[InstCombine/SimplifyCFG] Miscompilation: switch-to-select folding introduces poison where source has undef
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
`opt -O3` miscompiles a function containing a switch with a phi that has an undef incoming value on the default edge. The optimized output returns poison in a case where the source program is guaranteed to return a non-poison value.
Source:
``` llvm
define i32 @two_undef(i8 %cond, i32 %x) {
switch i8 %cond, label %A [
i8 0, label %B
i8 1, label %C
]
A:
br label %D
B:
br label %D
C:
br label %D
D:
%y = phi i32 [ undef, %A ], [ %x, %B ], [ 0, %C ]
ret i32 %y
}
```
Optimized output:
``` llvm
; opt -O3 -S test.ll -o -
define i32 @two_undef(i8 %cond, i32 %x) local_unnamed_addr #0 {
D:
%cond1 = icmp eq i8 %cond, 1
%spec.select = select i1 %cond1, i32 0, i32 %x
ret i32 %spec.select
}
```
But Alive reports it as a miscompilation since `Target is more poisonous than source`
Alive: https://alive2.llvm.org/ce/z/rKU-uj
Contributor guide
Assessment
This issue has not been assessed yet.