-instcombine miscompilation of MiBench/consumer-typeset

[llvmbot]

Bugzilla Link	1107
Resolution	FIXED
Resolved on	Nov 07, 2018 00:17
Version	trunk
OS	All
Reporter	LLVM Bugzilla Contributor

Extended Description

I have been trying to solve a little mystery. After resolving various issues
with the test case itsellf (MultisSource/Benchmarks/MiBench/consumer-typeset), I
have determined that there is a codegen bug that this test triggers when
-instcombine is run. Here's how I know this:

1. If you run the Output/consumer-typeset.linked.rbc file through lli in JIT
   mode it works fine.

2. All three backends (llc,jit,cbe) fail in the same way. They all produce the
   same incorrect output. This indicates a misoptimization rather than a code
   gen bug.

3. I used findmisopt to find the first optimization that caused the output to
   differ. It reported this sequence of optimizations as the first set that
   produces a difference in the output:
   -lowersetjmp -funcresolve -raiseallocs -simplifycfg -mem2reg -globalopt
   -globaldce -ipconstprop -deadargelim -instcombine

4. bugpoint produces a non-sensical reduction (two branches and a return)

I'm wondernig if someone can bugpoint this on Darwin because I'm starting to
think that bugpoint doesn't work so well on Linux. In the last month, a Darwin
run of bugpoint was able to reduce a test case that a run on Linux, with the
same inputs, could not reduce. If you can reduce this on Darwin, I'll file a bug
against bugpoint.

[llvmbot]

assigned to @lattner

[lattner]

I reduced it with this command:

bugpoint -llc-safe Output/consumer-typeset.noopt-llvm.bc cat Output/gccas-pass-args -append-
exit-code -Xlinker=-lm -input=/dev/null -output=Output/consumer-typeset.out-nat -timeout=500
--tool-args --args -- -I data/include -D data/data -F data/font -C data/maps -H data/hyph large.lout

Bugpoint gets confused because GCC ICEs on the CBE output (thus the -llc-safe mode).

I gets it down to: opt bugpoint-tooptimize.bc -load-vn -gcse -instcombine -break-crit-edges

I'll investigate.

-Chris

[llvmbot]

I really need to get bugpoint fixed on Linux. This is frustrating that I can't
reduce anything on Linux except on rare occasion. I tried -llc-safe!

[lattner]

Yes, you do :)

[lattner]

It took at lot of scrutinizing, but it looks like instcombine is miscompiling:

define bool %test(i8 %A, i8 %B) {
%a = zext i8 %A to i32 ; [#uses=1]
%b = zext i8 %B to i32 ; [#uses=1]
%c = icmp sgt i32 %a, %b ; [#uses=1]
ret bool %c
}

into:

define bool %test(i8 %A, i8 %B) {
%c = icmp sgt i8 %A, %B ; [#uses=1]
ret bool %c
}

[lattner]

Here is one instcombine bugfix:
http://lists.cs.uiuc.edu/pipermail/llvm-commits/Week-of-Mon-20070108/042635.html

Testcase here: Transforms/InstCombine/2007-01-13-ExtCompareMiscompile.ll

This is not sufficient to fix consumer-typeset though. Rebugpointing.

[lattner]

Here is one instcombine bugfix:
http://lists.cs.uiuc.edu/pipermail/llvm-commits/Week-of-Mon-20070108/042635.html

Testcase here: Transforms/InstCombine/2007-01-13-ExtCompareMiscompile.ll

The next bug isn't in instcombine. Closing this bug to keep things simple.

-Chris

[llvmbot]

Works on Linux too.

[nlewycky]

mentioned in issue llvm/llvm-bugzilla-archive#1940