Skip to content

[RISCV][MISched] Miscompilation due to incorrect scheduling #82616

Open
@dtcxzyw

Description

@dtcxzyw

Reproducer (it is a RISC-V-only bug):

/*
 * This is a RANDOMLY GENERATED PROGRAM.
 *
 * Generator: csmith 2.4.0
 * Git version: 0ec6f1b
 * Options:   --max-funcs 3 --max-block-depth 3 --quiet --no-volatiles --no-volatile-pointers --output ./csmith2024-02-22@05:14/test71188.c
 * Seed:      2561487490
 */

#include "csmith.h"


static long __undefined;


#pragma pack(push)
#pragma pack(1)
struct S0 {
   unsigned f0 : 15;
   unsigned f1 : 8;
   const signed f2 : 10;
   unsigned f3 : 14;
   signed f4 : 5;
   signed f5 : 8;
};
#pragma pack(pop)

#pragma pack(push)
#pragma pack(1)
struct S1 {
   uint16_t  f0;
   int8_t  f1;
};
#pragma pack(pop)

union U2 {
   int32_t  f0;
   struct S1  f1;
   struct S1  f2;
   const signed f3 : 7;
};

union U3 {
   uint16_t  f0;
   struct S1  f1;
   uint32_t  f2;
   int32_t  f3;
   int32_t  f4;
};

union U4 {
   int64_t  f0;
};

union U5 {
   uint64_t  f0;
};


static union U2 g_4[8][4] = {{{0x8B78ACC4L},{0xC58BDFADL},{-9L},{-9L}},{{0xEA964A90L},{0xEA964A90L},{0x6D21CD43L},{-8L}},{{0x7C7008B1L},{4L},{0x9642E40CL},{9L}},{{0x9642E40CL},{9L},{0x8B78ACC4L},{0x9642E40CL}},{{0xEA964A90L},{9L},{-1L},{9L}},{{9L},{4L},{-9L},{-8L}},{{0x79A20B28L},{0xEA964A90L},{0x8B78ACC4L},{-9L}},{{0x7C7008B1L},{0xC58BDFADL},{-4L},{9L}}};
static union U4 g_13 = {0x3E270BB1DCEDE6A6LL};
static int32_t *g_17 = &g_4[7][0].f0;
static union U2 g_29 = {1L};
static union U2 *g_28 = &g_29;
static uint16_t g_45 = 0x6D00L;
static uint32_t g_71[5] = {3UL,3UL,3UL,3UL,3UL};
static int16_t g_73 = 2L;
static uint64_t g_116 = 8UL;
static uint64_t *g_115 = &g_116;
static uint16_t g_144 = 0x7DB8L;
static struct S1 g_149 = {0x80BAL,1L};
static uint64_t g_165 = 0xD4FCCDB890218128LL;
static uint16_t *g_175 = &g_144;
static uint16_t **g_174 = &g_175;
static uint8_t g_181 = 0xE9L;
static union U5 g_189 = {18446744073709551615UL};
static union U3 g_226[8][3] = {{{0xA0C0L},{0UL},{0UL}},{{1UL},{4UL},{0x96E7L}},{{0xA0C0L},{0x4B21L},{0xA0C0L}},{{1UL},{0x4671L},{4UL}},{{0UL},{0UL},{0xA0C0L}},{{0x96E7L},{0x4671L},{0x4671L}},{{0xA0C0L},{0xFD01L},{0x4B21L}},{{0x96E7L},{0xC28FL},{0x96E7L}}};
static uint8_t g_244[9][5] = {{246UL,246UL,0x41L,246UL,246UL},{0x4EL,0x61L,0x4EL,0x4EL,0x61L},{246UL,2UL,2UL,246UL,2UL},{0x61L,0x61L,0xC3L,0x61L,0x61L},{2UL,246UL,2UL,2UL,246UL},{0x61L,0x4EL,0x4EL,0x61L,0x4EL},{246UL,246UL,0x41L,246UL,246UL},{0x4EL,0x61L,0x4EL,0x4EL,0x61L},{246UL,2UL,2UL,246UL,2UL}};
static int64_t g_255 = 1L;
static int32_t g_256 = 6L;
static int64_t g_257 = 0L;
static int32_t g_258 = (-1L);
static int16_t g_259 = 0xF022L;
static uint16_t g_260 = 0x509BL;
static int32_t g_268 = 0xBA2C1D85L;
static uint8_t g_270 = 0x7DL;



static struct S1  func_1(void);
static struct S1  func_5(union U5  p_6, union U4  p_7, uint64_t  p_8);
static union U5  func_9(struct S0  p_10, struct S1  p_11);





