[PATCH] D105216: [ScalarEvolution] Fix overflow in computeBECount.

[Mikael Holmén via Phabricator via llvm-commits]

uabelho added a comment.

Hi,

We see a miscompile as well.
It goes wrong for my out of tree target so I don't have a reproducer for an in tree target but maybe some info may help anyway.
I have a function containing the following two nested loops:

  void foo()
  {
      #define MAX 2048
  
      static unsigned a[MAX];
  
      unsigned count = 2;
  
      for (unsigned i = 0; i < MAX; ++i)
      {
          if (a[i] == 0)
          {
              unsigned p = i + i + 3;
              count++;
              for (unsigned j = i; j < MAX; j += p)
              {
                  a[j] = 1;
              }
          }
      }
      assert(count == 565);
  }

With some debug printouts from the compiler I see that before we got the following from SCEV  for the inner loop:

  Exit count: ({2047,+,-1}<%for.body> /u {3,+,2}<nuw><nsw><%for.body>)
  Trip count: (1 + ({2047,+,-1}<%for.body> /u {3,+,2}<nuw><nsw><%for.body>))<nuw><nsw>
  Trip count bound: 16 bits, [1,684)

and with the patch we get

  Exit count: ((((-1 * (1 umin {2045,+,-3}<%for.body>))<nuw><nsw> + {2045,+,-3}<%for.body>) /u {3,+,2}<nuw><nsw><%for.body>) + (1 umin {2045,+,-3}<%for.body>))
  Trip count: (1 + (((-1 * (1 umin {2045,+,-3}<%for.body>))<nuw><nsw> + {2045,+,-3}<%for.body>) /u {3,+,2}<nuw><nsw><%for.body>) + (1 umin {2045,+,-3}<%for.body>))
  Trip count bound: 16 bits, [1,21848)

With some printouts in the outer and inner loop I also see that when i is 682, then something goes wrong for the inner loop and it executes for the following (way too many) j values:

  outer. i: 682
    inner. j: 682
    inner. j: 2049
    inner. j: 3416
    inner. j: 4783
    inner. j: 6150
    [...]
    inner. j: 63564
    inner. j: 64931
    inner. j: 762
  outer. i: 683


Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D105216/new/

https://reviews.llvm.org/D105216