llvm / llvm/llvm-project

x86 Miscompiled floating-point return value by removing the final %xmm0 reload

Open
#214,068 1 comment 0 reactions 0 assignees View on GitHub
backend:X86 miscompilation
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

Clang 21 miscompiles the attached program with `-Og -mavx2`. Godbolt reproducer: https://godbolt.org/z/b8MboxhTe (fails also on newer versions). `-O0` code is correct.

Expected output:

```text
expected: 0.3125
actual: 0.3125
OK
```

Actual output:

```text
expected: 0.3125
actual: 1
MISCOMPILE
```

Reproducer appended below, tested as follows:

```bash
llc -O2 -mattr=+avx2 bugpoint-input.ll -filetype=obj -o bad.o
clang++ bad.o -o bad
./bad
```

Using `llc -O0` instead produces the correct result.

Backend pass bisection identifies the transition as:
```text
-opt-bisect-limit=91: correct, returns 0.3125
-opt-bisect-limit=92: incorrect, returns 1.0

Pass 92: Remove Loads Into Fake Uses
Function: Accumulator::calculateErrorAndJacobian
```

Reproducer:

```llvm
; ModuleID = '/tmp/llvm21_bugpoint_rerun/input.bc'
source_filename = "reduced.cpp"
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-redhat-linux-gnu"

%"struct.(anonymous namespace)::FixedCost" = type { %"struct.(anonymous namespace)::Cost", %"struct.(anonymous namespace)::Vector2" }
%"struct.(anonymous namespace)::Cost" = type { ptr }
%"struct.(anonymous namespace)::Vector2" = type { [2 x double] }
%"struct.(anonymous namespace)::IdentityLoss" = type { %"struct.(anonymous namespace)::Loss" }
%"struct.(anonymous namespace)::Loss" = type { ptr }
%"struct.(anonymous namespace)::Accumulator" = type { %"struct.(anonymous namespace)::Matrix2" }
%"struct.(anonymous namespace)::Matrix2" = type { [4 x double] }

@.str = private unnamed_addr constant [33 x i8] c"expected: %.17g\0Aactual: %.17g\0A\00", align 1
@.str.1 = private unnamed_addr constant [12 x i8] c"MISCOMPILE\0A\00", align 1
@.str.2 = private unnamed_addr constant [4 x i8] c"OK\0A\00", align 1
@_ZTVN12_GLOBAL__N_19FixedCostE = internal unnamed_addr constant { [3 x ptr] } { [3 x ptr] [ptr null, ptr @_ZTIN12_GLOBAL__N_19FixedCostE, ptr @_ZNK12_GLOBAL__N_19FixedCost15computeResidualEv] }, align 8
@_ZTIN12_GLOBAL__N_19FixedCostE = internal constant { ptr, ptr, ptr } { ptr getelementptr inbounds (ptr, ptr @_ZTVN10__cxxabiv120__si_class_type_infoE, i64 2), ptr @_ZTSN12_GLOBAL__N_19FixedCostE, ptr @_ZTIN12_GLOBAL__N_14CostE }, align 8
@_ZTVN10__cxxabiv120__si_class_type_infoE = external dso_local global [0 x ptr]
@_ZTSN12_GLOBAL__N_19FixedCostE = internal constant [27 x i8] c"N12_GLOBAL__N_19FixedCostE\00", align 1
@_ZTIN12_GLOBAL__N_14CostE = internal constant { ptr, ptr } { ptr getelementptr inbounds (ptr, ptr @_ZTVN10__cxxabiv117__class_type_infoE, i64 2), ptr @_ZTSN12_GLOBAL__N_14CostE }, align 8
@_ZTVN10__cxxabiv117__class_type_infoE = external dso_local global [0 x ptr]
@_ZTSN12_GLOBAL__N_14CostE = internal constant [22 x i8] c"N12_GLOBAL__N_14CostE\00", align 1
@_ZTVN12_GLOBAL__N_112IdentityLossE = internal unnamed_addr constant { [3 x ptr] } { [3 x ptr] [ptr null, ptr @_ZTIN12_GLOBAL__N_112IdentityLossE, ptr @_ZNK12_GLOBAL__N_112IdentityLoss13scalingFactorEd] }, align 8