static struct S1  func_1(void)
{ 
    union U2 **l_2 = (void*)0;
    union U2 *l_3[8][9][3] = {{{&g_4[7][0],(void*)0,&g_4[7][0]},{&g_4[5][0],&g_4[7][0],&g_4[0][2]},{&g_4[0][1],&g_4[6][0],&g_4[7][0]},{&g_4[7][1],&g_4[6][0],&g_4[7][0]},{&g_4[7][0],&g_4[7][0],&g_4[7][0]},{&g_4[7][3],(void*)0,&g_4[7][0]},{(void*)0,&g_4[7][0],&g_4[0][2]},{(void*)0,&g_4[7][0],&g_4[4][0]},{&g_4[7][0],&g_4[7][0],&g_4[7][0]}},{{&g_4[0][2],(void*)0,&g_4[5][3]},{&g_4[1][1],(void*)0,&g_4[7][0]},{&g_4[7][0],(void*)0,&g_4[3][0]},{&g_4[5][2],&g_4[7][0],&g_4[3][3]},{&g_4[7][2],&g_4[7][2],&g_4[7][0]},{&g_4[0][1],&g_4[5][3],&g_4[7][0]},{&g_4[0][2],&g_4[6][0],&g_4[6][2]},{&g_4[7][0],&g_4[3][3],&g_4[6][0]},{&g_4[2][1],&g_4[0][2],&g_4[6][2]}},{{&g_4[7][0],(void*)0,&g_4[7][0]},{(void*)0,&g_4[3][0],&g_4[7][0]},{&g_4[4][3],(void*)0,&g_4[3][3]},{&g_4[5][1],&g_4[5][0],&g_4[3][0]},{(void*)0,&g_4[1][0],&g_4[7][0]},{&g_4[4][0],&g_4[4][0],&g_4[5][3]},{&g_4[7][0],(void*)0,&g_4[7][0]},{&g_4[6][0],&g_4[7][0],&g_4[4][0]},{&g_4[6][0],&g_4[7][0],&g_4[0][2]}},{{&g_4[7][0],(void*)0,&g_4[7][0]},{&g_4[0][2],&g_4[2][1],&g_4[7][0]},{&g_4[6][0],&g_4[7][0],&g_4[7][0]},{(void*)0,&g_4[7][0],&g_4[7][0]},{(void*)0,&g_4[7][0],&g_4[0][2]},{&g_4[6][0],&g_4[7][0],&g_4[7][0]},{&g_4[0][2],&g_4[0][2],&g_4[7][0]},{&g_4[7][0],&g_4[0][0],&g_4[0][2]},{&g_4[6][0],&g_4[5][1],&g_4[7][1]}},{{&g_4[6][0],&g_4[7][0],&g_4[4][1]},{&g_4[7][0],(void*)0,&g_4[4][0]},{&g_4[4][0],&g_4[0][0],&g_4[2][1]},{(void*)0,&g_4[7][0],&g_4[7][0]},{&g_4[5][1],&g_4[3][2],&g_4[3][2]},{&g_4[4][3],&g_4[7][0],&g_4[0][2]},{(void*)0,&g_4[7][3],&g_4[7][0]},{&g_4[7][0],&g_4[5][2],&g_4[7][0]},{(void*)0,&g_4[0][1],&g_4[5][0]}},{{&g_4[7][0],&g_4[7][0],&g_4[5][1]},{&g_4[0][2],&g_4[7][3],&g_4[7][0]},{&g_4[5][3],&g_4[0][2],&g_4[7][0]},{&g_4[6][0],&g_4[6][2],&g_4[6][2]},{&g_4[7][0],&g_4[5][1],&g_4[7][3]},{(void*)0,&g_4[7][0],(void*)0},{&g_4[7][0],&g_4[6][2],&g_4[7][0]},{&g_4[6][0],&g_4[3][3],(void*)0},{&g_4[4][0],&g_4[3][1],&g_4[7][0]}},{{&g_4[4][3],(void*)0,(void*)0},{&g_4[0][1],&g_4[6][0],&g_4[6][0]},{&g_4[7][0],(void*)0,&g_4[0][0]},{&g_4[7][0],&g_4[7][0],&g_4[7][0]},{&g_4[0][1],&g_4[7][0],&g_4[7][0]},{&g_4[7][0],&g_4[7][0],&g_4[0][0]},{&g_4[7][3],(void*)0,&g_4[6][0]},{&g_4[7][0],&g_4[0][2],(void*)0},{&g_4[7][0],&g_4[7][2],&g_4[7][0]}},{{&g_4[7][0],&g_4[7][0],(void*)0},{&g_4[2][1],&g_4[7][0],&g_4[7][0]},{&g_4[7][0],&g_4[7][0],(void*)0},{&g_4[1][0],&g_4[7][0],&g_4[7][3]},{&g_4[7][0],&g_4[7][3],&g_4[6][2]},{&g_4[7][0],&g_4[7][0],&g_4[7][0]},{&g_4[7][0],&g_4[0][0],&g_4[7][0]},{&g_4[7][0],(void*)0,&g_4[5][1]},{(void*)0,&g_4[0][2],&g_4[5][0]}}};
    struct S0 l_12 = {12,6,31,30,2,7};
    struct S1 l_14 = {0xDB1AL,0x3BL};
    int32_t l_266 = 0xC236062CL;
    int32_t l_267 = 0xB78067A0L;
    int32_t l_269[3];
    int i, j, k;
    for (i = 0; i < 3; i++)
        l_269[i] = 4L;
    l_3[2][7][2] = (void*)0;
    l_14 = func_5(func_9(l_12, (g_13 , l_14)), g_13, l_12.f4);
    for (g_29.f1.f1 = 0; (g_29.f1.f1 == (-26)); --g_29.f1.f1)
    { 
        int32_t *l_265[6][2] = {{(void*)0,(void*)0},{&g_256,(void*)0},{(void*)0,&g_256},{(void*)0,(void*)0},{&g_256,(void*)0},{(void*)0,&g_256}};
        int i, j;
        g_270--;
    }
    return l_14;
}




