llvm / llvm/llvm-project

[MemCpyOpt] Slot optimization miscompilation

Open
#163,455 4 comments 0 reactions 0 assignees View on GitHub
llvm:optimizations miscompilation
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Running `opt --passes=memcpyopt` on

```llvm
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @f(ptr dead_on_unwind noalias noundef writable dereferenceable(80) %a) {
start:
%b = alloca [80 x i8]
call void @g(ptr %b)
call void @llvm.memcpy.p0.p0.i64(ptr %a, ptr %b, i64 80, i1 false)
ret void
}

declare void @g(ptr)
```

results in

```llvm
define void @f(ptr dead_on_unwind noalias noundef writable dereferenceable(80) %a) {
start:
%b = alloca [80 x i8], align 1
call void @g(ptr %a)
ret void
}
```

In the resulting program, pointer passed to `g` can be incorrectly observed to equal `%a`, even though it was impossible originally.

Contributor guide

Open the contributing guide

Research direction

Start by running the LLVM IR reproducer with `opt --passes=memcpyopt` and compare the input and resulting IR. Trace the MemCpyOpt handling of the alloca, the call to `g`, and the memcpy; done means the optimization no longer permits `g` to observe `%a` when the original program passed `%b`.

Written by the indexing model from the issue text.

Assessment

Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.