llvm opt -O3 fail (?)

问题

I need to identify integer variables which behave like boolean variables, that is, they can only have the values 0 or 1. For that purpose, I modified the llvm bitcode to add an equivalent instruction to:

int tmp = someVar*(someVar-1);

Hoping that agressive O3 optimizations will identify tmp as being the constant value 0. Here is a C version of the code I used:

int should_expand(char *s)
{
    int tmp = 0;
    int ret = 0;
    char *p = s;

    if (p && *p == '&')
    {
        ret = 1;
    }
    tmp = ret * (ret - 1);
    return tmp;
}

When I examine the *.ll file I see that almighty clang 6.0.0 failed to realize tmp is actually 0:

define i32 @should_expand(i8* readonly %s) local_unnamed_addr #0 {
entry:
  %tobool = icmp eq i8* %s, null
  br i1 %tobool, label %if.end, label %land.lhs.true

land.lhs.true:                                    ; preds = %entry
  %tmp = load i8, i8* %s, align 1, !tbaa !2
  %cmp = icmp eq i8 %tmp, 38
  %spec.select = zext i1 %cmp to i32
  br label %if.end

if.end:                                           ; preds = %land.lhs.true, %entry
  %ret.0 = phi i32 [ 0, %entry ], [ %spec.select, %land.lhs.true ]
  %sub = add nsw i32 %ret.0, -1
  %tmp1 = sub nsw i32 0, %ret.0
  %mul = and i32 %sub, %tmp1
  ret i32 %mul
}

Does that make sense? are there any external static analyzers I can use, that inter-operate smoothly with clang? or any other trick I can use? Thanks a lot!

来源：https://stackoverflow.com/questions/53533500/llvm-opt-o3-fail