1; NOTE: Assertions have been autogenerated by utils/update_test_checks.py 2; RUN: opt -S -indvars -indvars-predicate-loops=0 < %s | FileCheck %s 3 4; Tests in this file are specifically about correctly handling possibly poison 5; producing flags when converting from one IV to another. In particular, there 6; is a risk that the IV we chose to switch to is dynamically dead (i.e. there 7; is no side effect which dependents on the computation thereof). Such an IV 8; can produce poison on one or more iterations without triggering UB. When we 9; add an additional use to such an IV, we need to ensure that our new use does 10; not trigger UB where none existed in the original program. 11 12; Provide legal integer types. 13target datalayout = "n8:16:32:64" 14 15@data = common global [240 x i8] zeroinitializer, align 16 16 17;; In this example, the pointer IV is dynamicaly dead. As such, the fact that 18;; inbounds produces poison *does not* trigger UB in the original loop. As 19;; such, the pointer IV can be poison and adding a new use of the pointer 20;; IV which dependends on that poison computation in a manner which might 21;; trigger UB would be incorrect. 22;; FIXME: This currently shows a miscompile! 23define void @neg_dynamically_dead_inbounds(i1 %always_false) #0 { 24; CHECK-LABEL: @neg_dynamically_dead_inbounds( 25; CHECK-NEXT: entry: 26; CHECK-NEXT: br label [[LOOP:%.*]] 27; CHECK: loop: 28; CHECK-NEXT: [[I_0:%.*]] = phi i8 [ 0, [[ENTRY:%.*]] ], [ [[TMP4:%.*]], [[CONT:%.*]] ] 29; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), [[ENTRY]] ], [ [[TMP3:%.*]], [[CONT]] ] 30; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1 31; CHECK-NEXT: br i1 [[ALWAYS_FALSE:%.*]], label [[NEVER_EXECUTED:%.*]], label [[CONT]] 32; CHECK: never_executed: 33; CHECK-NEXT: store volatile i8 0, i8* [[TMP3]], align 1 34; CHECK-NEXT: br label [[CONT]] 35; CHECK: cont: 36; CHECK-NEXT: [[TMP4]] = add nuw i8 [[I_0]], 1 37; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8 [[TMP4]], -10 38; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]] 39; CHECK: exit: 40; CHECK-NEXT: ret void 41; 42entry: 43 br label %loop 44 45loop: 46 %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %cont ] 47 %p.0 = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), %entry ], [ %tmp3, %cont ] 48 %tmp3 = getelementptr inbounds i8, i8* %p.0, i64 1 49 br i1 %always_false, label %never_executed, label %cont 50 51never_executed: 52 store volatile i8 0, i8* %tmp3 53 br label %cont 54 55cont: 56 %tmp4 = add i8 %i.0, 1 57 %tmp5 = icmp ult i8 %tmp4, -10 58 br i1 %tmp5, label %loop, label %exit 59 60exit: 61 ret void 62} 63 64; Similiar to above, but shows how we currently guard non-constant 65; memory operands in a manner which hides the latent miscompile. 66define void @neg_dynamically_dead_inbounds2(i8* %a, i1 %always_false) #0 { 67; CHECK-LABEL: @neg_dynamically_dead_inbounds2( 68; CHECK-NEXT: entry: 69; CHECK-NEXT: br label [[LOOP:%.*]] 70; CHECK: loop: 71; CHECK-NEXT: [[I_0:%.*]] = phi i8 [ 0, [[ENTRY:%.*]] ], [ [[TMP4:%.*]], [[CONT:%.*]] ] 72; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ [[A:%.*]], [[ENTRY]] ], [ [[TMP3:%.*]], [[CONT]] ] 73; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1 74; CHECK-NEXT: br i1 [[ALWAYS_FALSE:%.*]], label [[NEVER_EXECUTED:%.*]], label [[CONT]] 75; CHECK: never_executed: 76; CHECK-NEXT: store volatile i8 0, i8* [[TMP3]], align 1 77; CHECK-NEXT: br label [[CONT]] 78; CHECK: cont: 79; CHECK-NEXT: [[TMP4]] = add nuw i8 [[I_0]], 1 80; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8 [[TMP4]], -10 81; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]] 82; CHECK: exit: 83; CHECK-NEXT: ret void 84; 85entry: 86 br label %loop 87 88loop: 89 %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %cont ] 90 %p.0 = phi i8* [ %a, %entry ], [ %tmp3, %cont ] 91 %tmp3 = getelementptr inbounds i8, i8* %p.0, i64 1 92 br i1 %always_false, label %never_executed, label %cont 93 94never_executed: 95 store volatile i8 0, i8* %tmp3 96 br label %cont 97 98cont: 99 %tmp4 = add i8 %i.0, 1 100 %tmp5 = icmp ult i8 %tmp4, -10 101 br i1 %tmp5, label %loop, label %exit 102 103exit: 104 ret void 105} 106 107define void @dom_store_preinc() #0 { 108; CHECK-LABEL: @dom_store_preinc( 109; CHECK-NEXT: entry: 110; CHECK-NEXT: br label [[LOOP:%.*]] 111; CHECK: loop: 112; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), [[ENTRY:%.*]] ], [ [[TMP3:%.