond2 = icmp ugt i8* %a2, %b
ret i1 %cond2
}
```
This is incorrect: if a = b = null, %res before opt is false whereas the output
after opt is poison.
https://alive2.llvm.org/ce/z/SDy_PX
The reason is that SimplifyWithOpReplaced calls SimplifyCmpInst which folds
`(gep inbounds a, -1) >u a` to `false` even if AllowRefinement is false.
A solution that I came up with is to add 'AllowRefinement' field to
SimplifyQuery as well and let SimplifyICmpInst() stop this folding if the flag
is set, but I found that SimplifyQuery is used in many places other than
InstructionSimplify.
Would it be still a reasonable solution though?
--
You are receiving this mail because:
You are on the CC list for the bug._______________________________________________
llvm-bugs mailing list
llvm-bugs@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
