[RISC-V][LV] Miscompile at -O3

[ewlu]

Testcase:

int a;
long long ad;
int w[14];
_Bool x[14];
unsigned short b[14][14][14][14];
void c(int w[], _Bool x[]) {
  for (short y = 0; y < 014; y++)
    for (_Bool z = 0; z < 1; z = 1) {
      for (int aa = 1; aa < x[10] + 2; aa++)
        b[y][y][z][a] = 0;
      for (int ab = 1; ab < x[10] + 12; ab++)
        a -= w[ab];
    }
}
int main() {
  for (int y = 0; y < 4; ++y)
    for (int ag = 0; ag < 4; ++ag)
      for (int ah = 0; ah < 4; ++ah)
        for (int ai = 0; ai < 4; ++ai)
          b[y][ag][ah][ai] = 040;
  c(w, x);
  for (int y = 0; y < 4;)
    for (int ag = 0; ag < 4;)
      for (int ah = 0; ah < 4;)
        for (int ai; y < 4; ++y)
          for (ag = 0; ag < 4; ++ag)
            for (ah = 0; ah < 4; ++ah)
              for (ai = 0; ai < 4; ++ai)
                ad ^= b[y][ag][ah][ai];
  __builtin_printf("%llu\n", ad);
}

Commands:

# -O3
$ /scratch/ewlu/daily-upstream-build/build-gcv/bin/clang -march=rv64gcv_zvl256b -O3 red.c -o user-config.out -fsigned-char -fno-strict-aliasing -fwrapv 
$ QEMU_CPU=rv64,vlen=256,rvv_ta_all_1s=true,rvv_ma_all_1s=true,v=true,vext_spec=v1.0,zve32f=true,zve64f=true timeout --verbose -k 0.1 4 /scratch/ewlu/daily-upstream-build/build-gcv/bin/qemu-riscv64 user-config.out
32
# -O2
$ /scratch/ewlu/daily-upstream-build/build-gcv/bin/clang -march=rv64gcv_zvl256b -O2 red.c -o user-config.out -fsigned-char -fno-strict-aliasing -fwrapv 
$ QEMU_CPU=rv64,vlen=256,rvv_ta_all_1s=true,rvv_ma_all_1s=true,v=true,vext_spec=v1.0,zve32f=true,zve64f=true timeout --verbose -k 0.1 4 /scratch/ewlu/daily-upstream-build/build-gcv/bin/qemu-riscv64 user-config.out
0

Found via fuzzer

[topperc]

opt-bisect-limit points to InstCombine

[topperc]

The loop vectorizer created multiple vector.memcheck blocks with a zext of poison

vector.memcheck90:                                ; preds = %for.cond23.preheader.1
  %scevgep91 = getelementptr i8, ptr %w, i64 48
  %5 = zext nneg i8 poison to i64
  %6 = shl nuw nsw i64 %5, 2
  %scevgep92 = getelementptr i8, ptr %scevgep91, i64 %6
  %bound093 = icmp ult ptr @a, %scevgep92
  %bound194 = icmp ult ptr %scevgep, getelementptr inbounds nuw (i8, ptr @a, i64 4) %found.conflict95 = and i1 %bound093, %bound194
  br i1 %found.conflict95, label %scalar.ph97, label %vector.ph98

InstCombine may have just been propagating this poison.

[topperc]

I think the poison is being created by formLCSSAForInstructions being called from the SCEVExpander in VPlanTransforms::expandSCEVs

Possibly because the memcheck block isn't reachable from the entry block yet?

[topperc]

cc: @fhahn @preames