As far as I known, if CtxI is given in isGuaranteedNotToBeUndefOrPoison,
it means that V is guaranteedNotToBeUndefOrPoison in CtxI's parent basic
block. However, in guaranteedNotToBeUndefOrPoison, we call
programUndefinedifUndefOrPoison that only scan's V's parent basic block
if V is instruction or entry block if V is argument. That will make
isGuaranteedNotToBePoisonOrUndef return incorrect result for the
following IR, and we call isGuaranteedNotToBePoisonOrUndef('%zext',
nullptr, '%x').
declare void @maythrow()
declare void @use.i32(i32)
define void @zext_sdiv_not_ok3_maybe_poison_denum(i32 noundef %nn, i16 %xx) {
entry:
%n = and i32 %nn, 123
%x = or i16 %xx, 1
br label %loop
loop:
call void @maythrow()
%zext = zext i16 %x to i32
%div = sdiv i32 %n, %zext
call void @use.i32(i32 %div)
br label %loop
}Actually, %zext in block entry is not guaranteed not to be undef or
poison. But current isGuarnateedNotToBePoisonOrUndef calls
programUndefIfUndefOrPoison that scans loop block and it returns true
since there is a sdiv instruction that uses %zext as divisor.
And current isSafeToSpeculativeExecute has not called
isGuaranteedNotToBePoison, but it will happen if D149423 is landed.
And then if we call isSafeToSpeculativeExecute(%div`, %x)`, it will
return true, which is wrong.