static struct S1  func_5(union U5  p_6, union U4  p_7, uint64_t  p_8)
{ 
    int64_t l_79 = 0x5013F2C8C67737D6LL;
    int16_t *l_99 = &g_73;
    uint16_t *l_107 = &g_4[7][0].f1.f0;
    int32_t *l_117[2][5] = {{&g_29.f0,&g_29.f0,&g_29.f0,&g_29.f0,&g_29.f0},{&g_29.f0,&g_29.f0,&g_29.f0,&g_29.f0,&g_29.f0}};
    int32_t l_143[9][6] = {{(-2L),0x645DA593L,0x16BB261DL,(-2L),7L,7L},{0x7B4A3B70L,0x645DA593L,0x645DA593L,0x7B4A3B70L,7L,0x16BB261DL},{8L,0x645DA593L,7L,8L,7L,0x645DA593L},{(-2L),0x645DA593L,0x16BB261DL,(-2L),7L,7L},{0x7B4A3B70L,0x645DA593L,0x645DA593L,0x7B4A3B70L,7L,0x16BB261DL},{8L,0x645DA593L,7L,8L,7L,0x645DA593L},{(-2L),0x645DA593L,0x16BB261DL,(-2L),7L,7L},{0x7B4A3B70L,0x645DA593L,0x645DA593L,0x7B4A3B70L,7L,0x16BB261DL},{8L,0x645DA593L,7L,8L,7L,0x645DA593L}};
    struct S1 l_204[2][4] = {{{0x977AL,0x77L},{0x977AL,0x77L},{0x977AL,0x77L},{0x977AL,0x77L}},{{0x977AL,0x77L},{0x977AL,0x77L},{0x977AL,0x77L},{0x977AL,0x77L}}};
    union U2 **l_209 = &g_28;
    int32_t **l_254 = &l_117[0][1];
    int i, j;
    if ((safe_sub_func_uint16_t_u_u((safe_sub_func_int16_t_s_s(9L, l_79)), (safe_rshift_func_int32_t_s_s((g_29.f0 = (safe_add_func_int8_t_s_s((((safe_lshift_func_uint16_t_u_s((((safe_sub_func_uint8_t_u_u(((safe_div_func_uint8_t_u_u(((safe_unary_minus_func_uint64_t_u((safe_div_func_int32_t_s_s((safe_add_func_uint8_t_u_u((safe_div_func_uint64_t_u_u(((safe_add_func_int16_t_s_s(((*l_99) = g_29.f0), (~(safe_sub_func_int64_t_s_s((safe_lshift_func_int8_t_s_s(0x22L, 1)), (safe_div_func_uint16_t_u_u(((*l_107) = l_79), ((safe_mul_func_uint16_t_u_u((safe_div_func_uint8_t_u_u((l_79 & (0xC4L ^ (!(safe_div_func_uint8_t_u_u(((((void*)0 != g_115) ^ g_29.f0) <= g_71[1]), 1L))))), 255UL)), 0x4290L)) & g_29.f0)))))))) && g_71[1]), (*g_115))), 1L)), g_29.f0)))) < p_6.f0), 8UL)) <= 0x5C710B0AL), g_116)) < 0x47AC3CA6ABCE8417LL) && l_79), g_45)) , (*g_115)) || p_6.f0), 0x24L))), 2)))))
    { 
        const int8_t l_135 = 0xF0L;
        int32_t l_142[9][10] = {{(-6L),0x6F6008F0L,(-1L),1L,9L,0L,0x56E8D107L,0L,9L,1L},{0x2AEDA2CAL,0xD69FAF8FL,0x2AEDA2CAL,0x30D721F5L,0xA0BFB30CL,0x7B95470CL,0L,0x77A9A3A1L,0x6F6008F0L,0x3BCE19DEL},{(-1L),0xB7F3AE84L,(-1L),0x7B95470CL,(-2L),1L,0xDCF32642L,4L,0xD69FAF8FL,0L},{0x23CDDDF8L,0xB442378EL,0x7B95470CL,1L,0x3BCE19DEL,7L,0xA0BFB30CL,(-1L),0x77A9A3A1L,9L},{0xB442378EL,0x56E8D107L,0L,4L,0x6F6008F0L,0x6F6008F0L,4L,0L,0x56E8D107L,0xB442378EL},{(-1L),(-1L),0xA0BFB30CL,(-1L),(-6L),1L,(-9L),(-10L),0x2AEDA2CAL,(-1L)},{0xD69FAF8FL,0x6F6008F0L,1L,(-1L),(-6L),(-3L),9L,(-1L),0x30D721F5L,0xB442378EL},{(-6L),(-9L),0xB442378EL,0L,0x6F6008F0L,(-1L),0xD69FAF8FL,9L,1L,9L},{0xD6BF538CL,0xDCF32642L,0x3BCE19DEL,1L,0x3BCE19DEL,0xDCF32642L,0xD6BF538CL,(-1L),4L,0L}};
        union U3 l_199 = {8UL};
        int32_t l_200 = 2L;
        int32_t **l_251[1][7] = {{&g_17,&g_17,&l_117[0][1],&g_17,&g_17,&l_117[0][1],&g_17}};
        int32_t * const l_252 = &l_200;
        int32_t **l_253 = &g_17;
        int i, j;
        for (p_6.f0 = 0; (p_6.f0 > 16); p_6.f0 = safe_add_func_int16_t_s_s(p_6.f0, 6))
        { 
            uint32_t l_126 = 0xA4EB99B8L;
            int32_t l_136 = (-1L);
            int32_t l_169 = 1L;
            int32_t l_170 = 0x87D1255FL;
            uint8_t *l_180[5][5] = {{&g_181,&g_181,&g_181,&g_181,&g_181},{(void*)0,(void*)0,(void*)0,(void*)0,(void*)0},{&g_181,&g_181,&g_181,&g_181,&g_181},{(void*)0,&g_181,&g_181,(void*)0,&g_181},{&g_181,&g_181,&g_181,&g_181,&g_181}};
            struct S0 l_185 = {53,0,31,75,3,6};
            uint16_t **l_186 = &g_175;
            union U5 *l_190 = &g_189;
            uint32_t *l_191 = &l_126;
            int i, j;
        }
        for (p_7.f0 = (-12); (p_7.f0 <= (-12)); p_7.f0++)
        { 
            uint16_t *l_227 = &l_204[0][0].f0;
            int32_t l_228 = (-3L);
            uint8_t *l_229 = &g_181;
            int32_t l_237 = 8L;
            int16_t l_238 = 1L;
            int32_t l_239[1][1][4] = {{{8L,8L,8L,8L}}};
            uint32_t l_247 = 4294967295UL;
            int32_t **l_250 = (void*)0;
            int i, j, k;
            for (g_29.f0 = 1; (g_29.f0 <= 4); g_29.f0 += 1)
            { 
                int32_t **l_207 = &l_117[0][1];
                (*l_207) = g_17;
            }
            if ((~((l_209 == (void*)0) < ((*l_229) = (safe_sub_func_uint16_t_u_u((--(*g_175)), (((((-6L) && (safe_mod_func_uint16_t_u_u(l_142[4][3], (safe_rshift_func_uint64_t_u_s((safe_mul_func_uint16_t_u_u((((*l_107) = ((safe_mul_func_uint8_t_u_u(g_116, (l_199.f4 = (g_165 || (safe_add_func_uint16_t_u_u(l_142[6][9], 1L)))))) <= (safe_div_func_uint16_t_u_u(((*l_227) ^= (g_226[3][2] , 0UL)), 0x501EL)))) ^ l_142[4][3]), p_8)), l_142[4][3]))))) , p_8) , (*g_17)) & l_228)))))))
            { 
                union U2 l_234 = {-8L};
                int32_t l_240 = 1L;
                int32_t l_241 = 0xB8815D8FL;
                int32_t l_242 = 0xFF450A72L;
                int32_t l_243 = 0x8C6111A7L;
                l_200 |= ((safe_mul_func_int64_t_s_s((safe_div_func_int16_t_s_s(0xA634L, (**g_174))), (0L | (l_234 , (-1L))))) || (l_228 , (safe_lshift_func_uint32_t_u_u(0UL, 24))));
                g_244[5][3]++;
                l_247++;
            }
            else
            { 
                if ((*g_17))
                    break;
            }
            l_117[0][1] = l_117[0][1];
        }
        g_17 = g_17;
        (*l_253) = l_252;
    }
    else
    { 
        (*g_17) |= p_7.f0;
        return g_149;
    }
    (*l_254) = l_117[1][1];
    g_260--;
    return l_204[0][2];
}