@_ZTIN12_GLOBAL__N_112IdentityLossE = internal constant { ptr, ptr, ptr } { ptr getelementptr inbounds (ptr, ptr @_ZTVN10__cxxabiv120__si_class_type_infoE, i64 2), ptr @_ZTSN12_GLOBAL__N_112IdentityLossE, ptr @_ZTIN12_GLOBAL__N_14LossE }, align 8
@_ZTSN12_GLOBAL__N_112IdentityLossE = internal constant [31 x i8] c"N12_GLOBAL__N_112IdentityLossE\00", align 1
@_ZTIN12_GLOBAL__N_14LossE = internal constant { ptr, ptr } { ptr getelementptr inbounds (ptr, ptr @_ZTVN10__cxxabiv117__class_type_infoE, i64 2), ptr @_ZTSN12_GLOBAL__N_14LossE }, align 8
@_ZTSN12_GLOBAL__N_14LossE = internal constant [22 x i8] c"N12_GLOBAL__N_14LossE\00", align 1

; Function Attrs: mustprogress norecurse uwtable
define dso_local noundef range(i32 0, 2) i32 @main() local_unnamed_addr #0 {
%1 = alloca %"struct.(anonymous namespace)::FixedCost", align 8
%2 = alloca %"struct.(anonymous namespace)::IdentityLoss", align 8
%3 = alloca %"struct.(anonymous namespace)::Accumulator", align 8
call void @llvm.lifetime.start.p0(i64 24, ptr nonnull %1) #10
store ptr getelementptr inbounds nuw inrange(-16, 8) (i8, ptr @_ZTVN12_GLOBAL__N_19FixedCostE, i64 16), ptr %1, align 8, !tbaa !3
%4 = getelementptr inbounds nuw i8, ptr %1, i64 8
store double 5.000000e-01, ptr %4, align 8
%5 = getelementptr inbounds nuw i8, ptr %1, i64 16
store double 2.500000e-01, ptr %5, align 8, !tbaa !6
%6 = tail call noalias noundef nonnull dereferenceable(8) ptr @_Znwm(i64 noundef 8) #11
store ptr %1, ptr %6, align 8, !tbaa !8
call void @llvm.lifetime.start.p0(i64 8, ptr nonnull %2) #10
store ptr getelementptr inbounds nuw inrange(-16, 8) (i8, ptr @_ZTVN12_GLOBAL__N_112IdentityLossE, i64 16), ptr %2, align 8, !tbaa !3
call void @llvm.lifetime.start.p0(i64 32, ptr nonnull %3) #10
%7 = call fastcc noundef double @_ZN12_GLOBAL__N_111Accumulator25calculateErrorAndJacobianENS_6vectorEPNS_4LossE(ptr noundef nonnull align 8 dereferenceable(32) %3, i32 1, ptr nonnull %6, ptr noundef %2)
call void (...) @printf(ptr noundef nonnull @.str, double noundef 3.125000e-01, double noundef %7)
%8 = fcmp une double %7, 3.125000e-01
%9 = select i1 %8, ptr @.str.1, ptr @.str.2
%10 = zext i1 %8 to i32
call void (...) @printf(ptr noundef nonnull %9)
notail call void (...) @llvm.fake.use(double %7) #10
call void @llvm.lifetime.end.p0(i64 32, ptr nonnull %3) #10
%11 = load ptr, ptr %2, align 8
call void (...) @llvm.fake.use(ptr %11)
call void @llvm.lifetime.end.p0(i64 8, ptr nonnull %2) #10
call void (...) @llvm.fake.use(i32 1)
call void (...) @llvm.fake.use(ptr nonnull %6)
call void @llvm.lifetime.end.p0(i64 24, ptr nonnull %1) #10
ret i32 %10
}

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.start.p0(i64 immarg, ptr captures(none)) #1

; Function Attrs: mustprogress noinline norecurse uwtable
define internal fastcc noundef double @_ZN12_GLOBAL__N_111Accumulator25calculateErrorAndJacobianENS_6vectorEPNS_4LossE(ptr noundef nonnull align 8 dereferenceable(32) initializes((0, 32)) %0, i32 %1, ptr %2, ptr noundef nonnull %3) unnamed_addr #2 align 2 {
tail call void @llvm.memset.p0.i64(ptr noundef nonnull align 8 dereferenceable(32) %0, i8 0, i64 32, i1 false)
%5 = sext i32 %1 to i64
