opt -O3 removes memove initialiser

[demoitem]

The following program has its local var initializer of the Work function removed at -O3 by opt. Using opt-bisect it looks like the DSE pass is the culprit.

; ModuleID = 'Main.mb'
source_filename = "../Main.m3"
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-pc-linux-gnu"

%M_Const_struct = type { [7 x i8], [1 x i8], [4 x i8], [1 x i8], [10 x i8], [1 x i8], ptr, ptr, ptr, ptr, ptr, ptr, [8 x i8], [10 x i8], [6 x i8] }
%M_Main_struct = type { ptr, [32 x i8], ptr, [24 x i8], ptr, [8 x i8], ptr, i64, [8 x i8], ptr, ptr, [8 x i8], ptr, ptr, [8 x i8], ptr, ptr, [8 x i8], ptr, ptr, [8 x i8], ptr, ptr, [8 x i8], ptr, ptr, [8 x i8], ptr, [8 x i8] }
%struct.0 = type { [16 x i8] }

@M_Const = internal constant %M_Const_struct { [7 x i8] c"Main_M3", [1 x i8] zeroinitializer, [4 x i8] c"Work", [1 x i8] zeroinitializer, [10 x i8] c"DisplayArr", [1 x i8] zeroinitializer, ptr @Main_M3, ptr @M_Const, ptr @Main__Work, ptr getelementptr inbounds (i8, ptr @M_Const, i64 8), ptr @Main__DisplayArr, ptr getelementptr inbounds (i8, ptr @M_Const, i64 13), [8 x i8] zeroinitializer, [10 x i8] c"../Main.m3", [6 x i8] zeroinitializer }, align 8
@M_Main = internal global %M_Main_struct { ptr getelementptr inbounds (i8, ptr @M_Const, i64 80), [32 x i8] zeroinitializer, ptr getelementptr inbounds (i8, ptr @M_Const, i64 24), [24 x i8] zeroinitializer, ptr getelementptr inbounds (i8, ptr @M_Main, i64 104), [8 x i8] zeroinitializer, ptr @Main_M3, i64 3, [8 x i8] zeroinitializer, ptr @Main_I3, ptr getelementptr inbounds (i8, ptr @M_Main, i64 128), [8 x i8] zeroinitializer, ptr @Remote_I3, ptr getelementptr inbounds (i8, ptr @M_Main, i64 152), [8 x i8] zeroinitializer, ptr @Wr_I3, ptr getelementptr inbounds (i8, ptr @M_Main, i64 176), [8 x i8] zeroinitializer, ptr @Thread_I3, ptr getelementptr inbounds (i8, ptr @M_Main, i64 200), [8 x i8] zeroinitializer, ptr @Stdio_I3, ptr getelementptr inbounds (i8, ptr @M_Main, i64 224), [8 x i8] zeroinitializer, ptr @Fmt_I3, ptr getelementptr inbounds (i8, ptr @M_Main, i64 248), [8 x i8] zeroinitializer, ptr @RTHooks_I3, [8 x i8] zeroinitializer }, align 8
@m3_jmpbuf_size = external global i64, align 8

declare ptr @__m3_personality_v0()

declare ptr @Main_I3()

declare ptr @Remote_I3()

declare ptr @Wr_I3()

declare ptr @Thread_I3()

declare ptr @Stdio_I3()

declare ptr @Fmt_I3()

declare ptr @RTHooks_I3()

define void @Main__DisplayArr(ptr byval(%struct.0) align 8 %Val) #0 {
entry:
  %tmp.13 = alloca %struct.0, align 8
  %tmp.18 = alloca ptr, align 8
  %tmp.21 = alloca ptr, align 8
  br label %second

second:                                           ; preds = %entry
  br label %label_1_

