[CodeGenPrepare] vector promotion makes `sdiv` overflow in an unobserved lane
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
### Reproduction
```llvm
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"
define void @trigger(ptr %src, ptr %dst) {
entry:
%v = load <2 x i8>, ptr %src, align 1
%e = extractelement <2 x i8> %v, i32 0
%r = sdiv i8 %e, -1
store i8 %r, ptr %dst, align 1
ret void
}
```
```console
$ alive-tv --disable-undef-input --disable-poison-input -stress-cgp-store-extract --passes='require,function(codegenprepare)' ./repro.ll
...
Transformation doesn't verify!
ERROR: Source is more defined than target
...
```
### Root cause
`CodeGenPrepare::VectorPromoteHelper` pushes a scalar operation below an `extractelement` by widening that operation to the source vector type. For signed division by `-1`, this evaluates lanes that the scalar source never evaluated. If an unobserved lane is `INT_MIN`, the new vector `sdiv` executes `INT_MIN / -1`, which is undefined, even when the selected source lane has a defined result.
godbolt link: https://alive2.llvm.org/ce/z/wSK4WH
Reproduced on e3bde09850d7be0bfdbd9051f09b887b1d607f38.
Contributor guide
Research direction
Start with CodeGenPrepare::VectorPromoteHelper and reproduce the issue using the supplied LLVM IR and alive-tv command. Trace the vector promotion of the extracted sdiv, then verify that the transformation no longer makes an unobserved INT_MIN lane undefined and that the Alive2 check succeeds.
Written by the indexing model from the issue text.
Assessment
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100