Skip to content

Doing certain kinds of IPO over comdat functions is unsound #27148

Description

@sanjoy
Bugzilla Link 26774
Version trunk
OS All
Attachments Reproducer
CC @dexonsmith,@hfinkel,@joker-eph,@rnk,@wjristow

Extended Description

This was discussed on llvm-dev: http://lists.llvm.org/pipermail/llvm-dev/2016-February/095833.html

Description copy-pasted from the thread:

"""
Let's start with an example that shows that we have a problem (direct
copy/paste from the guard intrinsics thread). Say we have:

void foo() available_externally {
  %t0 = load atomic %ptr
  %t1 = load atomic %ptr
  if (%t0 != %t1) print("X");
}
void main() {
  foo();
  print("Y");
}

The possible behaviors of the above program are {print("X"),
print("Y")} or {print("Y")}. But if we run opt then we have

void foo() available_externally readnone nounwind {
  ;; After CSE'ing the two loads and folding the condition
}
void main() {
  foo();
  print("Y");
}

and some generic reordering

void foo() available_externally readnone nounwind {
  ;; After CSE'ing the two loads and folding the condition
}
void main() {
  print("Y");
  foo();  // legal since we're moving a readnone nounwind function that
          // was guaranteed to execute (hence can't have UB)
}

If we do not inline @​foo(), and instead re-link the call site in @​main
to some non-optimized copy (or differently optimized copy) of @​foo,
then it is possible for the program to have the behavior {print("Y");
print ("X")}, which was disallowed in the earlier program.

In other words, opt refined the semantics of @​foo() (i.e. reduced the
set of behaviors it may have) in ways that would make later
optimizations invalid if we de-refine the implementation of @​foo().

The above example is clearly fabricated, but such cases can come up
even if everything is optimized to the same level. E.g. one of the
atomic loads in the unrefined implementation of @​foo() could have been
hidden behind a function call, whose body existed in only one module.
That module would then be able to refine @​foo() to ret void but
other modules won't.
"""

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugzillaIssues migrated from bugzillaipoInterprocedural optimizations

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions