[llvm-bugs] [Bug 42557] New: newgvn assertion BeforeCC->isEquivalentTo(AfterCC) && "Value number changed after main loop completed!

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=42557

            Bug ID: 42557
           Summary: newgvn assertion BeforeCC->isEquivalentTo(AfterCC) &&
                    "Value number changed after main loop completed!
           Product: libraries
           Version: trunk
          Hardware: PC
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: Scalar Optimizations
          Assignee: unassignedbugs at nondot.org
          Reporter: nick at wasmer.io
                CC: llvm-bugs at lists.llvm.org

This testcase is reduced out of sqlite.

$ cat c.ll
; ModuleID = '<stdin>'
source_filename = "module"
target triple = "x86_64-apple-darwin18.6.0"

declare void @use1(i1)
declare i1 @get1()

define void @hoge(i32 %tmp6) {
bb:
  %A = call i1 @get1()
  %B = call i1 @get1()
  br label %bb1

bb1:                                              ; preds = %bb1, %bb
  %tmp = phi i32 [ 0, %bb ], [ %tmp6, %bb1 ]
  br i1 %A, label %bb2, label %bb1

bb2:                                              ; preds = %bb1
  br i1 %B, label %bb16, label %bb11

bb16:                                             ; preds = %bb2
  %tmp17 = add i32 %tmp, 1
  br label %bb11

bb11:                                             ; preds = %bb16, %bb2
  %tmp12 = phi i32 [ %tmp17, %bb16 ], [ 0, %bb2 ]
  %tmp13 = icmp eq i32 %tmp12, 0
  call void @use1(i1 %tmp13)
  %tmp15 = icmp ne i32 %tmp, 0
  br i1 %tmp15, label %bb18, label %bb19

bb18:                                             ; preds = %bb11
  br label %bb19

bb19:                                             ; preds = %bb18, %bb11
  %tmp20 = phi i32 [ %tmp12, %bb11 ], [ 1, %bb18 ]
  %tmp21 = icmp eq i32 %tmp20, 0
  call void @use1(i1 %tmp21)
  ret void
}
$ opt -newgvn c.ll
Assertion failed: (BeforeCC->isEquivalentTo(AfterCC) && "Value number changed
after main loop completed!"), function verifyIterationSettled, file
/Users/nicklewycky/llvm-project/llvm/lib/Transforms/Scalar/NewGVN.cpp, line
3305.
Stack dump:
0.      Program arguments: llvm-head/bin/opt -newgvn c.ll -debug 
1.      Running pass 'Function Pass Manager' on module 'c.ll'.
2.      Running pass 'Global Value Numbering' on function '@hoge'
0  opt                      0x0000000107fdc74c
llvm::sys::PrintStackTrace(llvm::raw_ostream&) + 60
1  opt                      0x0000000107fdccd9
PrintStackTraceSignalHandler(void*) + 25
2  opt                      0x0000000107fdaa26 llvm::sys::RunSignalHandlers() +
118
3  opt                      0x0000000107fdfc22 SignalHandler(int) + 210
4  libsystem_platform.dylib 0x00007fff7148ab5d _sigtramp + 29
5  opt                      0x000000010a524b98
llvm::DenseMapInfo<llvm::codeview::GloballyHashedType>::Tombstone + 2160352
6  libsystem_c.dylib        0x00007fff713446a6 abort + 127
7  libsystem_c.dylib        0x00007fff7130d20d basename_r + 0
8  opt                      0x0000000107c68587 (anonymous
namespace)::NewGVN::verifyIterationSettled(llvm::Function&) + 1639
9  opt                      0x0000000107c5aa78 (anonymous
namespace)::NewGVN::runGVN() + 1624
10 opt                      0x0000000107c5fc27 (anonymous
namespace)::NewGVNLegacyPass::runOnFunction(llvm::Function&) + 327
11 opt                      0x000000010720e359
llvm::FPPassManager::runOnFunction(llvm::Function&) + 681
12 opt                      0x000000010720e96f
llvm::FPPassManager::runOnModule(llvm::Module&) + 175
13 opt                      0x000000010720f0f5 (anonymous
namespace)::MPPassManager::runOnModule(llvm::Module&) + 789
14 opt                      0x000000010720ec15
llvm::legacy::PassManagerImpl::run(llvm::Module&) + 293
15 opt                      0x000000010720f711
llvm::legacy::PassManager::run(llvm::Module&) + 33
16 opt                      0x00000001047d6200 main + 10880
17 libdyld.dylib            0x00007fff7129f3d5 start + 1
18 libdyld.dylib            0x0000000000000004 start + 18446603338617588784

In the final round, newgvn decides that %tmp21's leader is "i1 false", while in
the verification comparison round it does not. The congruence classes only have
one member, %tmp21.

However, this is incorrect, there is a path where %tmp21 could equal true, when
%A is true and %B is false (and %tmp6 doesn't matter). Then %tmp = i32 0, we go
to 
%bb11, %tmp12 = i32 0, %tmp15 = i1 false, go to %bb19 directly, %tmp20 = i32 0,
%tmp21 = i1 true.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20190709/b7ee94d3/attachment.html>