ConstantFolding: fold OOB accesses to poison instead of undef

Author: nunoplopes

llvm/lib/Analysis/ConstantFolding.cpp

@@ -591,7 +591,7 @@ Constant *FoldReinterpretLoadFromConst(Constant *C, Type *LoadTy,
 
   // If we're not accessing anything in this constant, the result is undefined.
   if (Offset <= -1 * static_cast<int64_t>(BytesLoaded))
-    return UndefValue::get(IntType);
+    return PoisonValue::get(IntType);
 
   // TODO: We should be able to support scalable types.
   TypeSize InitializerSize = DL.getTypeAllocSize(C->getType());
@@ -600,7 +600,7 @@ Constant *FoldReinterpretLoadFromConst(Constant *C, Type *LoadTy,
 
   // If we're not accessing anything in this constant, the result is undefined.
   if (Offset >= (int64_t)InitializerSize.getFixedValue())
-    return UndefValue::get(IntType);
+    return PoisonValue::get(IntType);
 
   unsigned char RawBytes[32] = {0};
   unsigned char *CurPtr = RawBytes;
@@ -702,11 +702,11 @@ Constant *llvm::ConstantFoldLoadFromConst(Constant *C, Type *Ty,
     if (Constant *Result = ConstantFoldLoadThroughBitcast(AtOffset, Ty, DL))
       return Result;
 
-  // Explicitly check for out-of-bounds access, so we return undef even if the
+  // Explicitly check for out-of-bounds access, so we return poison even if the
   // constant is a uniform value.
   TypeSize Size = DL.getTypeAllocSize(C->getType());
   if (!Size.isScalable() && Offset.sge(Size.getFixedSize()))
-    return UndefValue::get(Ty);
+    return PoisonValue::get(Ty);
 
   // Try an offset-independent fold of a uniform value.
   if (Constant *Result = ConstantFoldLoadFromUniformValue(C, Ty))

llvm/test/Transforms/InstCombine/strcall-no-nul.ll

@@ -105,11 +105,11 @@ define void @fold_strncmp_past_end(i32* %pcmp) {
 }
 
 
-; Fold strrchr(a5 + 5, '\0') to null.
+; Fold strrchr(a5 + 5, '\0') to poison (it's UB).
 
 define i8* @fold_strrchr_past_end(i32 %c) {
 ; CHECK-LABEL: @fold_strrchr_past_end(
-; CHECK-NEXT:    ret i8* null
+; CHECK-NEXT:    ret i8* poison
 ;
   %p5 = getelementptr [5 x i8], [5 x i8]* @a5, i32 0, i32 5
   %r = call i8* @strrchr(i8* %p5, i32 0)

llvm/test/Transforms/InstSimplify/ConstProp/loads.ll

@@ -267,7 +267,7 @@ define i64 @test16.3() {
   ret i64 %v
 }
 
-@g7 = constant {[0 x i32], [0 x i8], ptr} { [0 x i32] undef, [0 x i8] undef, ptr null }
+@g7 = constant {[0 x i32], [0 x i8], ptr} { [0 x i32] poison, [0 x i8] poison, ptr null }
 
 define ptr @test_leading_zero_size_elems() {
 ; CHECK-LABEL: @test_leading_zero_size_elems(
@@ -277,7 +277,7 @@ define ptr @test_leading_zero_size_elems() {
   ret ptr %v
 }
 
-@g8 = constant {[4294967295 x [0 x i32]], i64} { [4294967295 x [0 x i32]] undef, i64 123 }
+@g8 = constant {[4294967295 x [0 x i32]], i64} { [4294967295 x [0 x i32]] poison, i64 123 }
 
 define i64 @test_leading_zero_size_elems_big() {
 ; CHECK-LABEL: @test_leading_zero_size_elems_big(
@@ -291,7 +291,7 @@ define i64 @test_leading_zero_size_elems_big() {
 
 define i64 @test_array_of_zero_size_array() {
 ; CHECK-LABEL: @test_array_of_zero_size_array(
-; CHECK-NEXT:    ret i64 undef
+; CHECK-NEXT:    ret i64 poison
 ;
   %v = load i64, ptr @g9
   ret i64 %v
@@ -317,7 +317,7 @@ define ptr @test_poison_aggregate() {
   ret ptr %v
 }
 
-@g11 = constant <{ [8 x i8], [8 x i8] }> <{ [8 x i8] undef, [8 x i8] zeroinitializer }>, align 4
+@g11 = constant <{ [8 x i8], [8 x i8] }> <{ [8 x i8] poison, [8 x i8] zeroinitializer }>, align 4
 
 define ptr @test_trailing_zero_gep_index() {
 ; CHECK-LABEL: @test_trailing_zero_gep_index(
@@ -360,24 +360,24 @@ define i8 @load_neg_one_at_unknown_offset() {
   ret i8 %v
 }
 
-@g_with_padding = constant { i32, [4 x i8] } { i32 0, [4 x i8] undef }
+@g_with_padding = constant { i32, [4 x i8] } { i32 0, [4 x i8] poison }
 
 define i32 @load_padding() {
 ; CHECK-LABEL: @load_padding(
-; CHECK-NEXT:    ret i32 undef
+; CHECK-NEXT:    ret i32 poison
 ;
   %v = load i32, ptr getelementptr (i32, ptr @g_with_padding, i64 1)
   ret i32 %v
 }
 
-@g_all_undef = constant { i32, [4 x i8] } undef
+@g_all_poison = constant { i32, [4 x i8] } poison
 
-; Same as the previous case, but with an all-undef initializer.
-define i32 @load_all_undef() {
-; CHECK-LABEL: @load_all_undef(
-; CHECK-NEXT:    ret i32 undef
+; Same as the previous case, but with an all-poison initializer.
+define i32 @load_all_poison() {
+; CHECK-LABEL: @load_all_poison(
+; CHECK-NEXT:    ret i32 poison
 ;
-  %v = load i32, ptr getelementptr (i32, ptr @g_all_undef, i64 1)
+  %v = load i32, ptr getelementptr (i32, ptr @g_all_poison, i64 1)
   ret i32 %v
 }
 

llvm/test/Transforms/InstSimplify/load.ll

@@ -2,21 +2,21 @@
 ; RUN: opt < %s -passes=instsimplify -S | FileCheck %s
 
 @zeroinit = constant {} zeroinitializer
-@undef = constant {} undef
+@poison = constant {} poison
 
 define i32 @crash_on_zeroinit() {
 ; CHECK-LABEL: @crash_on_zeroinit(
-; CHECK-NEXT:    ret i32 undef
+; CHECK-NEXT:    ret i32 poison
 ;
   %load = load i32, ptr @zeroinit
   ret i32 %load
 }
 
-define i32 @crash_on_undef() {
-; CHECK-LABEL: @crash_on_undef(
-; CHECK-NEXT:    ret i32 undef
+define i32 @crash_on_poison() {
+; CHECK-LABEL: @crash_on_poison(
+; CHECK-NEXT:    ret i32 poison
 ;
-  %load = load i32, ptr @undef
+  %load = load i32, ptr @poison
   ret i32 %load
 }
 
@@ -35,7 +35,7 @@ define <8 x i32> @partial_load() {
 ; This does an out of bounds load from the global constant
 define <3 x float> @load_vec3() {
 ; CHECK-LABEL: @load_vec3(
-; CHECK-NEXT:    ret <3 x float> undef
+; CHECK-NEXT:    ret <3 x float> poison
 ;
   %1 = load <3 x float>, ptr getelementptr inbounds (<3 x float>, ptr @constvec, i64 1)
   ret <3 x float> %1