%6 = shl nsw i64 %5, 3
%7 = getelementptr inbounds i8, ptr %2, i64 %6
%8 = icmp eq i32 %1, 0
br i1 %8, label %9, label %11

9: ; preds = %11, %4
%10 = phi double [ 0.000000e+00, %4 ], [ %22, %11 ]
notail call void (...) @llvm.fake.use(double %10) #10
notail call void (...) @llvm.fake.use(ptr nonnull %3) #10
tail call void (...) @llvm.fake.use(i32 %1)
tail call void (...) @llvm.fake.use(ptr %2)
notail call void (...) @llvm.fake.use(ptr nonnull %0) #10
ret double %10

11: ; preds = %4, %11
%12 = phi double [ %22, %11 ], [ 0.000000e+00, %4 ]
%13 = phi ptr [ %26, %11 ], [ %2, %4 ]
%14 = load ptr, ptr %13, align 8, !tbaa !8
%15 = load ptr, ptr %14, align 8, !tbaa !3
%16 = load ptr, ptr %15, align 8
%17 = tail call { double, double } %16(ptr noundef nonnull align 8 dereferenceable(8) %14)
%18 = extractvalue { double, double } %17, 0
%19 = extractvalue { double, double } %17, 1
%20 = fmul double %19, %19
%21 = tail call noundef double @llvm.fmuladd.f64(double %18, double %18, double %20)
%22 = fadd double %12, %21
%23 = load ptr, ptr %3, align 8, !tbaa !3
%24 = load ptr, ptr %23, align 8
%25 = tail call noundef double %24(ptr noundef nonnull align 8 dereferenceable(8) %3, double noundef %21)
notail call void (...) @llvm.fake.use(double %21) #10
tail call void (...) @llvm.fake.use(double %18)
tail call void (...) @llvm.fake.use(double %19)
notail call void (...) @llvm.fake.use(ptr nonnull %14) #10
%26 = getelementptr inbounds nuw i8, ptr %13, i64 8
%27 = icmp eq ptr %26, %7
br i1 %27, label %9, label %11, !llvm.loop !11
}

declare dso_local void @printf(...) local_unnamed_addr #3

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(inaccessiblemem: readwrite)
declare void @llvm.fake.use(...) #4

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(argmem: readwrite)
declare void @llvm.lifetime.end.p0(i64 immarg, ptr captures(none)) #1

; Function Attrs: mustprogress nofree norecurse nosync nounwind willreturn memory(argmem: read, inaccessiblemem: readwrite) uwtable
define internal { double, double } @_ZNK12_GLOBAL__N_19FixedCost15computeResidualEv(ptr noundef nonnull align 8 dereferenceable(24) %0) unnamed_addr #5 align 2 {
%2 = getelementptr inbounds nuw i8, ptr %0, i64 8
%3 = load double, ptr %2, align 8
%4 = getelementptr inbounds nuw i8, ptr %0, i64 16
%5 = load double, ptr %4, align 8, !tbaa !6
notail call void (...) @llvm.fake.use(ptr nonnull %0) #10
%6 = insertvalue { double, double } poison, double %3, 0
%7 = insertvalue { double, double } %6, double %5, 1
ret { double, double } %7
}

; Function Attrs: nobuiltin allocsize(0)
declare dso_local noundef nonnull ptr @_Znwm(i64 noundef) local_unnamed_addr #6

; Function Attrs: mustprogress nofree norecurse nosync nounwind willreturn memory(inaccessiblemem: readwrite) uwtable
define internal noundef double @_ZNK12_GLOBAL__N_112IdentityLoss13scalingFactorEd(ptr noundef nonnull align 8 dereferenceable(8) %0, double noundef %1) unnamed_addr #7 align 2 {
notail call void (...) @llvm.fake.use(double %1) #10
notail call void (...) @llvm.fake.use(ptr nonnull %0) #10
ret double 1.000000e+00
}

; Function Attrs: nocallback nofree nosync nounwind speculatable willreturn memory(none)
