AliveToolkit / alive2

Automatic verification of LLVM optimizations
MIT License
721 stars 93 forks source link

False positive when devirtualizing call with memory attributes #1006

Closed nikic closed 3 weeks ago

nikic commented 5 months ago

https://alive2.llvm.org/ce/z/cyCxQ6

@vtable = constant ptr @fn
declare void @fn() memory(none)

define void @src() {
  %fn = load ptr, ptr @vtable
  call void %fn()
  ret void
}

Results in:

ERROR: Source is more defined than target

Example:

Source:
  >> Jump to %#0
ptr %fn = pointer(non-local, block_id=2, offset=0)
void = function did not return!

SOURCE MEMORY STATE
===================
NON-LOCAL BLOCKS:
Block 0 >   size: 0 align: 8    alloc type: 0   alive: false    address: 0
Block 1 >   size: 8 align: 8    alloc type: 0   alive: true address: 128    const
Block 2 >   size: 8 align: 8    alloc type: 0   alive: true address: 8  const
Block 3 >   size: 4 align: 4    alloc type: 0   alive: true address: 4
Block 4 >   size: 1 align: 8    alloc type: 0   alive: true address: 128

Target:
  >> Jump to %#0
Function @fn triggered UB

Seen in https://web.ist.utl.pt/nuno.lopes/alive2/index.php?hash=a4dd1863f139db90&test=Transforms%2FSimpleLoopUnswitch%2Fmemssa-readnone-access.ll.