static union U5  func_9(struct S0  p_10, struct S1  p_11)
{ 
    int8_t l_15 = (-1L);
    union U5 l_16 = {0x9D7FCCEA59F7C1AELL};
    int32_t **l_18 = &g_17;
    const int32_t *l_24 = &g_4[7][0].f0;
    union U4 l_25[10] = {{0x57240E60136B8055LL},{0x57240E60136B8055LL},{0x57240E60136B8055LL},{0x57240E60136B8055LL},{0x57240E60136B8055LL},{0x57240E60136B8055LL},{0x57240E60136B8055LL},{0x57240E60136B8055LL},{0x57240E60136B8055LL},{0x57240E60136B8055LL}};
    struct S1 l_35[1][9] = {{{0x6938L,0x8DL},{0x6938L,0x8DL},{0x6938L,0x8DL},{0x6938L,0x8DL},{0x6938L,0x8DL},{0x6938L,0x8DL},{0x6938L,0x8DL},{0x6938L,0x8DL},{0x6938L,0x8DL}}};
    uint16_t l_52 = 1UL;
    int16_t l_72 = 0xCDD4L;
    union U5 l_74 = {18446744073709551613UL};
    int i, j;
    l_15 = (g_4[7][0].f0 >= (-4L));
    (*l_18) = (l_16 , g_17);
    for (l_15 = 25; (l_15 == (-19)); l_15 = safe_sub_func_int16_t_s_s(l_15, 6))
    { 
        const int32_t *l_21 = &g_4[7][0].f0;
        const int32_t **l_22 = (void*)0;
        const int32_t **l_23[8] = {&l_21,&l_21,&l_21,&l_21,&l_21,&l_21,&l_21,&l_21};
        int i;
        l_24 = l_21;
    }
    for (p_11.f1 = 9; (p_11.f1 >= 0); p_11.f1 -= 1)
    { 
        int8_t l_31[3][1][10] = {{{0xCBL,0xCBL,(-1L),4L,(-1L),0xCBL,0xCBL,(-1L),4L,(-1L)}},{{0xCBL,0xCBL,(-1L),4L,(-1L),0xCBL,0xCBL,(-1L),4L,(-1L)}},{{0xCBL,0xCBL,(-1L),4L,(-1L),0xCBL,0xCBL,(-1L),4L,(-1L)}}};
        int32_t *l_41[10][8][3] = {{{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0}},{{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0}},{{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0}},{{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0}},{{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0}},{{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0}},{{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0}},{{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0}},{{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0}},{{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0},{&g_29.f0,&g_29.f0,&g_29.f0},{&g_4[7][0].f0,&g_4[7][0].f0,&g_4[7][0].f0}}};
        union U2 *l_51 = &g_4[6][1];
        int8_t l_70 = (-1L);
        int i, j, k;
        for (l_15 = 9; (l_15 >= 0); l_15 -= 1)
        { 
            union U2 *l_27[8];
            union U2 **l_26 = &l_27[4];
            uint64_t *l_30[6][10][4] = {{{(void*)0,&l_16.f0,&l_16.f0,&l_16.f0},{(void*)0,(void*)0,(void*)0,(void*)0},{(void*)0,(void*)0,(void*)0,&l_16.f0},{&l_16.f0,(void*)0,(void*)0,&l_16.f0},{(void*)0,&l_16.f0,&l_16.f0,&l_16.f0},{(void*)0,(void*)0,&l_16.f0,&l_16.f0},{&l_16.f0,(void*)0,(void*)0,(void*)0},{(void*)0,(void*)0,&l_16.f0,&l_16.f0},{&l_16.f0,&l_16.f0,(void*)0,&l_16.f0},{&l_16.f0,(void*)0,&l_16.f0,&l_16.f0}},{{&l_16.f0,(void*)0,(void*)0,&l_16.f0},{&l_16.f0,&l_16.f0,&l_16.f0,&l_16.f0},{(void*)0,(void*)0,(void*)0,&l_16.f0},{&l_16.f0,&l_16.f0,&l_16.f0,(void*)0},{(void*)0,&l_16.f0,&l_16.f0,&l_16.f0},{(void*)0,&l_16.f0,(void*)0,(void*)0},{&l_16.f0,&l_16.f0,(void*)0,&l_16.f0},{(void*)0,(void*)0,(void*)0,&l_16.f0},{(void*)0,&l_16.f0,&l_16.f0,&l_16.f0},{(void*)0,(void*)0,&l_16.f0,&l_16.f0}},{{&l_16.f0,(void*)0,&l_16.f