4 Commits

Author SHA1 Message Date
Philip Reames
7b04f74ca3 [PoisonChecking] Flesh out complete todo list for full coverage
Note: I don't actually plan to implement all of the cases at the moment, I'm just documenting them for completeness.  There's a couple of cases left which are practically useful for me in debugging loop transforms, and I'll probably stop there for the moment.



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@365550 91177308-0d34-0410-b5e6-96231b3b80d8
2019-07-09 19:59:39 +00:00
Philip Reames
716786c549 [PoisonCheker] Support for out of bounds operands on shifts + insert/extractelement
These are sources of poison which don't come from flags, but are clearly documented in the LangRef.  Left off support for scalable vectors for the moment, but should be easy to add if anyone is interested.  



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@365543 91177308-0d34-0410-b5e6-96231b3b80d8
2019-07-09 19:26:12 +00:00
Philip Reames
b82d90f0e0 [PoisonChecking] Add validation rules for "exact" on sdiv/udiv
As directly stated in the LangRef, no ambiguity here...



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@365538 91177308-0d34-0410-b5e6-96231b3b80d8
2019-07-09 18:56:41 +00:00
Philip Reames
303e799e01 Add a transform pass to make the executable semantics of poison explicit in the IR
Implements a transform pass which instruments IR such that poison semantics are made explicit. That is, it provides a (possibly partial) executable semantics for every instruction w.r.t. poison as specified in the LLVM LangRef. There are obvious parallels to the sanitizer tools, but this pass is focused purely on the semantics of LLVM IR, not any particular source language.

The target audience for this tool is developers working on or targetting LLVM from a frontend. The idea is to be able to take arbitrary IR (with the assumption of known inputs), and evaluate it concretely after having made poison semantics explicit to detect cases where either a) the original code executes UB, or b) a transform pass introduces UB which didn't exist in the original program.

At the moment, this is mostly the framework and still needs to be fleshed out. By reusing existing code we have decent coverage, but there's a lot of cases not yet handled. What's here is good enough to handle interesting cases though; for instance, one of the recent LFTR bugs involved UB being triggered by integer induction variables with nsw/nuw flags would be reported by the current code.

(See comment in PoisonChecking.cpp for full explanation and context)

Differential Revision: https://reviews.llvm.org/D64215



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@365536 91177308-0d34-0410-b5e6-96231b3b80d8
2019-07-09 18:49:29 +00:00