llvm dev - Feb 2019 - funnel shift, select, and poison

On 2/25/2019 12:28 PM, John Regehr via llvm-dev wrote:
> Poison has to propagate through calls and loads/stores, or else 
> basically nothing works.
Consider this:

   %v0 = call i32 @foo(poison) nounwind/readnone
   store i32 %v0, i32* %valid_address

If we assume that poison propagates through calls, we could then 
optimize this to

   %v0 = poison
   store poison, i32* %valid_address

If we somehow realized that foo is

   define i32 @foo(i32) { ret i32 0 }

then the resulting code would be different.

-Krzysztof

> Consider this:
> 
>    %v0 = call i32 @foo(poison) nounwind/readnone
>    store i32 %v0, i32* %valid_address
> 
> If we assume that poison propagates through calls, we could then 
> optimize this to
> 
>    %v0 = poison
>    store poison, i32* %valid_address
This is a sound transformation only if foo() returns poison when it is 
called with poison as an argument.

If this is what foo() looks like:
>    define i32 @foo(i32) { ret i32 0 }
then of course the transformation above is wrong.

John

On 2/25/2019 1:24 PM, John Regehr via llvm-dev wrote:
> 
> This is a sound transformation only if foo() returns poison when it is 
> called with poison as an argument.
Then how do you interpret "poison has to propagate through calls"?

A typical analysis of a function will either see a call or the inlined 
body. If "call(poison)" cannot be assumed to be a poison, then a call 
effectively stops the propagation of a poison.

-Krzysztof