[Mem2Reg] Incorrect poison propagation

[nikic]

; RUN: opt -S -passes=sroa < %a

define i8 @test(i1 %cond) {
start:
  %a = alloca i8, align 1
  br i1 %cond, label %bb1, label %bb2

bb1:
  store i8 poison, ptr %a, align 1
  br label %exit

bb2:
  br label %exit

exit:
  %5 = load i8, ptr %a, align 1
  ret i8 %5
}

Results in:

define i8 @test(i1 %cond) {
  br i1 %cond, label %bb1, label %bb2

bb1:                                              ; preds = %start
  br label %exit

bb2:                                              ; preds = %start
  br label %exit

exit:                                             ; preds = %bb2, %bb1
  ret i8 poison
}

This is incorrect. If %cond is false, then the result must be undef, not poison.

The original test case is more along these lines (not sure yet whether the root cause is always the same):

define i24 @test(i1 %cond) {
start:
  %a = alloca [3 x i8], align 1
  %b = alloca [1 x i8], align 1
  %a.1 = getelementptr inbounds i8, ptr %a, i64 1
  store i8 1, ptr %a, align 1
  store i8 1, ptr %a.1, align 1
  br i1 %cond, label %bb1, label %bb2

bb1:
  %b.1 = getelementptr inbounds i8, ptr %b, i64 1
  %oob = load i8, ptr %b.1, align 1
  %a.2 = getelementptr inbounds i8, ptr %a, i64 2
  store i8 %oob, ptr %a.2, align 1
  br label %exit

bb2:
  br label %exit

exit:
  %5 = load i24, ptr %a, align 1
  ret i24 %5
}

[nikic]

It looks like just mem2reg is sufficient for this.

[nikic]

Looks like mem2reg calls InstSimplify on phi nodes here:

llvm-project/llvm/lib/Transforms/Utils/PromoteMemoryToRegister.cpp

Line 913 in f99746f

if (Value *V = simplifyInstruction(PN, SQ)) {

So it looks like we have found the first real-world instance of the #96631 miscompile.

[nikic]

After looking a bit closer, my guess in the previous comment wasn't right. The actual root cause is the "single store" optimization in mem2reg, which is not correct if the stored value may be poison.

[nikic]

Adding a isGuaranteedNotToBePoison() check to rewriteSingleStoreAlloca() does fix the issue.