llvm / llvm/llvm-project

Miscompile at -O1 and above after change to use poison instead of undef in some vector combines

Closed
#222,857 0 comments 0 reactions 1 assignee Claimed by @bjope View on GitHub
llvm:SelectionDAG miscompilation regression:23
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

llvm commit: c1b661fde12

Reproduce with:

```
llc -O1 bbi-120753.ll -o a.s && clang a.s -o a && ./a ; echo $?
```

Result:

```
1
```

-O2 and -O3 behave as -O1.
With -O0 we get "0".

"test_and" should return 0x20000 (131072) which we check in main, and then we return 1 on error and 0 when we get the expected value.

This starts happening with 544c300f43

```
DAG: Use poison instead of undef in some vector combines (#177612)
```

It seems to be this change in DAGCombiner::visitCONCAT_VECTORS in 544c300f43 that causes the miscompile:

```
for (const SDValue &Op : N->ops()) {
EVT OpVT = Op.getValueType();
unsigned NumElts = OpVT.getVectorNumElements();

if (Op.isUndef())
- Opnds.append(NumElts, DAG.getUNDEF(MinVT));
+ Opnds.append(NumElts, DAG.getPOISON(MinVT));

if (ISD::BUILD_VECTOR == Op.getOpcode()) {
```

With that change the "test_and" function becomes

```asm
test_and: # @test_and
.cfi_startproc
# %bb.0: # %entry
movb $1, -32(%rsp)
movq $-1, -40(%rsp)
movb $1, -16(%rsp)
movq $-1, -24(%rsp)
movl $2, %eax
retq
```

Without that change we instead get the expected

```asm
test_and: # @test_and
.cfi_startproc
# %bb.0: # %entry
movb $1, -32(%rsp)
movq $-1, -40(%rsp)
movb $1, -16(%rsp)
movq $-1, -24(%rsp)
movl $131072, %eax # imm = 0x20000
retq
```

[bbi-120753.ll.gz](https://github.com/user-attachments/files/32089628/bbi-120753.ll.gz)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.