[PATCH] D150769: [SelectionDAG][computeKnownBits]: Move ISD::ADD/ISD::SUB into their own cases

[Alexander Kornienko via Phabricator via llvm-commits]

alexfh added a comment.

In D150769#4369056 <https://reviews.llvm.org/D150769#4369056>, @alexfh wrote:

> Heads up: this commit has triggered a crash in some of our code. We suspect, it leads to a miscompilation. We're trying to get a reduced test case, but it's taking a long time, since it relies on FDO and ThinLTO.

The following IR was reduced from https://github.com/v8/v8/blob/main/src/json/json-parser.cc (which needs a specific FDO profile to demonstrate the issue, but the reduced example doesn't):

  $ cat reduced.ll
  ; ModuleID = '<bc file>'
  target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
  target triple = "x86_64-unknown-linux-gnu"
  
  define weak_odr ptr @_ZN2v88internal10JsonParserItE14ParseJsonValueEv(ptr %0, ptr %_e.llvm.2168063466968335352, i8 %1, i32 %2) {
  _q.exit:
    switch i8 %1, label %.preheader193 [
      i8 13, label %common.ret
      i8 0, label %common.ret
      i8 2, label %common.ret
      i8 4, label %common.ret
      i8 6, label %common.ret
      i8 7, label %common.ret
      i8 8, label %common.ret
      i8 10, label %common.ret
      i8 11, label %common.ret
      i8 12, label %common.ret
      i8 3, label %common.ret
      i8 1, label %common.ret
    ]
  
  .preheader193:                                    ; preds = %6, %_q.exit
    %3 = phi ptr [ %7, %6 ], [ null, %_q.exit ]
    %4 = load i8, ptr %3, align 1
    %5 = icmp eq i8 %4, 0
    br i1 %5, label %6, label %_w.exit.thread137
  
  6:                                                ; preds = %.preheader193
    %7 = getelementptr i16, ptr %3, i64 1
    br label %.preheader193
  
  _w.exit.thread137: ; preds = %.preheader193
    %8 = call ptr @_ZN2v88internal11HandleScope6ExtendEPNS0_7IsolateE()
    switch i32 %2, label %vector.memcheck [
      i32 1, label %common.ret
      i32 6, label %common.ret
      i32 0, label %common.ret
      i32 4, label %common.ret
    ]
  
  common.ret:                                       ; preds = %vector.body, %_w.exit.thread137, %_w.exit.thread137, %_w.exit.thread137, %_w.exit.thread137, %_q.exit, %_q.exit, %_q.exit, %_q.exit, %_q.exit, %_q.exit, %_q.exit, %_q.exit, %_q.exit, %
  _q.exit, %_q.exit, %_q.exit
    ret ptr null
  
  vector.memcheck:                                  ; preds = %_w.exit.thread137
    %9 = ptrtoint ptr %3 to i64
    %10 = lshr i64 %9, 1
    %11 = add i64 %10, 1
    %12 = and i64 %11, 4294967295
    %13 = add i64 %12, 9223372036854775807
    %14 = and i64 %13, 9223372036854775807
    %15 = add i64 %14, 1
    %n.vec = and i64 %15, -16
    br label %vector.body
  
  vector.body:                                      ; preds = %vector.body, %vector.memcheck
    %index1 = phi i64 [ 0, %vector.memcheck ], [ %index.next, %vector.body ]
    store <8 x i8> zeroinitializer, ptr %_e.llvm.2168063466968335352, align 1
    store <8 x i8> zeroinitializer, ptr %0, align 1
    %index.next = add i64 %index1, 1
    %16 = icmp eq i64 %index1, %n.vec
    br i1 %16, label %common.ret, label %vector.body
  }
  
  declare ptr @_ZN2v88internal11HandleScope6ExtendEPNS0_7IsolateE()
  $ diff -u <(./clang-good -O2 reduced.ll -S -o -) <(./clang-bad -O2 reduced.ll -S -o -)
  --- /dev/fd/63  2023-05-25 03:36:19.016151472 +0200
  +++ /dev/fd/62  2023-05-25 03:36:19.016151472 +0200
  @@ -62,19 +62,19 @@
          jb      .LBB0_9
   .LBB0_6:                                # %vector.memcheck
          shrq    %r15
  -       leal    1(%r15), %ecx
  -       decq    %rcx
  -       movabsq $9223372036854775807, %rax      # imm = 0x7FFFFFFFFFFFFFFF
  +       leal    1(%r15), %eax
  +       decq    %rax
  +       movabsq $9223372036854775807, %rcx      # imm = 0x7FFFFFFFFFFFFFFF
          andq    %rax, %rcx
          incq    %rcx
          testq   $-16, %rcx
          je      .LBB0_7
   # %bb.10:                               # %vector.body.preheader
          incl    %r15d
  -       decq    %r15
  -       andq    %rax, %r15
  -       incq    %r15
  -       andq    $-16, %r15
  +       movabsq $-9223372036854775808, %rcx     # imm = 0x8000000000000000
  +       orq     %r15, %rcx
  +       movabsq $-9223372032559808528, %rax     # imm = 0x80000000FFFFFFF0
  +       andq    %rcx, %rax
          .p2align        4, 0x90
   .LBB0_11:                               # %vector.body
                                           # =>This Inner Loop Header: Depth=1
  @@ -94,7 +94,7 @@
          movq    $0, (%r14)
          movq    $0, (%rbx)
          movq    $0, (%r14)
  -       addq    $-8, %r15
  +       addq    $-8, %rax
          jne     .LBB0_11
   .LBB0_7:                                # %vector.body.epil.preheader
          movl    $1, %eax

I hope, automatic reduction retained validity of the IR, but I'm not fluent in LLVM IR and x86 assembly to verify.


Repository:
  rG LLVM Github Monorepo

CHANGES SINCE LAST ACTION
  https://reviews.llvm.org/D150769/new/

https://reviews.llvm.org/D150769