declare double @llvm.fmuladd.f64(double, double, double) #8

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: write)
declare void @llvm.memset.p0.i64(ptr writeonly captures(none), i8, i64, i1 immarg) #9

attributes #0 = { mustprogress norecurse uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+avx,+avx2,+cmov,+crc32,+cx8,+fxsr,+mmx,+popcnt,+sse,+sse2,+sse3,+sse4.1,+sse4.2,+ssse3,+x87,+xsave" "tune-cpu"="generic" }
attributes #1 = { nocallback nofree nosync nounwind willreturn memory(argmem: readwrite) }
attributes #2 = { mustprogress noinline norecurse uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+avx,+avx2,+cmov,+crc32,+cx8,+fxsr,+mmx,+popcnt,+sse,+sse2,+sse3,+sse4.1,+sse4.2,+ssse3,+x87,+xsave" "tune-cpu"="generic" }
attributes #3 = { "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+avx,+avx2,+cmov,+crc32,+cx8,+fxsr,+mmx,+popcnt,+sse,+sse2,+sse3,+sse4.1,+sse4.2,+ssse3,+x87,+xsave" "tune-cpu"="generic" }
attributes #4 = { nocallback nofree nosync nounwind willreturn memory(inaccessiblemem: readwrite) }
attributes #5 = { mustprogress nofree norecurse nosync nounwind willreturn memory(argmem: read, inaccessiblemem: readwrite) uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+avx,+avx2,+cmov,+crc32,+cx8,+fxsr,+mmx,+popcnt,+sse,+sse2,+sse3,+sse4.1,+sse4.2,+ssse3,+x87,+xsave" "tune-cpu"="generic" }
attributes #6 = { nobuiltin allocsize(0) "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+avx,+avx2,+cmov,+crc32,+cx8,+fxsr,+mmx,+popcnt,+sse,+sse2,+sse3,+sse4.1,+sse4.2,+ssse3,+x87,+xsave" "tune-cpu"="generic" }
attributes #7 = { mustprogress nofree norecurse nosync nounwind willreturn memory(inaccessiblemem: readwrite) uwtable "min-legal-vector-width"="0" "no-trapping-math"="true" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+avx,+avx2,+cmov,+crc32,+cx8,+fxsr,+mmx,+popcnt,+sse,+sse2,+sse3,+sse4.1,+sse4.2,+ssse3,+x87,+xsave" "tune-cpu"="generic" }
attributes #8 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }
attributes #9 = { nocallback nofree nounwind willreturn memory(argmem: write) }
attributes #10 = { nounwind }
attributes #11 = { builtin allocsize(0) }

!llvm.module.flags = !{!0, !1}
!llvm.ident = !{!2}

!0 = !{i32 1, !"wchar_size", i32 4}
!1 = !{i32 7, !"uwtable", i32 2}
!2 = !{!"clang version 21.1.0 (ssh://git.vip.facebook.com/data/gitrepos/osmeta/external/llvm-project f15d5070b840d95f662317ba1628f66b35e403d0)"}
!3 = !{!4, !4, i64 0}
!4 = !{!"vtable pointer", !5, i64 0}
!5 = !{!"Simple C++ TBAA"}
!6 = !{!7, !7, i64 0}
!7 = !{!"omnipotent char", !5, i64 0}
!8 = !{!9, !9, i64 0}
!9 = !{!"p1 _ZTSN12_GLOBAL__N_14CostE", !10, i64 0}
!10 = !{!"any pointer", !7, i64 0}
!11 = distinct !{!11, !12}
!12 = !{!"llvm.loop.unroll.disable"}
```

Contributor guide

Open the contributing guide

Research direction

Start by running the llc and clang++ commands against the attached bugpoint-input.ll reproducer with -O2 and +avx2, then compare the result with -O0. Inspect the Accumulator::calculateErrorAndJacobian function and the Remove Loads Into Fake Uses pass at bisect limit 92; done means the optimized program returns 0.3125 instead of 1.0.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.