llvm / llvm/llvm-project

[SCEV] Long-standing miscompile due to absence of per-use flags in SCEV expressions

Open
#175,729 13 comments 0 reactions 0 assignees View on GitHub
llvm:SCEV miscompilation
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

llvm commit: 4ef3f8dbc1c
Reproduce with:
```opt -passes=indvars bbi-113977.ll -S -o -```
Result:
```llvm
define i16 @main() {
entry:
br label %vector.body

vector.body: ; preds = %vector.body, %entry
br i1 false, label %if.then, label %vector.body

if.then: ; preds = %vector.body
ret i16 0
}
```
Notice the infinite ```vector.body``` loop.

If we remove the "nuw" from the add
```%vec.next = add nuw i32 %vec, 4```
we instead get the correct result
```llvm
define i16 @main() {
entry:
br label %vector.body

vector.body: ; preds = %vector.body, %entry
br i1 true, label %if.then, label %vector.body

if.then: ; preds = %vector.body
ret i16 0
}
```
But the result of the add is only used in a phi, which in turn is only used in the add, so it shouldn't matter.

This seems to be very old.

https://godbolt.org/z/Tbqc6Mv8a

[bbi-113977.ll.gz](https://github.com/user-attachments/files/24585344/bbi-113977.ll.gz)

Contributor guide

Open the contributing guide

Research direction

Start by running opt -passes=indvars on bbi-113977.ll and compare the output with and without the nuw flag on %vec.next. Read the SCEV handling involved in indvars and per-use flags. Done means the reproducer no longer produces the incorrect infinite-loop condition while preserving the correct result.

Written by the indexing model from the issue text.

Assessment

Domain
compilers
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.