Loading/storing float/double on 32-bit x86 without SSE can cause the value to mutate

[beetrees]

In LLVM IR, it is valid to transform

%x = load i32, ptr %0
store i32 %x, ptr %1

into

%x = load float, ptr %0
store float %x, ptr %1

(alive2)

However, the 32-bit x86 backend will (when SSE is disabled) miscompile the second example:

fld     dword ptr [ecx]
fstp    dword ptr [eax]

(comparison)

This is a miscompilation as the fld/fstp instructions will convert bit patterns that are signalling NaNs to quiet NaNs (e.g. 0xff800001 -> 0xffc00001).

This can cause miscompilations like this one, where the optimiser replaced an integer load/store with a float load/store, ultimately resulting in a segfault.

Related to #44218.

[llvmbot]

@llvm/issue-subscribers-backend-x86

Author: None (beetrees)

In LLVM IR, it is valid to transform ```llvm %x = load i32, ptr %0 store i32 %x, ptr %1 ```

into

%x = load float, ptr %0
store float %x, ptr %1

(alive2)

However, the 32-bit x86 backend will (when SSE is disabled) miscompile the second example:

fld     dword ptr [ecx]
fstp    dword ptr [eax]

(comparison)

This is a miscompilation as the fld/fstp instructions will convert bit patterns that are signalling NaNs to quiet NaNs (e.g. 0xff800001 -> 0xffc00001).

This can cause miscompilations like this one, where the optimiser replaced an integer load/store with a float load/store, ultimately resulting in a segfault.

Related to #44218.

[efriedma-quic]

Duplicate of #44497