wrong code with "opt -loop-rotate -mem2reg -instcombine -loop-unroll -simplifycfg -gvn -loop-reroll" on x86_64-linux-gnu

[zhendongsu]

Bugzilla Link	33085
Version	trunk
OS	All
CC	@choikwa,@efriedma-quic,@zmodem

Extended Description

$ clang -v
clang version 5.0.0 (trunk 303312)
Target: x86_64-unknown-linux-gnu
Thread model: posix
InstalledDir: /usr/local/clang-trunk/bin
Found candidate GCC installation: /usr/lib/gcc/i686-linux-gnu/5
Found candidate GCC installation: /usr/lib/gcc/i686-linux-gnu/5.4.0
Found candidate GCC installation: /usr/lib/gcc/i686-linux-gnu/6
Found candidate GCC installation: /usr/lib/gcc/i686-linux-gnu/6.0.0
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.4
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.4.7
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.6
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.6.4
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.7
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.7.4
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.8
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.8.5
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.9
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/4.9.3
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/5
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/5.4.0
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/6
Found candidate GCC installation: /usr/lib/gcc/x86_64-linux-gnu/6.0.0
Selected GCC installation: /usr/lib/gcc/x86_64-linux-gnu/5.4.0
Candidate multilib: .;@m64
Candidate multilib: 32;@m32
Candidate multilib: x32;@mx32
Selected multilib: .;@m64
$ 
$ clang -O3 -mllvm -disable-llvm-optzns -S -emit-llvm -o small.bc small.c
$ opt -loop-rotate -mem2reg -instcombine -loop-unroll -simplifycfg -gvn -loop-reroll -o small-opt.bc small.bc
$ clang small-opt.bc
$ ./a.out
2
$  
$ clang -O0 small.c
$ ./a.out
1
$ 

int printf (const char *, ...);

int a[1][2], b;

int main ()
{
  int c;
  for (; b < 1; b++)
    for (c = 0; c < 2; c++)
      a[b][c] = 0;
  printf ("%d\n", b);
  return 0; 
}

[zmodem]

This repros on 5.0 and 4.0 but not 3.9, so something changed.

[llvmbot]

If we do not run simplifycfg before gvn, it wont fold for.cond.for.end8_crit_edge into for.end8 and it will generate correct code.

$ opt -loop-rotate -mem2reg -instcombine -loop-unroll -gvn -loop-reroll -o small-opt.bc small.bc
$ clang small-opt.bc
$ ./a.out
1

[llvmbot]

please ignore earlier comment, simplifycfg is doing the right thing here by folding away trivially empty block.

[choikwa]

Why is b uninitialized?

int a[1][2], b;  //

int main ()
{
  int c;
  for (; b < 1; b++)   //

[zmodem]

Since it reproduces also with 4.0, I'm not blocking 5.0 on it.

Why is b uninitialized?

int a[1][2], b; //

int main ()
{
int c;
for (; b < 1; b++) //

Since they're in the global scope, a and b are zero-initialized.

[choikwa]

It looks like LoopRerollPass introduced multiple side-effects (%inc7, @​b) by rerolling.

[Before]

for.body:                                         ; preds = %for.body.preheader, %for.body
  %1 = phi i32 [ %inc7, %for.body ], [ %0, %for.body.preheader ]
  %idxprom = sext i32 %1 to i64
  %arrayidx5 = getelementptr inbounds [1 x [2 x i32]], [1 x [2 x i32]]* @​a, i64 0, i64 %idxprom, i64 0
  store i32 0, i32* %arrayidx5, align 4, !tbaa !​2
  %arrayidx5.1 = getelementptr inbounds [1 x [2 x i32]], [1 x [2 x i32]]* @​a, i64 0, i64 %idxprom, i64 1
  store i32 0, i32* %arrayidx5.1, align 4, !tbaa !​2
  %inc7 = add nsw i32 %1, 1
  store i32 %inc7, i32* @​b, align 4, !tbaa !​2
  %cmp = icmp slt i32 %1, 0
  br i1 %cmp, label %for.body, label %for.end8.loopexit

for.end8.loopexit:                                ; preds = %for.body
  %inc7.lcssa = phi i32 [ %inc7, %for.body ]
  br label %for.end8

[After]

for.body.preheader:
%scevgep4 = getelementptr [1 x [2 x i32]], [1 x [2 x i32]]* @​a, i64 %6=1, i64 0, i64 -1 ; %scevgep4=&a[1][-1]  ??

for.body:                                         ; preds = %for.body, %for.body.preheader
  %indvar = phi i64 [ 0, %for.body.preheader ], [ %indvar.next, %for.body ]
  %7 = phi i32 [ %inc7, %for.body ], [ %0, %for.body.preheader ]
  %scevgep = getelementptr [1 x [2 x i32]], [1 x [2 x i32]]* @​a, i64 %1, i64 0, i64 %indvar
  store i32 0, i32* %scevgep, align 4, !tbaa !​2
  %inc7 = add nsw i32 %7, 1
  store i32 %inc7, i32* @​b, align 4, !tbaa !​2
  %indvar.next = add i64 %indvar, 1
  %exitcond = icmp eq i32* %scevgep, %scevgep4
  br i1 %exitcond, label %for.end8.loopexit, label %for.body

for.end8.loopexit:                                ; preds = %for.body
  %inc7.lcssa = phi i32 [ %inc7, %for.body ]
  br label %for.end8

for.body loops once with %scevgep as new IV and %inc7=2 as a result (This gets printed). Might be able to bisect this on LoopRerollPass.cpp

[choikwa]

breaking commit is

1e10f37 [LoopReroll] Make root-finding more aggressive.

+Eli

[llvmbot]

See also llvm/llvm-bugzilla-archive#34029

It's not really particularly critical as reroll is not part of the default pipeline (so not a showstopper for 5.0)

[nikic]

The LoopReroll pass has been removed by #80972.