[PATCH] D101291: [IndVars] avoid crash in LFTR when assuming an add recurrence

[Sanjay Patel via Phabricator via llvm-commits]

spatel created this revision.
spatel added reviewers: nikic, lebedev.ri, fhahn, reames.
Herald added subscribers: javed.absar, hiraditya, mcrosier.
spatel requested review of this revision.
Herald added a project: LLVM.

The test is a crasher reduced from:
https://llvm.org/PR49993

I don't know IndVars / SCEV well enough to say if this fix is sufficient. Also, I didn't see an obvious recursion limit to explain why we need 10 `urem` instructions to trigger, but removing any of those avoids the bug.


https://reviews.llvm.org/D101291

Files:
  llvm/lib/Transforms/Scalar/IndVarSimplify.cpp
  llvm/test/Transforms/IndVarSimplify/lftr.ll


Index: llvm/test/Transforms/IndVarSimplify/lftr.ll
===================================================================
--- llvm/test/Transforms/IndVarSimplify/lftr.ll
+++ llvm/test/Transforms/IndVarSimplify/lftr.ll
@@ -657,6 +657,58 @@
   ret void
 }
 
+define void @PR49993() {
+; CHECK-LABEL: @PR49993(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    br label [[IF_END:%.*]]
+; CHECK:       d:
+; CHECK-NEXT:    [[PHI:%.*]] = phi i32 [ [[ADD:%.*]], [[D:%.*]] ], [ [[REM10:%.*]], [[IF_END]] ]
+; CHECK-NEXT:    [[ADD]] = add nsw i32 [[PHI]], 1
+; CHECK-NEXT:    [[SMAX:%.*]] = call i32 @llvm.smax.i32(i32 [[REM10]], i32 3)
+; CHECK-NEXT:    [[TMP0:%.*]] = sub i32 [[SMAX]], [[TMP4:%.*]]
+; CHECK-NEXT:    [[TMP1:%.*]] = add i32 [[REM10]], [[TMP0]]
+; CHECK-NEXT:    [[TMP2:%.*]] = add i32 [[TMP1]], 1
+; CHECK-NEXT:    [[EXITCOND:%.*]] = icmp ne i32 [[ADD]], [[TMP2]]
+; CHECK-NEXT:    br i1 [[EXITCOND]], label [[D]], label [[IF_END_LOOPEXIT:%.*]]
+; CHECK:       if.end.loopexit:
+; CHECK-NEXT:    br label [[IF_END]]
+; CHECK:       if.end:
+; CHECK-NEXT:    [[REM1:%.*]] = urem i32 undef, undef
+; CHECK-NEXT:    [[REM2:%.*]] = urem i32 [[REM1]], undef
+; CHECK-NEXT:    [[REM3:%.*]] = urem i32 [[REM2]], undef
+; CHECK-NEXT:    [[REM4:%.*]] = urem i32 [[REM3]], undef
+; CHECK-NEXT:    [[REM5:%.*]] = urem i32 [[REM4]], undef
+; CHECK-NEXT:    [[REM6:%.*]] = urem i32 [[REM5]], undef
+; CHECK-NEXT:    [[REM7:%.*]] = urem i32 [[REM6]], undef
+; CHECK-NEXT:    [[REM8:%.*]] = urem i32 [[REM7]], undef
+; CHECK-NEXT:    [[REM9:%.*]] = urem i32 [[REM8]], undef
+; CHECK-NEXT:    [[REM10]] = urem i32 [[REM9]], undef
+; CHECK-NEXT:    [[TMP3:%.*]] = sub i32 0, [[REM10]]
+; CHECK-NEXT:    [[TMP4]] = mul i32 [[TMP3]], -1
+; CHECK-NEXT:    br label [[D]]
+;
+entry:
+  br label %if.end
+
+d:
+  %phi = phi i32 [ %add, %d ], [ %rem10, %if.end ]
+  %add = add nsw i32 %phi, 1
+  %cmp = icmp slt i32 %phi, 3
+  br i1 %cmp, label %d, label %if.end
+
+if.end:
+  %rem1 = urem i32 undef, undef
+  %rem2 = urem i32 %rem1, undef
+  %rem3 = urem i32 %rem2, undef
+  %rem4 = urem i32 %rem3, undef
+  %rem5 = urem i32 %rem4, undef
+  %rem6 = urem i32 %rem5, undef
+  %rem7 = urem i32 %rem6, undef
+  %rem8 = urem i32 %rem7, undef
+  %rem9 = urem i32 %rem8, undef
+  %rem10 = urem i32 %rem9, undef
+  br label %d
+}
 
 declare i32 @llvm.loop.decrement.reg.i32(i32, i32)
 
Index: llvm/lib/Transforms/Scalar/IndVarSimplify.cpp
===================================================================
--- llvm/lib/Transforms/Scalar/IndVarSimplify.cpp
+++ llvm/lib/Transforms/Scalar/IndVarSimplify.cpp
@@ -1103,11 +1103,12 @@
   // not covered by the post-inc addrec. (If the new IV was not dynamically
   // dead, it could not be poison on the first iteration in the first place.)
   if (auto *BO = dyn_cast<BinaryOperator>(IncVar)) {
-    const SCEVAddRecExpr *AR = cast<SCEVAddRecExpr>(SE->getSCEV(IncVar));
-    if (BO->hasNoUnsignedWrap())
-      BO->setHasNoUnsignedWrap(AR->hasNoUnsignedWrap());
-    if (BO->hasNoSignedWrap())
-      BO->setHasNoSignedWrap(AR->hasNoSignedWrap());
+    if (auto *AR = dyn_cast<SCEVAddRecExpr>(SE->getSCEV(IncVar))) {
+      if (BO->hasNoUnsignedWrap())
+        BO->setHasNoUnsignedWrap(AR->hasNoUnsignedWrap());
+      if (BO->hasNoSignedWrap())
+        BO->setHasNoSignedWrap(AR->hasNoSignedWrap());
+    }
   }
 
   Value *ExitCnt = genLoopLimit(


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D101291.340495.patch
Type: text/x-patch
Size: 3365 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20210426/6f604b69/attachment.bin>