0,&l_16.f0},{(void*)0,&l_16.f0,&l_16.f0,&l_16.f0},{(void*)0,(void*)0,(void*)0,(void*)0},{(void*)0,(void*)0,(void*)0,&l_16.f0},{&l_16.f0,(void*)0,(void*)0,&l_16.f0},{(void*)0,&l_16.f0,&l_16.f0,&l_16.f0},{(void*)0,(void*)0,&l_16.f0,&l_16.f0},{&l_16.f0,(void*)0,(void*)0,(void*)0},{(void*)0,(void*)0,&l_16.f0,&l_16.f0},{&l_16.f0,&l_16.f0,(void*)0,&l_16.f0}},{{&l_16.f0,(void*)0,&l_16.f0,&l_16.f0},{&l_16.f0,(void*)0,(void*)0,&l_16.f0},{&l_16.f0,&l_16.f0,&l_16.f0,&l_16.f0},{(void*)0,(void*)0,(void*)0,&l_16.f0},{&l_16.f0,&l_16.f0,&l_16.f0,(void*)0},{(void*)0,&l_16.f0,&l_16.f0,&l_16.f0},{(void*)0,&l_16.f0,(void*)0,(void*)0},{&l_16.f0,&l_16.f0,(void*)0,&l_16.f0},{(void*)0,(void*)0,(void*)0,&l_16.f0},{(void*)0,&l_16.f0,&l_16.f0,&l_16.f0}},{{(void*)0,(void*)0,&l_16.f0,&l_16.f0},{&l_16.f0,(void*)0,&l_16.f0,&l_16.f0},{(void*)0,&l_16.f0,&l_16.f0,(void*)0},{(void*)0,&l_16.f0,&l_16.f0,(void*)0},{&l_16.f0,(void*)0,(void*)0,&l_16.f0},{&l_16.f0,&l_16.f0,&l_16.f0,&l_16.f0},{(void*)0,&l_16.f0,(void*)0,&l_16.f0},{(void*)0,&l_16.f0,&l_16.f0,&l_16.f0},{&l_16.f0,(void*)0,(void*)0,(void*)0},{&l_16.f0,&l_16.f0,(void*)0,(void*)0}},{{(void*)0,&l_16.f0,&l_16.f0,(void*)0},{&l_16.f0,(void*)0,&l_16.f0,&l_16.f0},{&l_16.f0,(void*)0,&l_16.f0,&l_16.f0},{(void*)0,&l_16.f0,(void*)0,(void*)0},{&l_16.f0,&l_16.f0,(void*)0,&l_16.f0},{&l_16.f0,(void*)0,&l_16.f0,(void*)0},{(void*)0,&l_16.f0,(void*)0,&l_16.f0},{(void*)0,&l_16.f0,&l_16.f0,(void*)0},{&l_16.f0,(void*)0,(void*)0,&l_16.f0},{&l_16.f0,&l_16.f0,&l_16.f0,(void*)0}}};
            int32_t l_32[10] = {3L,3L,0x0C4F586FL,(-1L),0x0C4F586FL,3L,3L,0x0C4F586FL,(-1L),0x0C4F586FL};
            uint64_t l_46 = 0xE796224A103C2894LL;
            int i, j, k;
            for (i = 0; i < 8; i++)
                l_27[i] = &g_4[7][0];
            if (((p_10.f3 == (l_31[2][0][6] |= ((g_28 = ((*l_26) = (void*)0)) == &g_29))) >= p_10.f5))
            { 
                uint16_t *l_42 = (void*)0;
                uint16_t *l_43 = (void*)0;
                uint16_t *l_44 = &g_4[7][0].f1.f0;
                g_45 |= ((-5L) <= ((g_29.f0 != ((0xEDB0L > g_13.f0) != (l_32[5] & (((safe_sub_func_uint32_t_u_u((l_35[0][0] , (safe_div_func_uint16_t_u_u(((*l_44) = (((safe_rshift_func_uint8_t_u_s(g_29.f0, p_10.f3)) & (!((l_41[4][6][1] = g_17) != (void*)0))) < (**l_18))), g_29.f0))), p_10.f2)) , 0x92L) < 0xFCL)))) < p_11.f1));
            }
            else
            { 
                ++l_46;
                if (p_10.f4)
                    break;
            }
            g_73 ^= ((l_52 = (p_10 , (((void*)0 == l_51) == ((void*)0 == &g_17)))) != ((g_13.f0 && (l_32[5] = ((-1L) || (safe_mul_func_uint8_t_u_u((safe_add_func_int32_t_s_s(((*g_17) = (((((((8L || (safe_mul_func_int64_t_s_s((~((safe_mul_func_uint64_t_u_u((g_71[1] = ((safe_div_func_int16_t_s_s(((safe_mul_func_uint64_t_u_u((safe_add_func_uint8_t_u_u((safe_add_func_uint64_t_u_u(0UL, (-10L))), g_4[7][0].f0)), 0L)) && g_29.f0), l_70)) != (**l_18))), p_10.f5)) && g_71[2])), (**l_18)))) && l_72) < p_10.f3) && 0x4046E41CA980D529LL) == (*g_17)) , (**l_18)) < (*g_17))), p_10.f1)), (-1L)))))) < p_10.f3));
        }
    }
    return l_74;
}





