[PATCH] D48599: SCEVExpander::expandAddRecExprLiterally(): check before casting as Instruction

[Roman Lebedev via Phabricator via llvm-commits]

lebedev.ri created this revision.
lebedev.ri added reviewers: mkazantsev, uabelho, sanjoy, silviu.baranga, wmi.
Herald added a subscriber: javed.absar.

An alternative to https://reviews.llvm.org/D48597.
Fixes PR37936 <https://bugs.llvm.org/show_bug.cgi?id=37936>.

The problem is as follows:

1. `indvars` marks `%dec` as `NUW`.
2. `loop-instsimplify` runs `instsimplify`, which constant-folds `%dec` to -1 (https://reviews.llvm.org/D47908)
3. `loop-reduce` tries to do some further modification, but crashes with an type assertion in cast, because `%dec` is no longer an `Instruction`,

If the runline is split into two, i.e. you first run `-indvars -loop-instsimplify`,
store that into a file, and then run `-loop-reduce`, there is no crash.

So it looks like the problem is due to `-loop-instsimplify` not discarding SCEV.
But in this case we can just not crash if it's not an `Instruction`.
This is just a local fix, unlike https://reviews.llvm.org/D48597, so there may very well be other problems.


Repository:
  rL LLVM

https://reviews.llvm.org/D48599

Files:
  lib/Analysis/ScalarEvolutionExpander.cpp
  test/Transforms/LoopStrengthReduce/scev-after-loopinstsimplify.ll


Index: test/Transforms/LoopStrengthReduce/scev-after-loopinstsimplify.ll
===================================================================
--- /dev/null
+++ test/Transforms/LoopStrengthReduce/scev-after-loopinstsimplify.ll
@@ -0,0 +1,43 @@
+; RUN: opt %s -indvars -loop-instsimplify -loop-reduce
+; We are only checking that there is no crash!
+
+; https://bugs.llvm.org/show_bug.cgi?id=37936
+
+; The problem is as follows:
+; 1. indvars marks %dec as NUW.
+; 2. loop-instsimplify runs instsimplify, which constant-folds %dec to -1
+; 3. loop-reduce tries to do some further modification, but crashes
+;    with an type assertion in cast, because %dec is no longer an Instruction,
+;    even though the SCEV data indicated it was.
+
+; If the runline is split into two, i.e. -indvars -loop-instsimplify first, that
+; stored into a file, and then -loop-reduce is run on that, there is no crash.
+; So it looks like the problem is due to -loop-instsimplify not discarding SCEV.
+
+target datalayout = "n16"
+
+ at a = external global i16, align 1
+
+define void @f1() {
+entry:
+  br label %for.cond
+
+for.cond:                                         ; preds = %land.end, %entry
+  %c.0 = phi i16 [ 0, %entry ], [ %dec, %land.end ]
+  br i1 undef, label %for.body, label %for.cond.cleanup
+
+for.cond.cleanup:                                 ; preds = %for.cond
+  ret void
+
+for.body:                                         ; preds = %for.cond
+  %0 = load i16, i16* @a, align 1
+  %cmp = icmp sgt i16 %0, %c.0
+  br i1 %cmp, label %land.rhs, label %land.end
+
+land.rhs:                                         ; preds = %for.body
+  unreachable
+
+land.end:                                         ; preds = %for.body
+  %dec = add nsw i16 %c.0, -1
+  br label %for.cond
+}
Index: lib/Analysis/ScalarEvolutionExpander.cpp
===================================================================
--- lib/Analysis/ScalarEvolutionExpander.cpp
+++ lib/Analysis/ScalarEvolutionExpander.cpp
@@ -1169,8 +1169,10 @@
       if (!IsMatchingSCEV && !TryNonMatchingSCEV)
           continue;
 
-      Instruction *TempIncV =
-          cast<Instruction>(PN.getIncomingValueForBlock(LatchBlock));
+      Value *IncomingValue = PN.getIncomingValueForBlock(LatchBlock);
+      if (!isa<Instruction>(IncomingValue))
+        continue;
+      Instruction *TempIncV = cast<Instruction>(IncomingValue);
 
       // Check whether we can reuse this PHI node.
       if (LSRMode) {


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D48599.152916.patch
Type: text/x-patch
Size: 2461 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20180626/43c05d4d/attachment.bin>