label_1_:                                         ; preds = %second
  %store_dest = getelementptr inbounds i8, ptr %tmp.13, i64 8
  store volatile i64 5, ptr %store_dest, align 8
  call void @RTHooks__PushEFrame(ptr %tmp.13)
  %v.2 = load volatile ptr, ptr getelementptr inbounds (i8, ptr @M_Main, i64 200), align 8
  %load_ind = getelementptr inbounds i8, ptr %v.2, i64 112
  %load_ind1 = load volatile ptr, ptr %load_ind, align 8
  store volatile ptr %load_ind1, ptr %tmp.18, align 8
  %v.18 = load volatile ptr, ptr %tmp.18, align 8
  %icmp = icmp eq ptr null, %v.18
  br i1 %icmp, label %if_2, label %else_2

else_2:                                           ; preds = %label_1_
  %v.182 = load ptr, ptr %tmp.18, align 8
  %loophole-addr_word = ptrtoint ptr %v.182 to i64
  %and = and i64 %loophole-addr_word, 1
  %icmp3 = icmp ne i64 %and, 0
  br i1 %icmp3, label %if_2, label %else_24

else_24:                                          ; preds = %else_2
  %v.185 = load ptr, ptr %tmp.18, align 8
  %load_ind6 = getelementptr inbounds i8, ptr %v.185, i64 -8
  %load_ind7 = load i64, ptr %load_ind6, align 8
  %eshl = shl i64 %load_ind7, 41
  %eshr = lshr i64 %eshl, 63
  %icmp8 = icmp eq i64 %eshr, 0
  br i1 %icmp8, label %if_2, label %else_29

else_29:                                          ; preds = %else_24
  %v.1810 = load ptr, ptr %tmp.18, align 8
  call void @RTHooks__CheckLoadTracedRef(ptr %v.1810)
  br label %if_2

if_2:                                             ; preds = %else_29, %else_24, %else_2, %label_1_
  %v.11 = load i64, ptr %Val, align 8
  %result = call ptr @Fmt__Int(i64 %v.11, i8 10)
  store ptr %result, ptr %tmp.21, align 8
  %v.1811 = load ptr, ptr %tmp.18, align 8
  %v.21 = load ptr, ptr %tmp.21, align 8
  call void @Wr__PutText(ptr %v.1811, ptr %v.21)
  %v.212 = load ptr, ptr getelementptr inbounds (i8, ptr @M_Main, i64 200), align 8
  %load_ind13 = getelementptr inbounds i8, ptr %v.212, i64 112
  %load_ind14 = load ptr, ptr %load_ind13, align 8
  store ptr %load_ind14, ptr %tmp.21, align 8
  %v.2115 = load ptr, ptr %tmp.21, align 8
  %icmp16 = icmp eq ptr null, %v.2115
  br i1 %icmp16, label %if_3, label %else_3

else_3:                                           ; preds = %if_2
  %v.2117 = load ptr, ptr %tmp.21, align 8
  %loophole-addr_word18 = ptrtoint ptr %v.2117 to i64
  %and19 = and i64 %loophole-addr_word18, 1
  %icmp20 = icmp ne i64 %and19, 0
  br i1 %icmp20, label %if_3, label %else_321

else_321:                                         ; preds = %else_3
  %v.2122 = load ptr, ptr %tmp.21, align 8
  %load_ind23 = getelementptr inbounds i8, ptr %v.2122, i64 -8
  %load_ind24 = load i64, ptr %load_ind23, align 8
  %eshl25 = shl i64 %load_ind24, 41
  %eshr26 = lshr i64 %eshl25, 63
  %icmp27 = icmp eq i64 %eshr26, 0
  br i1 %icmp27, label %if_3, label %else_328

else_328:                                         ; preds = %else_321
  %v.2129 = load ptr, ptr %tmp.21, align 8
  call void @RTHooks__CheckLoadTracedRef(ptr %v.2129)
  br label %if_3

if_3:                                             ; preds = %else_328, %else_321, %else_3, %if_2
  %load_dest = getelementptr inbounds i8, ptr %Val, i64 8
  %v.1130 = load i64, ptr %load_dest, align 8
  %result31 = call ptr @Fmt__Int(i64 %v.1130, i8 10)
  store ptr %result31, ptr %tmp.18, align 8
  %v.2132 = load ptr, ptr %tmp.21, align 8
  %v.1833 = load ptr, ptr %tmp.18, align 8
  call void @Wr__PutText(ptr %v.2132, ptr %v.1833)
  br label %label_4_

