[RISCV] Miscompile at -O3

[dtcxzyw]

Reduced test case: https://godbolt.org/z/1sxbE8eco

#include <stdint.h>
#include <stdio.h>
int32_t a, f;
uint16_t e = 10;
static uint8_t f1(uint8_t c, uint8_t d) { return d == 0 ? 0 : c % d; }
static uint32_t f2(uint32_t c, uint32_t d) { return d == 0 ? c : 0; }
static int32_t *h(int32_t l) {
  int32_t *n = &a;
  return n;
}
static uint64_t g(int16_t k) {
  uint16_t m[] = {0, 3};
  int32_t *j = h(0);
  *j = f1(f2(1 && m[1], 0), e) == 0;
  return m[f];
}
int main() {
  g(f);
  printf("%d\n", a);
}

> clang -O0 test.c && ./a.out
0
> clang -O3 test.c --target=riscv64-linux-gnu
> qemu-riscv64 -L /usr/riscv64-linux-gnu/ ./a.out
-10

Clang version: 6e27dd4

[llvmbot]

@llvm/issue-subscribers-backend-risc-v

Author: Yingwei Zheng (dtcxzyw)

Reduced test case: https://godbolt.org/z/1sxbE8eco ``` #include <stdint.h> #include <stdio.h> int32_t a, f; uint16_t e = 10; static uint8_t f1(uint8_t c, uint8_t d) { return d == 0 ? 0 : c % d; } static uint32_t f2(uint32_t c, uint32_t d) { return d == 0 ? c : 0; } static int32_t *h(int32_t l) { int32_t *n = &a; return n; } static uint64_t g(int16_t k) { uint16_t m[] = {0, 3}; int32_t *j = h(0); *j = f1(f2(1 && m[1], 0), e) == 0; return m[f]; } int main() { g(f); printf("%d\n", a); } ```

> clang -O0 test.c && ./a.out
0
> clang -O3 test.c --target=riscv64-linux-gnu
> qemu-riscv64 -L /usr/riscv64-linux-gnu/ ./a.out
-10

[topperc]

Looks like TypePromotion. I'll take this.

[topperc]

Still fails if I revert the most recent change to TypePromotion

commit 0813b90ff5d195d8a40c280f6b745f1cc43e087a
Author: Craig Topper <[email protected]>
Date:   Fri Mar 1 09:17:14 2024

    [TypePromotion] Support positive addition amounts in isSafeWrap. (#81690)

[topperc]

The bug is in SelectionDAG but exposed by TypePromotion.

We convert some selects into AND/OR in LowerSelect. Select blocks poison propagation, but AND/OR does not. We need to insert a freeze to keep poison from the true/false operand from affecting the AND/OR.