int main (int argc, char* argv[])
{
    int i, j;
    int print_hash_value = 0;
    if (argc == 2 && strcmp(argv[1], "1") == 0) print_hash_value = 1;
    platform_main_begin();
    crc32_gentab();
    func_1();
    for (i = 0; i < 8; i++)
    {
        for (j = 0; j < 4; j++)
        {
            transparent_crc(g_4[i][j].f0, "g_4[i][j].f0", print_hash_value);
            if (print_hash_value) printf("index = [%d][%d]\n", i, j);

        }
    }
    transparent_crc(g_13.f0, "g_13.f0", print_hash_value);
    transparent_crc(g_29.f0, "g_29.f0", print_hash_value);
    transparent_crc(g_45, "g_45", print_hash_value);
    for (i = 0; i < 5; i++)
    {
        transparent_crc(g_71[i], "g_71[i]", print_hash_value);
        if (print_hash_value) printf("index = [%d]\n", i);

    }
    transparent_crc(g_73, "g_73", print_hash_value);
    transparent_crc(g_116, "g_116", print_hash_value);
    transparent_crc(g_144, "g_144", print_hash_value);
    transparent_crc(g_149.f0, "g_149.f0", print_hash_value);
    transparent_crc(g_149.f1, "g_149.f1", print_hash_value);
    transparent_crc(g_165, "g_165", print_hash_value);
    transparent_crc(g_181, "g_181", print_hash_value);
    transparent_crc(g_189.f0, "g_189.f0", print_hash_value);
    for (i = 0; i < 8; i++)
    {
        for (j = 0; j < 3; j++)
        {
            transparent_crc(g_226[i][j].f0, "g_226[i][j].f0", print_hash_value);
            if (print_hash_value) printf("index = [%d][%d]\n", i, j);

        }
    }
    for (i = 0; i < 9; i++)
    {
        for (j = 0; j < 5; j++)
        {
            transparent_crc(g_244[i][j], "g_244[i][j]", print_hash_value);
            if (print_hash_value) printf("index = [%d][%d]\n", i, j);

        }
    }
    transparent_crc(g_255, "g_255", print_hash_value);
    transparent_crc(g_256, "g_256", print_hash_value);
    transparent_crc(g_257, "g_257", print_hash_value);
    transparent_crc(g_258, "g_258", print_hash_value);
    transparent_crc(g_259, "g_259", print_hash_value);
    transparent_crc(g_260, "g_260", print_hash_value);
    transparent_crc(g_268, "g_268", print_hash_value);
    transparent_crc(g_270, "g_270", print_hash_value);
    platform_main_end(crc32_context ^ 0xFFFFFFFFUL, print_hash_value);
    return 0;
}

/************************ statistics *************************

XXX max struct depth: 1
breakdown:
   depth: 0, occurrence: 64
   depth: 1, occurrence: 6
XXX total union variables: 7