label_4_:                                         ; preds = %if_3
  %v.13 = load volatile ptr, ptr %tmp.13, align 8
  call void @RTHooks__PopEFrame(ptr %v.13)
  ret void
}

declare void @RTHooks__PushEFrame(ptr) #0

declare ptr @alloca()

declare void @RTHooks__CheckLoadTracedRef(ptr) #0

declare ptr @Fmt__Int(i64, i8) #0

declare void @Wr__PutText(ptr, ptr) #0

declare void @RTHooks__PopEFrame(ptr) #0

define void @Main__Work() #0 {
entry:
  %AC = alloca %struct.0, align 8
  br label %second

second:                                           ; preds = %entry
  %v.2 = load ptr, ptr getelementptr inbounds (i8, ptr @M_Main, i64 128), align 8
  %load_ind = getelementptr inbounds i8, ptr %v.2, i64 120
  %load_ind1 = load ptr, ptr %load_ind, align 8
  call void @llvm.memmove.p0.p0.i64(ptr align 8 %AC, ptr align 8 %load_ind1, i64 16, i1 false)
  call void @Main__DisplayArr(ptr %AC)
  ret void
}

; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memmove.p0.p0.i64(ptr nocapture writeonly, ptr nocapture readonly, i64, i1 immarg) #1

define ptr @Main_M3(i64 %mode) #0 {
entry:
  %mode1 = alloca i64, align 8
  store i64 %mode, ptr %mode1, align 8
  br label %second

second:                                           ; preds = %entry
  %v.3 = load i64, ptr %mode1, align 8
  %icmp = icmp eq i64 %v.3, 0
  br i1 %icmp, label %if_5, label %else_5

else_5:                                           ; preds = %second
  call void @Main__Work()
  br label %if_5

if_5:                                             ; preds = %else_5, %second
  ret ptr @M_Main
}

attributes #0 = { "target-features"="+fxsr,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }
attributes #1 = { nocallback nofree nounwind willreturn memory(argmem: readwrite) }

!llvm.ident = !{!0}

!0 = !{!"versions- cm3: d5.11.9 llvm: 20.0.0git"}

[nikic]

Your IR has an ABI mismatch: The Main__DisplayArr argument is byval, but the attribute is missing on the call-site.

[nikic]

Reduced:

; RUN: opt -S -passes=dse < %s
%struct.0 = type { [16 x i8] }

declare void @Main__DisplayArr(ptr byval(%struct.0) align 8)

define void @Main__Work(ptr %p) {
entry:
  %AC = alloca %struct.0, align 8
  call void @llvm.memcpy.p0.p0.i64(ptr %AC, ptr %p, i64 16, i1 false)
  tail call void @Main__DisplayArr(ptr %AC)
  ret void
}

It's related to this code:

llvm-project/llvm/lib/Analysis/BasicAliasAnalysis.cpp

Lines 928 to 937 in fe1c4f0

	// Calls marked 'tail' cannot read or write allocas from the current frame
	// because the current frame might be destroyed by the time they run. However,
	// a tail call may use an alloca with byval. Calling with byval copies the
	// contents of the alloca into argument registers or stack slots, so there is
	// no lifetime issue.
	if (isa<AllocaInst>(Object))
	if (const CallInst *CI = dyn_cast<CallInst>(Call))
	if (CI->isTailCall() &&
	!CI->getAttributes().hasAttrSomewhere(Attribute::ByVal))
	return ModRefInfo::NoModRef;

In any case, the input is UB.

[demoitem]

Okay, thanks. That was quick. I've added the callsite attribute and it works properly. I had it on indirect
calls but not for direct for some reason. I never had a warning or error from the verifier and assumed it
wasn't needed.

[nikic]

The verifier wouldn't report this (because it's not malformed, only UB), but it looks like the linter doesn't either, but probably should...