possible induction variable bug

[regehr]

Bugzilla Link	2791
Resolution	FIXED
Resolved on	Sep 17, 2008 12:54
Version	unspecified
OS	Linux
CC	@sunfishcode

Extended Description

Seen using r56177 on Ubuntu Hardy on ia32.

The -O3 result is clearly wrong. Notice that g_5 is not assigned to anywhere except in the header of the for loop.

llvm-gcc is valgrind-clean on the -O3 run.

regehr@john-home:/volatile/tmp31$ llvm-gcc -O1 -w small.c -o small
regehr@john-home:/volatile/tmp31$ ./small
2
regehr@john-home:/volatile/tmp31$ llvm-gcc -O3 -w small.c -o small
regehr@john-home:/volatile/tmp31$ ./small
1
regehr@john-home:~/volatile/tmp31$ cat small.c

#include <stdint.h>
#include <limits.h>
#include <stdio.h>

static inline unsigned long int
mod_rhs(const long int rhs)
{
if (rhs == 0) return 1;
return rhs;
}

static inline int
rshift_s_s(int left, int right)
{
if ((left < 0)
|| (right < 0)
|| (right >= sizeof(int)CHAR_BIT)) {
/ Avoid implementation-defined and undefined behavior. */
return left;
}
return left >> right;
}

static inline unsigned int
lshift_u_u(unsigned int left, unsigned int right)
{
if ((right >= sizeof(unsigned int)CHAR_BIT)
|| (left > (UINT_MAX >> right))) {
/ Avoid undefined behavior. */
return left;
}
return left << right;
}

static inline int
lshift_s_s(int left, int right)
{
if ((left < 0)
|| (right < 0)
|| (right >= sizeof(int)CHAR_BIT)
|| (left > (INT_MAX >> right))) {
/ Avoid undefined behavior. */
return left;
}
return left << right;
}

uint32_t g_5;
uint32_t g_234;
uint32_t g_248;
volatile uint32_t g_283;
uint32_t g_286;
int32_t func_12 (uint32_t p_13, uint32_t p_14, uint32_t p_15);
int32_t
func_12 (uint32_t p_13, uint32_t p_14, uint32_t p_15)
{
return 1;
}

int32_t func_50 (uint32_t p_51, int8_t p_53);
int32_t func_50 (uint32_t p_51, int8_t p_53)
{
return 1;
}

int32_t func_55 (uint16_t p_57);
int32_t func_55 (uint16_t p_57)
{
if (1 % mod_rhs (1))
return 1;
return 1;
}

int32_t func_95 (int8_t p_96);
int32_t func_95 (int8_t p_96)
{
return 1;
}

int32_t func_103 (uint32_t p_105);
int32_t func_103 (uint32_t p_105)
{
return 1;
}

void func_8 (void);
void func_8 (void)
{
int32_t p_9 = 1;
uint32_t l_11 = 0;
uint32_t l_281;

if (g_5) return;

uint32_t l_280;
uint32_t l_282 = 1;
if (((rshift_s_s
(g_5
&& 1, func_12 (1 & (l_280 * g_234), func_50 ((1 | l_11), l_281),
(l_11 > (g_283 && p_9))))) + (lshift_u_u (g_5,
0)) ==
1) + (func_55 (func_103 (&l_282) & g_248 +
(lshift_s_s ((lshift_u_u (g_286, 1)), func_95 (p_9)))) >
((lshift_u_u (p_9, 1)) % mod_rhs (1))))
{
}
else
for (1; p_9; p_9--)
{
}
}

void func_1 (void);
void func_1 (void)
{
for (g_5 = 0; g_5 <= 1; g_5++) {
func_8 ();
}
}

int
main (void)
{
func_1 ();
printf ("%d\n", g_5);
return 0;
}

[efriedma-quic]

Testcase
To reproduce: compare output of "lli reduced.bc" and "opt -loop-index-split reduced.bc | lli".

[regehr]

Simpler test case that looks to exercise the same bug.

regehr@john-home:/volatile/tmp33$ llvm-gcc -O1 small.c -o small
regehr@john-home:/volatile/tmp33$ ./small
0
regehr@john-home:/volatile/tmp33$ llvm-gcc -O2 small.c -o small
regehr@john-home:/volatile/tmp33$ ./small
1
regehr@john-home:~/volatile/tmp33$ cat small.c
#include <stdint.h>
#include <stdio.h>

uint32_t g_62;

int32_t func_6 (void);
int32_t func_6 (void)
{
return 1;
}

int32_t func_124 (void);
int32_t func_124 (void)
{
for (g_62 = 1; 0; g_62 += 1)
{
}
return 1;
}

void func_57 (int32_t p_58);
void func_57 (int32_t p_58)
{
for (p_58 = 0; p_58; p_58 += 0)
{
if (0 - func_6 () > p_58)
return;
func_124 ();
for (p_58 = -26; 0; p_58++)
{
}
}
}

int main (void)
{
func_57 (1);
printf ("%d\n", g_62);
return 0;
}

[regehr]

Below-- simplest testcase yet for this bug, looks like a real smoking gun to me...

regehr@john-home:/volatile/tmp38$ llvm-gcc -O0 small.c -o small
regehr@john-home:/volatile/tmp38$ ./small
10
regehr@john-home:/volatile/tmp38$ llvm-gcc -O1 small.c -o small
regehr@john-home:/volatile/tmp38$ ./small
1

#include <stdint.h>
#include <stdio.h>

uint32_t g_40;
uint32_t g_192;

void func_29 (void);
void func_29 (void)
{
uint32_t i;
for (i = 0; i < 10; i++)
{
g_192 = i || g_40;
}
printf ("%d\n", i);
}

int main (void)
{
func_29 ();
return 0;
}

[sunfishcode]

This looks related to LoopIndexSplit.
This test fails with a full -std-compile-opts and passes when run with everything
except -loop-index-split.

[llvmbot]

Fixed.
Committed revision 56284.