llvm / llvm/llvm-project

[InstCombine/SimplifyCFG] Miscompilation: switch-to-select folding introduces poison where source has undef

Open
#189,526 2 comments 0 reactions 0 assignees View on GitHub
llvm:instcombine miscompilation
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

`opt -O3` miscompiles a function containing a switch with a phi that has an undef incoming value on the default edge. The optimized output returns poison in a case where the source program is guaranteed to return a non-poison value.

Source:
``` llvm
define i32 @two_undef(i8 %cond, i32 %x) {
switch i8 %cond, label %A [
i8 0, label %B
i8 1, label %C
]
A:
br label %D
B:
br label %D
C:
br label %D
D:
%y = phi i32 [ undef, %A ], [ %x, %B ], [ 0, %C ]
ret i32 %y
}
```

Optimized output:
``` llvm
; opt -O3 -S test.ll -o -
define i32 @two_undef(i8 %cond, i32 %x) local_unnamed_addr #0 {
D:
%cond1 = icmp eq i8 %cond, 1
%spec.select = select i1 %cond1, i32 0, i32 %x
ret i32 %spec.select
}
```

But Alive reports it as a miscompilation since `Target is more poisonous than source`

Alive: https://alive2.llvm.org/ce/z/rKU-uj

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.