XXX non-zero bitfields defined in structs: 7
XXX zero bitfields defined in structs: 0
XXX const bitfields defined in structs: 2
XXX volatile bitfields defined in structs: 0
XXX structs with bitfields in the program: 7
breakdown:
   indirect level: 0, occurrence: 3
   indirect level: 1, occurrence: 3
   indirect level: 2, occurrence: 1
XXX full-bitfields structs in the program: 2
breakdown:
   indirect level: 0, occurrence: 2
XXX times a bitfields struct's address is taken: 72
XXX times a bitfields struct on LHS: 0
XXX times a bitfields struct on RHS: 6
XXX times a single bitfield on LHS: 0
XXX times a single bitfield on RHS: 10

XXX max expression depth: 34
breakdown:
   depth: 1, occurrence: 38
   depth: 2, occurrence: 9
   depth: 7, occurrence: 2
   depth: 8, occurrence: 1
   depth: 18, occurrence: 1
   depth: 23, occurrence: 1
   depth: 31, occurrence: 1
   depth: 34, occurrence: 1

XXX total number of pointers: 51

XXX times a variable address is taken: 141
XXX times a pointer is dereferenced on RHS: 14
breakdown:
   depth: 1, occurrence: 8
   depth: 2, occurrence: 6
XXX times a pointer is dereferenced on LHS: 22
breakdown:
   depth: 1, occurrence: 22
XXX times a pointer is compared with null: 5
XXX times a pointer is compared with address of another variable: 0
XXX times a pointer is compared with another pointer: 0
XXX times a pointer is qualified to be dereferenced: 417

XXX max dereference level: 2
breakdown:
   level: 0, occurrence: 0
   level: 1, occurrence: 59
   level: 2, occurrence: 10
XXX number of pointers point to pointers: 17
XXX number of pointers point to scalars: 28
XXX number of pointers point to structs: 1
XXX percent of pointers has null in alias set: 35.3
XXX average alias set size: 1.29

XXX times a non-volatile is read: 160
XXX times a non-volatile is write: 86
XXX times a volatile is read: 0
XXX    times read thru a pointer: 0
XXX times a volatile is write: 0
XXX    times written thru a pointer: 0
XXX times a volatile is available for access: 0
XXX percentage of non-volatile access: 100

XXX forward jumps: 0
XXX backward jumps: 0

XXX stmts: 35
XXX max block depth: 3
breakdown:
   depth: 0, occurrence: 13
   depth: 1, occurrence: 9
   depth: 2, occurrence: 5
   depth: 3, occurrence: 8

XXX percentage a fresh-made variable is used: 26.5
XXX percentage an existing variable is used: 73.5
FYI: the random generator makes assumptions about the integer size. See platform.info for more details.
XXX total OOB instances added: 0
********************* end of statistics **********************/

I am sorry I cannot provide a minimal UB-free reproducer.

Commands:

bin/clang -O1 test.c --target=riscv64-linux-gnu -I/usr/include/csmith -w
qemu-riscv64 -L /usr/riscv64-linux-gnu/ ./a.out

The result should be checksum = A559693C, but qemu returns checksum = FC86B582.

Bisect to Machine Instruction Scheduler:

bin/clang -O1 test.c --target=riscv64-linux-gnu -I/usr/include/csmith -w -mllvm -opt-bisect-limit=1340 -mllvm -debug-only=machine-scheduler -mllvm --misched-only-block=7 2>log

Before MISched:

1024B	bb.7.crc32_gentab.exit:
	; predecessors: %bb.6
	  successors: %bb.9(0x30000000), %bb.8(0x50000000); %bb.9(37.50%), %bb.8(62.50%)

1040B	  %218:gpr = AUIPC target-flags(riscv-pcrel-hi) @g_29, pre-instr-symbol <mcsymbol .Lpcrel_hi2>
1056B	  %70:gpr = ADDI %218:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi2>
1072B	  %71:gpr = LH %70:gpr, 0 :: (dereferenceable load (s16) from @g_29, align 4, !tbaa !19)
1088B	  %219:gpr = AUIPC target-flags(riscv-pcrel-hi) @g_73, pre-instr-symbol <mcsymbol .Lpcrel_hi3>
1104B	  SH %71:gpr, %219:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi3> :: (store (s16) into @g_73, !tbaa !20)
1120B	  %220:gpr = AUIPC target-flags(riscv-pcrel-hi) @g_4, pre-instr-symbol <mcsymbol .Lpcrel_hi4>
1136B	  %73:gpr = ADDI %220:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi4>
1152B	  %74:gpr = LUI 3
1168B	  %75:gpr = ADDI %74:gpr, 2006
1184B	  SH %75:gpr, %73:gpr, 112 :: (store (s16) into `ptr getelementptr inbounds ([8 x [4 x %union.U2]], ptr @g_4, i64 0, i64 7)`, align 4, !tbaa !20)
1200B	  %76:gpr = ADDI $x0, 37
1216B	  SW %76:gpr, %70:gpr, 0 :: (store (s32) into @g_29, !tbaa !19)
1232B	  %77:gpr = ADDI $x0, 2
1248B	  SW %77:gpr, %stack.0.l_200.i.i, 0 :: (store (s32) into %ir.l_200.i.i, !tbaa !16)
1264B	  %78:gpr = ADDI $x0, 5
1280B	  SW %78:gpr, %70:gpr, 0 :: (store (s32) into @g_29, !tbaa !19)
1296B	  %221:gpr = AUIPC target-flags(riscv-pcrel-hi) @g_144, pre-instr-symbol <mcsymbol .Lpcrel_hi5>
1312B	  %80:gpr = LH %221:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi5> :: (dereferenceable load (s16) from @g_144, !tbaa !20)
1328B	  %11:gpr = ADDI %80:gpr, -1
1344B	  SH %11:gpr, %221:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi5> :: (store (s16) into @g_144, !tbaa !20)
1376B	  SH $x0, %73:gpr, 112 :: (store (s16) into `ptr getelementptr inbounds ([8 x [4 x %union.U2]], ptr @g_4, i64 0, i64 7)`, align 4, !tbaa !20)
1392B	  %222:gpr = AUIPC target-flags(riscv-pcrel-hi) @g_17, pre-instr-symbol <mcsymbol .Lpcrel_hi6>
1408B	  %83:gpr = LD %222:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi6> :: (dereferenceable load (s64) from @g_17, !tbaa !9)
1424B	  %84:gpr = LHU %83:gpr, 0 :: (load (s16) from %ir.4, align 4, !tbaa !16)
1440B	  %85:gpr = ANDI %84:gpr, 253
1456B	  %86:gpr = SUBW %11:gpr, %85:gpr
1472B	  %223:gpr = AUIPC target-flags(riscv-pcrel-hi) @g_181, pre-instr-symbol <mcsymbol .Lpcrel_hi7>
1488B	  SB %86:gpr, %223:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi7> :: (store (s8) into @g_181, !tbaa !19)
1504B	  %88:gpr = SLLI %11:gpr, 48
1520B	  BEQ %88:gpr, $x0, %bb.9
1536B	  PseudoBR %bb.8

