Pointer comparison failure with opt -O2

[llvmbot]

Bugzilla Link	11382
Resolution	INVALID
Resolved on	Nov 16, 2011 02:22
Version	trunk
OS	Linux
Attachments	C file to reproduce problem, ll produced by clang at -O0, ll file after opt -O2 ptrcomp.ll -S -o ptrcomp.opt.ll
Reporter	LLVM Bugzilla Contributor
CC	@efriedma-quic,@sunfishcode

Extended Description

Here is a simple C example:

#include <stdio.h>

static int rslts[31] ;

int main(int argc, char *argv[])
{
char *pp = "abcdef", *qq = pp + 5;

if (qq < pp - 1)     rslts[8] = 4;
printf ("result[8] = %d\n", rslts[8]) ;
return 0 ;

}

When compiled using clang at -O0 or -O2 we got different results.
It seems that at -O2 LLVM opt assumes that pointer comparison is always true and thus result printed output is:

result[8]=4

Where as at -O0 printed output is:

result[8]=0

Correct behavior is at -O0. looking at LLVM assembly generated at -O0 on which we invoke 'opt -O2' we clearly see that final LLVM is not correct.

I used LLVM 2.9, trunk and 3.0rc3 and they all exhibits same behavior.

[sunfishcode]

The testcase invokes undefined behavior when it computes pp - 1 (6.5.6p8).

[llvmbot]

Hi Dan, to which document do you refer ?

[sunfishcode]

The C standard. http://open-std.org/JTC1/SC22/WG14/www/standards.html

[llvmbot]

Sorry, reading C standard I don't understand your statement about undefined behavior could you please elaborate before marking problem as resolved ?
Here is what I read in the document:

When an expression that has integer type is added to or subtracted from a pointer, the
result has the type of the pointer operand. If the pointer operand points to an element of
an array object, and the array is large enough, the result points to an element offset from
the original element such that the difference of the subscripts of the resulting and original
array elements equals the integer expression. In other words, if the expression P points to
the i-th element of an array object, the expressions (P)+N (equivalently, N+(P)) and
(P)-N (where N has the value n) point to, respectively, the i+n-th and i−n-th elements of
the array object, provided they exist. Moreover, if the expression P points to the last
element of an array object, the expression (P)+1 points one past the last element of the
array object, and if the expression Q points one past the last element of an array object,
the expression (Q)-1 points to the last element of the array object. If both the pointer
operand and the result point to elements of the same array object, or one past the last
element of the array object, the evaluation shall not produce an overflow; otherwise, the
behavior is undefined. If the result points one past the last element of the array object, it
shall not be used as the operand of a unary * operator that is evaluated.

[efriedma-quic]

"If both the pointer operand and the result point to elements of the same array object, or one past the last element of the array object, the evaluation shall not produce an overflow; otherwise, the behavior is undefined". You hit the undefined behavior by subtracting 1 from pp.