[PATCH] D99328: [SLP] Fix crash in reduction for integer min/max

[Yevgeny Rouban via Phabricator via llvm-commits]

yrouban created this revision.
yrouban added reviewers: lebedev.ri, spatel, vdmitrie, ebrevnov.
Herald added subscribers: javed.absar, hiraditya.
yrouban requested review of this revision.
Herald added a project: LLVM.

The SCEV change https://reviews.llvm.org/rGb46c085d2b6d15873fb53718f0a70b3848e19e4a seems to reveal a new crash in SLPVectorizer.
SLP crashes expecting a //SelectInst// as an externally used value but //umin// call is found.

The patch relaxes the assumption to make the IR flag propagation safe.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D99328

Files:
  llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
  llvm/test/Transforms/SLPVectorizer/slp-umax-rdx-crash.ll


Index: llvm/test/Transforms/SLPVectorizer/slp-umax-rdx-crash.ll
===================================================================
--- /dev/null
+++ llvm/test/Transforms/SLPVectorizer/slp-umax-rdx-crash.ll
@@ -0,0 +1,43 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
+; RUN: opt -slp-vectorizer -S < %s 2>&1| FileCheck %s
+; REQUIRES: asserts
+
+declare i32 @llvm.smin.i32(i32, i32)
+declare i32 @llvm.umin.i32(i32, i32)
+
+; Given LLVM IR caused crash in SLP.
+define void @test() {
+; CHECK-LABEL: @test(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[SMIN0:%.*]] = call i32 @llvm.smin.i32(i32 undef, i32 0)
+; CHECK-NEXT:    [[SMIN1:%.*]] = call i32 @llvm.smin.i32(i32 undef, i32 1)
+; CHECK-NEXT:    [[SMIN2:%.*]] = call i32 @llvm.smin.i32(i32 undef, i32 2)
+; CHECK-NEXT:    [[SMIN3:%.*]] = call i32 @llvm.smin.i32(i32 undef, i32 3)
+; CHECK-NEXT:    [[A:%.*]] = sub nsw i32 undef, [[SMIN0]]
+; CHECK-NEXT:    [[B:%.*]] = sub nsw i32 undef, [[SMIN1]]
+; CHECK-NEXT:    [[C:%.*]] = sub nsw i32 undef, [[SMIN2]]
+; CHECK-NEXT:    [[D:%.*]] = sub nsw i32 undef, [[SMIN3]]
+; CHECK-NEXT:    [[UMIN0:%.*]] = call i32 @llvm.umin.i32(i32 [[D]], i32 [[C]])
+; CHECK-NEXT:    [[UMIN1:%.*]] = call i32 @llvm.umin.i32(i32 [[UMIN0]], i32 [[B]])
+; CHECK-NEXT:    [[UMIN2:%.*]] = call i32 @llvm.umin.i32(i32 [[UMIN1]], i32 [[A]])
+; CHECK-NEXT:    [[UMIN3:%.*]] = call i32 @llvm.umin.i32(i32 [[UMIN2]], i32 77)
+; CHECK-NEXT:    [[E:%.*]] = icmp ugt i32 [[UMIN3]], 1
+; CHECK-NEXT:    ret void
+;
+entry:
+  %smin0 = call i32 @llvm.smin.i32(i32 undef, i32 0)
+  %smin1 = call i32 @llvm.smin.i32(i32 undef, i32 1)
+  %smin2 = call i32 @llvm.smin.i32(i32 undef, i32 2)
+  %smin3 = call i32 @llvm.smin.i32(i32 undef, i32 3)
+  %a = sub nsw i32 undef, %smin0
+  %b = sub nsw i32 undef, %smin1
+  %c = sub nsw i32 undef, %smin2
+  %d = sub nsw i32 undef, %smin3
+  %umin0 = call i32 @llvm.umin.i32(i32 %d, i32 %c)
+  %umin1 = call i32 @llvm.umin.i32(i32 %umin0, i32 %b)
+  %umin2 = call i32 @llvm.umin.i32(i32 %umin1, i32 %a)
+  %umin3 = call i32 @llvm.umin.i32(i32 %umin2, i32 77)
+  %e = icmp ugt i32 %umin3, 1
+  ret void
+}
+
Index: llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
===================================================================
--- llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
+++ llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp
@@ -6631,10 +6631,9 @@
                          Value *RHS, const Twine &Name, Instruction *I) {
     Value *Op = createOp(Builder, RdxKind, LHS, RHS, Name);
     if (RecurrenceDescriptor::isIntMinMaxRecurrenceKind(RdxKind)) {
-      if (auto *Sel = dyn_cast<SelectInst>(Op)) {
-        propagateIRFlags(Sel->getCondition(),
-                         cast<SelectInst>(I)->getCondition());
-      }
+      if (auto *Sel = dyn_cast<SelectInst>(Op))
+        if (auto *SelI = dyn_cast<SelectInst>(I))
+          propagateIRFlags(Sel->getCondition(), SelI->getCondition());
     }
     propagateIRFlags(Op, I);
     return Op;


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D99328.333255.patch
Type: text/x-patch
Size: 2996 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20210325/0bd5086f/attachment.bin>