After:

1024B	bb.7.crc32_gentab.exit:
	; predecessors: %bb.6
	  successors: %bb.9(0x30000000), %bb.8(0x50000000); %bb.9(37.50%), %bb.8(62.50%)

1040B	  %218:gpr = AUIPC target-flags(riscv-pcrel-hi) @g_29, pre-instr-symbol <mcsymbol .Lpcrel_hi2>
1056B	  %70:gpr = ADDI %218:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi2>
1072B	  %71:gpr = LH %70:gpr, 0 :: (dereferenceable load (s16) from @g_29, align 4, !tbaa !19)
1088B	  %219:gpr = AUIPC target-flags(riscv-pcrel-hi) @g_73, pre-instr-symbol <mcsymbol .Lpcrel_hi3>
1104B	  SH %71:gpr, %219:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi3> :: (store (s16) into @g_73, !tbaa !20)
1120B	  %220:gpr = AUIPC target-flags(riscv-pcrel-hi) @g_4, pre-instr-symbol <mcsymbol .Lpcrel_hi4>
1136B	  %73:gpr = ADDI %220:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi4>
1152B	  %74:gpr = LUI 3
1168B	  %75:gpr = ADDI %74:gpr, 2006
1184B	  SH %75:gpr, %73:gpr, 112 :: (store (s16) into `ptr getelementptr inbounds ([8 x [4 x %union.U2]], ptr @g_4, i64 0, i64 7)`, align 4, !tbaa !20)
1200B	  %76:gpr = ADDI $x0, 37
1216B	  SW %76:gpr, %70:gpr, 0 :: (store (s32) into @g_29, !tbaa !19)
1232B	  %77:gpr = ADDI $x0, 2
1248B	  SW %77:gpr, %stack.0.l_200.i.i, 0 :: (store (s32) into %ir.l_200.i.i, !tbaa !16)
1296B	  %221:gpr = AUIPC target-flags(riscv-pcrel-hi) @g_144, pre-instr-symbol <mcsymbol .Lpcrel_hi5>
1392B	  %222:gpr = AUIPC target-flags(riscv-pcrel-hi) @g_17, pre-instr-symbol <mcsymbol .Lpcrel_hi6>
1408B	  %83:gpr = LD %222:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi6> :: (dereferenceable load (s64) from @g_17, !tbaa !9)
1416B	  %80:gpr = LH %221:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi5> :: (dereferenceable load (s16) from @g_144, !tbaa !20)
1424B	  %78:gpr = ADDI $x0, 5
1432B	  SW %78:gpr, %70:gpr, 0 :: (store (s32) into @g_29, !tbaa !19)
1440B	  %84:gpr = LHU %83:gpr, 0 :: (load (s16) from %ir.4, align 4, !tbaa !16)
1448B	  %11:gpr = ADDI %80:gpr, -1
1456B	  SH %11:gpr, %221:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi5> :: (store (s16) into @g_144, !tbaa !20)
1464B	  SH $x0, %73:gpr, 112 :: (store (s16) into `ptr getelementptr inbounds ([8 x [4 x %union.U2]], ptr @g_4, i64 0, i64 7)`, align 4, !tbaa !20)
1472B	  %85:gpr = ANDI %84:gpr, 253
1480B	  %86:gpr = SUBW %11:gpr, %85:gpr
1488B	  %223:gpr = AUIPC target-flags(riscv-pcrel-hi) @g_181, pre-instr-symbol <mcsymbol .Lpcrel_hi7>
1504B	  %88:gpr = SLLI %11:gpr, 48
1512B	  SB %86:gpr, %223:gpr, target-flags(riscv-pcrel-lo) <mcsymbol .Lpcrel_hi7> :: (store (s8) into @g_181, !tbaa !19)
1520B	  BEQ %88:gpr, $x0, %bb.9
1536B	  PseudoBR %bb.8

I guess there is a TBAA bug, but it is not caused by #81313, which causes another miscompilation #82586.

LLVM version: 0e8d187

cc @topperc @RKSimon

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions