[RISC-V] Miscompile at -O2

[patrick-rivos]

Testcase:

int printf(const char *, ...);
int a, c = 1;
int b[2];
int main() {
d:
  for (; a < 8; a += 1) {
    int *e = &c;
    if (&b[1] == e)
      *e = 0;
  }
f:
  if (0) {
    goto f;
    goto d;
  }
  printf("%d\n", c);
}

The condition if (&b[1] == e) should never be true.

Commands:

> /scratch/tc-testing/tc-mar-4-llvm/build/bin/clang -march=rv64gcv -O2 red.c -o red.out -fno-strict-aliasing
> /scratch/tc-testing/tc-mar-4-llvm/build/bin/qemu-riscv64 red.out
0
> /scratch/tc-testing/tc-mar-4-llvm/build/bin/clang red.c -o red.out -fno-strict-aliasing
> /scratch/tc-testing/tc-mar-4-llvm/build/bin/qemu-riscv64 red.out
1

Godbolt: https://godbolt.org/z/eEfqjf5rr

-opt-bisect-limit points at InstCombinePass

Discovered/tested using version 57592e9 (not bisected)

Found using fuzzer

[dtcxzyw]

Confirmed. But it looks like a RISC-V backend bug.
cc @wangpc-pp @topperc @lukel97

[llvmbot]

@llvm/issue-subscribers-backend-risc-v

Author: Patrick O'Neill (patrick-rivos)

Testcase: ```c int printf(const char *, ...); int a, c = 1; int b[2]; int main() { d: for (; a < 8; a += 1) { int *e = &c; if (&b[1] == e) *e = 0; } f: if (0) { goto f; goto d; } printf("%d\n", c); } ``` The condition `if (&b[1] == e)` should never be true.

Commands:

> /scratch/tc-testing/tc-mar-4-llvm/build/bin/clang -march=rv64gcv -O2 red.c -o red.out -fno-strict-aliasing
> /scratch/tc-testing/tc-mar-4-llvm/build/bin/qemu-riscv64 red.out
0
> /scratch/tc-testing/tc-mar-4-llvm/build/bin/clang red.c -o red.out -fno-strict-aliasing
> /scratch/tc-testing/tc-mar-4-llvm/build/bin/qemu-riscv64 red.out
1

Godbolt: https://godbolt.org/z/eEfqjf5rr

-opt-bisect-limit points at InstCombinePass

Discovered/tested using version 57592e9 (not bisected)

Found using fuzzer

[topperc]

Confirmed. But it looks like a RISC-V backend bug. cc @wangpc-pp @topperc @lukel97

The bug is in InstCombine

This transforms assumes the mask is a non-zero splat. We only know its a splat and not provably all 0s. The mask is a constexpr that includes the address of the global variable. We can't resolve the constant expression to an exact value.

    // scatter(splat(value), splat(ptr), non-zero-mask) -> store value, ptr
    if (auto *SplatValue = getSplatValue(II.getArgOperand(0))) {
      Align Alignment = cast<ConstantInt>(II.getArgOperand(2))->getAlignValue(); 
      StoreInst *S =
          new StoreInst(SplatValue, SplatPtr, /*IsVolatile=*/false, Alignment);  
      S->copyMetadata(II);
      return S;
    }

[topperc]

We need to loop through all elements of the mask and check if any of them are a ConstantInt of 1. Not sure if there's a routine for that already.