*]], [[LOOP]] ] 113; CHECK-NEXT: store volatile i8 0, i8* [[P_0]], align 1 114; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1 115; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8* [[P_0]], getelementptr ([240 x i8], [240 x i8]* @data, i64 1, i64 5) 116; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]] 117; CHECK: exit: 118; CHECK-NEXT: ret void 119; 120entry: 121 br label %loop 122 123loop: 124 %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %loop ] 125 %p.0 = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), %entry ], [ %tmp3, %loop ] 126 store volatile i8 0, i8* %p.0 127 %tmp3 = getelementptr inbounds i8, i8* %p.0, i64 1 128 %tmp4 = add i8 %i.0, 1 129 %tmp5 = icmp ult i8 %tmp4, -10 130 br i1 %tmp5, label %loop, label %exit 131 132exit: 133 ret void 134} 135 136define void @dom_store_postinc() #0 { 137; CHECK-LABEL: @dom_store_postinc( 138; CHECK-NEXT: entry: 139; CHECK-NEXT: br label [[LOOP:%.*]] 140; CHECK: loop: 141; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), [[ENTRY:%.*]] ], [ [[TMP3:%.*]], [[LOOP]] ] 142; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1 143; CHECK-NEXT: store volatile i8 0, i8* [[TMP3]], align 1 144; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8* [[TMP3]], getelementptr ([240 x i8], [240 x i8]* @data, i64 1, i64 6) 145; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]] 146; CHECK: exit: 147; CHECK-NEXT: ret void 148; 149entry: 150 br label %loop 151 152loop: 153 %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %loop ] 154 %p.0 = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), %entry ], [ %tmp3, %loop ] 155 %tmp3 = getelementptr inbounds i8, i8* %p.0, i64 1 156 store volatile i8 0, i8* %tmp3 157 %tmp4 = add i8 %i.0, 1 158 %tmp5 = icmp ult i8 %tmp4, -10 159 br i1 %tmp5, label %loop, label %exit 160 161exit: 162 ret void 163} 164 165define i8 @dom_load() #0 { 166; CHECK-LABEL: @dom_load( 167; CHECK-NEXT: entry: 168; CHECK-NEXT: br label [[LOOP:%.*]] 169; CHECK: loop: 170; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), [[ENTRY:%.*]] ], [ [[TMP3:%.*]], [[LOOP]] ] 171; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1 172; CHECK-NEXT: [[V:%.*]] = load i8, i8* [[TMP3]], align 1 173; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8* [[TMP3]], getelementptr ([240 x i8], [240 x i8]* @data, i64 1, i64 6) 174; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]] 175; CHECK: exit: 176; CHECK-NEXT: [[V_LCSSA:%.*]] = phi i8 [ [[V]], [[LOOP]] ] 177; CHECK-NEXT: ret i8 [[V_LCSSA]] 178; 179entry: 180 br label %loop 181 182loop: 183 %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %loop ] 184 %p.0 = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), %entry ], [ %tmp3, %loop ] 185 %tmp3 = getelementptr inbounds i8, i8* %p.0, i64 1 186 %v = load i8, i8* %tmp3 187 %tmp4 = add i8 %i.0, 1 188 %tmp5 = icmp ult i8 %tmp4, -10 189 br i1 %tmp5, label %loop, label %exit 190 191exit: 192 ret i8 %v 193} 194 195define i64 @dom_div(i64 %input) #0 { 196; CHECK-LABEL: @dom_div( 197; CHECK-NEXT: entry: 198; CHECK-NEXT: br label [[LOOP:%.*]] 199; CHECK: loop: 200; CHECK-NEXT: [[I_0:%.*]] = phi i8 [ 0, [[ENTRY:%.*]] ], [ [[TMP4:%.*]], [[LOOP]] ] 201; CHECK-NEXT: [[I_1:%.*]] = phi i64 [ [[INPUT:%.*]], [[ENTRY]] ], [ [[TMP3:%.*]], [[LOOP]] ] 202; CHECK-NEXT: [[TMP3]] = add nuw nsw i64 [[I_1]], 1 203; CHECK-NEXT: [[V:%.*]] = udiv i64 5, [[TMP3]] 204; CHECK-NEXT: [[TMP4]] = add nuw i8 [[I_0]], 1 205; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8 [[TMP4]], -10 206; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]] 207; CHECK: exit: 208; CHECK-NEXT: [[V_LCSSA:%.*]] = phi i64 [ [[V]], [[LOOP]] ] 209; CHECK-NEXT: ret i64 [[V_LCSSA]] 210; 211entry: 212 br label %loop 213 214loop: 215 %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %loop ] 216 %i.1 = phi i64 [ %input, %entry ], [ %tmp3, %loop ] 217 %tmp3 = add nsw nuw i64 %i.1, 1 218 %v = udiv i64 5, %tmp3 219 %tmp4 = add i8 %i.0, 1 220 %tmp5 = icmp ult i8 %tmp4, -10 221 br i1 %tmp5, label %loop, label %exit 222 223exit: 224 ret i64 %v 225} 226 227; For integer IVs, we handle this trigger case by stripping the problematic 228; flags which removes the potential introduction of UB. 229define void @neg_dead_int_iv() #0 { 230; CHECK-LABEL: @neg_dead_int_iv( 231; CHECK-NEXT: entry: 232; CHECK-NEXT: br label [[LOOP:%.*]] 233; CHECK: loop: 234; CHECK-NEXT: [[I_1:%.*]] = phi i64 [ -2, [[ENTRY:%.*]] ], [ [[TMP3:%.*]], [[LOOP]] ] 235; CHECK-NEXT: [[TMP3]] = add nsw i64 [[I_1]], 1 236; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i64 [[TMP3]], 244 237; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]] 238; CHECK: exit: 239; CHECK-NEXT: ret void 240; 241entry: 242 br label %loop 243 244loop: 245 %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %loop ] 246 %i.1 = phi i64 [ -2, %entry ], [ %tmp3, %loop ] 247 %tmp3 = add nsw nuw i64 %i.1, 1 248 %tmp4 = add i8 %i.0, 1 249 %tmp5 = icmp ult i8 %tmp4, -10 250 br i1 %tmp5, label %loop, label %exit 251 252exit: 253 ret void 254} 255 256