Skip to content

propagate constraints during copying #35

Closed

Description

@graydon

Copying from one slot to another should add a copy of every constraint that
includes the RHS of the assignment to the copy postcondition (with the RHS
renamed, in the constraint, to the new LHS slot).

In other words:

let int x = 10;
let int y = 11;
check lt(x,y); // postcond = { lt(x,y) }
let int z = x; // postcond = { lt(x,y), lt(z,y) }

Unless some horrible complications arise that make this impossible, I believe
the current rules permit this propagation to work.

Activity

  1. graydon commented on Jan 27, 2011

    @graydon
    ContributorAuthor

    Shifted to rustc

  2. catamorphism commented on Jul 9, 2011

    @catamorphism
    Contributor

    Fixed in 182c413

  3. added a commit that references this issue on Dec 12, 2017
  4. added a commit that references this issue on Nov 29, 2018
  5. added a commit that references this issue on Jan 19, 2019
    bdcd161
  6. added a commit that references this issue on Dec 9, 2021
    59e671a
  7. added 2 commits that reference this issue on Dec 4, 2023
  8. added a commit that references this issue on Dec 5, 2023
  9. added a commit that references this issue on Dec 5, 2023
  10. jsloan-red-button commented on Apr 25, 2026

    @jsloan-red-button

    Phase 2b RCA update (2026-04-25): The bug pattern reported here ('LLVM SH4 tail-call-opt drops arg-setup across extern "C"') is not a tail-call-opt issue. Phase 2b SDAG capture identified the root cause as our own SuperHFixupCallClobber.cpp post-PEI peephole pass.

    The pass walks backwards from each JSR @rN looking for a MOV32PCR that defined $rN and, if it sees an intervening def of $rN (a 'clobber'), inserts a fresh $r1 = MOV32PCR <CPI> before the JSR and rewrites the JSR target to $r1. The flaw: it doesn't bail on intervening kills of $rN. If an unrelated MOV32PCR loaded a static-global address into $rN, that address was used+killed by an immediate consumer (e.g., another MOV32mr), and $rN was later reused as a legitimate JSR-target carrier (e.g., $r0 = MOV32mrd $r14, 0 for a stack-spilled fn-ptr), the pass mis-identifies the unrelated MOV32PCR as the JSR's source and rewrites the JSR target to load the unrelated global address.

    In the relibc_start_v1 main() call site this manifested as: $r5 silently aliased to *(&environ) (CSE-collapse against the prior environ load) and JSR @r1 jumping to literal &argv (.bss).

    Fix: bail when the backward walk sees a killed $CallReg USE — the kill flag marks the last use of the value held in CallReg from its previous def; any earlier MOV32PCR was meant for that consumer, not for the JSR. Lands in rustx-sh4 v4.4.63. Phase 2b artifacts: /var/tmp/sh4-issue18-phase2/. Arbiter contract #44.

  11. added a commit that references this issue on Sep 3, 2026
  12. added a commit that references this issue on Oct 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions