llvm / llvm/llvm-project

[DebugInfo][CorrelatedValuePropagation] Meta issue: context-dependent rewrites misdescribe source variables outside proven ranges

Open
#218,635 1 comment 0 reactions 0 assignees View on GitHub
debuginfo llvm:transforms metaissue
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

## Description

This meta issue tracks a group of debug-info bugs in `correlated-propagation`. In each case, the pass uses range or control-flow information to replace an operation with a result that is equivalent wherever that result affects program behavior. The executable semantics are preserved, but a `#dbg_value` describing a source variable is also updated to use the replacement result outside the range where the equivalence is valid.

As a result, the debugger can display a concrete value that the source program never assigned to the variable. The individual reports cover signed-to-unsigned rewrites, elimination of operations, narrowing of operations, and saturating-to-normal rewrites. Each report includes a standalone C reproducer, relevant IR excerpts, and LLDB output before and after `correlated-propagation`.

Although these bugs share a common pattern, each tracked issue is associated with a distinct implementation location in [`llvm/lib/Transforms/Scalar/CorrelatedValuePropagation.cpp`](https://github.com/llvm/llvm-project/blob/main/llvm/lib/Transforms/Scalar/CorrelatedValuePropagation.cpp).

## Common Pattern

The affected transformations generally have the following shape:

```llvm
%source.value =
#dbg_value( %source.value, !variable, ...)
%result = select i1 %condition, %source.value, %fallback
```

`correlated-propagation` proves that a cheaper replacement is equivalent to `%source.value` when `%condition` selects it:

```llvm
%replacement =
#dbg_value( %replacement, !variable, ...)
%result = select i1 %condition, %replacement, %fallback
```

This is correct for `%result`, but the replacement is not necessarily equivalent to the source variable when `%condition` is false. The debug record nevertheless describes the variable with `%replacement`, so a debugger can report a wrong value at a source location where the variable remains inspectable.

## Tracked Issues

### Signed-to-unsigned rewrites

- [ ] #218366
- [ ] #218620
- [ ] #218621
- [ ] #218622
- [ ] #218623
- [ ] #218626
- [ ] #218627

### Operation elimination

- [ ] #218630
- [ ] #218631
- [ ] #218632
- [ ] #218633
- [ ] #219940

### Operation narrowing

- [ ] #218406
- [ ] #218628

### Saturating-to-normal rewrites

- [ ] #220562

Contributor guide

Open the contributing guide

Research direction

Start with llvm/lib/Transforms/Scalar/CorrelatedValuePropagation.cpp, then read the linked reports for their standalone C reproducers, IR excerpts, and LLDB output. This meta issue is complete when the tracked correlated-propagation debug-info bugs are individually addressed and debugger values no longer describe source variables with replacements outside their proven ranges.

Written by the indexing model from the issue text.

Assessment

Domain
compilers
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.