llvm / llvm/llvm-project

[CodeGenPrepare] vector promotion makes `sdiv` overflow in an unobserved lane

Open
#218,570 1 comment 0 reactions 0 assignees View on GitHub
confirmed llvm:codegen miscompilation
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

### Reproduction
```llvm
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define void @trigger(ptr %src, ptr %dst) {
entry:
%v = load <2 x i8>, ptr %src, align 1
%e = extractelement <2 x i8> %v, i32 0
%r = sdiv i8 %e, -1
store i8 %r, ptr %dst, align 1
ret void
}
```

```console
$ alive-tv --disable-undef-input --disable-poison-input -stress-cgp-store-extract --passes='require,function(codegenprepare)' ./repro.ll
...
Transformation doesn't verify!
ERROR: Source is more defined than target
...
```

### Root cause
`CodeGenPrepare::VectorPromoteHelper` pushes a scalar operation below an `extractelement` by widening that operation to the source vector type. For signed division by `-1`, this evaluates lanes that the scalar source never evaluated. If an unobserved lane is `INT_MIN`, the new vector `sdiv` executes `INT_MIN / -1`, which is undefined, even when the selected source lane has a defined result.

godbolt link: https://alive2.llvm.org/ce/z/wSK4WH
Reproduced on e3bde09850d7be0bfdbd9051f09b887b1d607f38.

Contributor guide

Open the contributing guide

Research direction

Start with CodeGenPrepare::VectorPromoteHelper and reproduce the issue using the supplied LLVM IR and alive-tv command. Trace the vector promotion of the extracted sdiv, then verify that the transformation no longer makes an unobserved INT_MIN lane undefined and that the Alive2 check succeeds.

Written by the indexing model from the issue text.

Assessment

Domain
compilers
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.