llvm / llvm/llvm-project

[LVI] Pointer equivalence implied without considering pointer provenance

Open
#163,144 0 comments 0 reactions 1 assignee Claimed by @antoniofrighetto View on GitHub
llvm:optimizations miscompilation
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Similarly to what has already been fixed in GVN, and currently tracked in SCCP (https://github.com/llvm/llvm-project/issues/159565), when assuming a pointer equality, CVP happens to propagate the known constant (or the pointer itself on the inverse condition), without however considering the pointer provenance, which may be different (or non-existent).

```llvm
define ptr @src(ptr %p) {
entry:
%cond = icmp eq ptr %p, inttoptr (i64 -1 to ptr)
br i1 %cond, label %join, label %bb.1

bb.1:
br label %join

join:
%phi = phi ptr [ %p, %entry ], [ inttoptr (i64 -1 to ptr), %bb.1 ]
ret ptr %phi
}

define ptr @tgt(ptr %p) {
%cond = icmp eq ptr %p, inttoptr (i64 -1 to ptr)
br i1 %cond, label %join, label %bb.1

bb.1:
br label %join

join:
ret ptr inttoptr (i64 -1 to ptr)
}
```

Alive2: https://alive2.llvm.org/ce/z/GkRymb.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.