Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[GVNPass] Range attribute should be handled after CSE #113997

Closed
dtcxzyw opened this issue Oct 29, 2024 · 0 comments · Fixed by #114011
Closed

[GVNPass] Range attribute should be handled after CSE #113997

dtcxzyw opened this issue Oct 29, 2024 · 0 comments · Fixed by #114011
Assignees
Labels
llvm:GVN GVN and NewGVN stages (Global value numbering) miscompilation

Comments

@dtcxzyw
Copy link
Member

dtcxzyw commented Oct 29, 2024

Reproducer: https://alive2.llvm.org/ce/z/HAnoKn

define i1 @src(i32 noundef %x) {
  %cmp1 = icmp sgt i32 %x, 0
  %ctpop1 = tail call range(i32 1, 32) i32 @llvm.ctpop.i32(i32 %x)
  %cmp2 = icmp samesign ult i32 %ctpop1, 2
  %cond = select i1 %cmp1, i1 %cmp2, i1 false
  br i1 %cond, label %if.then, label %if.else

if.else:
  %ctpop2 = tail call range(i32 0, 33) i32 @llvm.ctpop.i32(i32 %x)
  %res = icmp eq i32 %ctpop2, 1
  ret i1 %res

if.then:
  ret i1 false
}

define i1 @tgt(i32 noundef %x) {
  %cmp1 = icmp sgt i32 %x, 0
  %ctpop1 = tail call range(i32 1, 32) i32 @llvm.ctpop.i32(i32 %x)
  %cmp2 = icmp samesign ult i32 %ctpop1, 2
  %cond = select i1 %cmp1, i1 %cmp2, i1 false
  br i1 %cond, label %if.then, label %if.else

if.else:
  %res = icmp eq i32 %ctpop1, 1
  ret i1 %res

if.then:
  ret i1 false
}

----------------------------------------
define i1 @src(i32 noundef %x) {
#0:
  %cmp1 = icmp sgt i32 noundef %x, 0
  %ctpop1 = ctpop i32 noundef %x
  %#range_0_%ctpop1 = !range i32 %ctpop1, i32 1, i32 32
  %cmp2 = icmp samesign ult i32 %#range_0_%ctpop1, 2
  %cond = select i1 %cmp1, i1 %cmp2, i1 0
  br i1 %cond, label %if.then, label %if.else

if.else:
  %ctpop2 = ctpop i32 noundef %x
  %#range_1_%ctpop2 = !range i32 %ctpop2, i32 0, i32 33
  %res = icmp eq i32 %#range_1_%ctpop2, 1
  ret i1 %res

if.then:
  ret i1 0
}
=>
define i1 @tgt(i32 noundef %x) {
#0:
  %cmp1 = icmp sgt i32 noundef %x, 0
  %ctpop1 = ctpop i32 noundef %x
  %#range_0_%ctpop1 = !range i32 %ctpop1, i32 1, i32 32
  %cmp2 = icmp samesign ult i32 %#range_0_%ctpop1, 2
  %cond = select i1 %cmp1, i1 %cmp2, i1 0
  br i1 %cond, label %if.then, label %if.else

if.else:
  %res = icmp eq i32 %#range_0_%ctpop1, 1
  ret i1 %res

if.then:
  ret i1 0
}
Transformation doesn't verify!

ERROR: Target is more poisonous than source

Example:
i32 noundef %x = #x00000000 (0)

Source:
i1 %cmp1 = #x0 (0)
i32 %ctpop1 = #x00000000 (0)
i32 %#range_0_%ctpop1 = poison
i1 %cmp2 = poison
i1 %cond = #x0 (0)
  >> Jump to %if.else
i32 %ctpop2 = #x00000000 (0)
i32 %#range_1_%ctpop2 = #x00000000 (0)
i1 %res = #x0 (0)

Target:
i1 %cmp1 = #x0 (0)
i32 %ctpop1 = #x00000000 (0)
i32 %#range_0_%ctpop1 = poison
i1 %cmp2 = poison
i1 %cond = #x0 (0)
  >> Jump to %if.else
i1 %res = poison
Source value: #x0 (0)
Target value: poison

Reported by @pranavk. See #100899 (comment).

@dtcxzyw dtcxzyw self-assigned this Oct 29, 2024
@EugeneZelenko EugeneZelenko added llvm:GVN GVN and NewGVN stages (Global value numbering) and removed llvm:transforms labels Oct 29, 2024
@dtcxzyw dtcxzyw closed this as completed in f16bff1 Nov 1, 2024
smallp-o-p pushed a commit to smallp-o-p/llvm-project that referenced this issue Nov 3, 2024
…lvm#114011)

This patch intersects attributes of two calls to avoid introducing UB.
It also skips incompatible call pairs in GVN/NewGVN. However, I cannot
provide negative tests for these changes.

Fixes llvm#113997.
smallp-o-p pushed a commit to smallp-o-p/llvm-project that referenced this issue Nov 3, 2024
…lvm#114011)

This patch intersects attributes of two calls to avoid introducing UB.
It also skips incompatible call pairs in GVN/NewGVN. However, I cannot
provide negative tests for these changes.

Fixes llvm#113997.
NoumanAmir657 pushed a commit to NoumanAmir657/llvm-project that referenced this issue Nov 4, 2024
…lvm#114011)

This patch intersects attributes of two calls to avoid introducing UB.
It also skips incompatible call pairs in GVN/NewGVN. However, I cannot
provide negative tests for these changes.

Fixes llvm#113997.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
llvm:GVN GVN and NewGVN stages (Global value numbering) miscompilation
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants