[llvm] ccf788a - [IRCE] Drop SCEV of a Phi after adding a new input. PR57335

[Max Kazantsev via llvm-commits]

Author: Max Kazantsev
Date: 2022-08-25T18:14:29+07:00
New Revision: ccf788a5659430571d5970dfc766b235e413dde2

URL: https://github.com/llvm/llvm-project/commit/ccf788a5659430571d5970dfc766b235e413dde2
DIFF: https://github.com/llvm/llvm-project/commit/ccf788a5659430571d5970dfc766b235e413dde2.diff

LOG: [IRCE] Drop SCEV of a Phi after adding a new input. PR57335

Since SCEV learned to look through single value phis with
20d798bd47ec5191de1b2a8a031da06a04e612e1, whenever we add
a new input to a Phi, we should make sure that the old cached
value is dropped. Otherwise, it may lead to various miscompiles,
such as breach of dominance as shown in the bug
https://github.com/llvm/llvm-project/issues/57335

Added: 
    llvm/test/Transforms/IRCE/pr57335.ll

Modified: 
    llvm/lib/Transforms/Scalar/InductiveRangeCheckElimination.cpp

Removed: 
    


################################################################################
diff  --git a/llvm/lib/Transforms/Scalar/InductiveRangeCheckElimination.cpp b/llvm/lib/Transforms/Scalar/InductiveRangeCheckElimination.cpp
index b907c37a23b71..9d18f32a5960c 100644
--- a/llvm/lib/Transforms/Scalar/InductiveRangeCheckElimination.cpp
+++ b/llvm/lib/Transforms/Scalar/InductiveRangeCheckElimination.cpp
@@ -1184,6 +1184,7 @@ void LoopConstrainer::cloneLoop(LoopConstrainer::ClonedLoop &Result,
       for (PHINode &PN : SBB->phis()) {
         Value *OldIncoming = PN.getIncomingValueForBlock(OriginalBB);
         PN.addIncoming(GetClonedValue(OldIncoming), ClonedBB);
+        SE.forgetValue(&PN);
       }
     }
   }

diff  --git a/llvm/test/Transforms/IRCE/pr57335.ll b/llvm/test/Transforms/IRCE/pr57335.ll
new file mode 100644
index 0000000000000..1fadbfb0b3eba
--- /dev/null
+++ b/llvm/test/Transforms/IRCE/pr57335.ll
@@ -0,0 +1,72 @@
+; RUN: opt -irce -S < %s 2>&1 | FileCheck %s
+; RUN: opt -passes=irce -S < %s 2>&1 | FileCheck %s
+; RUN: opt -passes='require<branch-prob>,irce' -S < %s 2>&1 | FileCheck %s
+
+; Make sure we don't crash.
+define void @test() {
+; CHECK-LABEL: test
+bb:
+  %tmp = icmp ult i32 0, undef
+  br i1 %tmp, label %bb1, label %bb31
+
+bb1:                                              ; preds = %bb
+  br label %bb5
+
+bb2:                                              ; preds = %bb20
+  %tmp3 = phi i32 [ %tmp21, %bb20 ]
+  %tmp4 = add nuw nsw i32 %tmp3, 100
+  br label %bb5
+
+bb5:                                              ; preds = %bb2, %bb1
+  %tmp6 = phi i32 [ 102, %bb1 ], [ %tmp4, %bb2 ]
+  %tmp7 = phi i32 [ 2, %bb1 ], [ %tmp3, %bb2 ]
+  br label %bb12
+
+bb8:                                              ; preds = %bb12
+  %tmp9 = phi i32 [ %tmp14, %bb12 ]
+  %tmp10 = add nsw i32 %tmp9, -1
+  %tmp11 = icmp ult i32 %tmp10, undef
+  br i1 %tmp11, label %bb12, label %bb32
+
+bb12:                                             ; preds = %bb8, %bb5
+  %tmp13 = phi i32 [ 1, %bb5 ], [ %tmp9, %bb8 ]
+  %tmp14 = add nuw nsw i32 %tmp13, 1
+  %tmp15 = load atomic i32, i32 addrspace(1)* undef unordered, align 8
+  %tmp16 = icmp ult i32 %tmp14, %tmp6
+  br i1 %tmp16, label %bb8, label %bb17
+
+bb17:                                             ; preds = %bb12
+  %tmp18 = phi i32 [ %tmp15, %bb12 ]
+  %tmp19 = icmp ult i32 %tmp7, %tmp18
+  br i1 %tmp19, label %bb20, label %bb33
+
+bb20:                                             ; preds = %bb17
+  %tmp21 = add nuw nsw i32 %tmp7, 2
+  br i1 undef, label %bb22, label %bb2
+
+bb22:                                             ; preds = %bb20
+  %tmp23 = phi i32 [ %tmp18, %bb20 ]
+  br label %bb24
+
+bb24:                                             ; preds = %bb30, %bb22
+  %tmp25 = phi i32 [ 3, %bb22 ], [ %tmp26, %bb30 ]
+  %tmp26 = add i32 %tmp25, 1
+  %tmp27 = icmp ult i32 %tmp26, %tmp23
+  %tmp28 = and i1 undef, %tmp27
+  br i1 %tmp28, label %bb30, label %bb29
+
+bb29:                                             ; preds = %bb24
+  ret void
+
+bb30:                                             ; preds = %bb24
+  br label %bb24
+
+bb31:                                             ; preds = %bb
+  ret void
+
+bb32:                                             ; preds = %bb8
+  unreachable
+
+bb33:                                             ; preds = %bb17
+  ret void
+}