[llvm] [SCEV] Do not allow refinement in the rewriting of BEValue (PR #117152)

[Nikita Popov via llvm-commits]

================
@@ -5933,18 +5925,21 @@ const SCEV *ScalarEvolution::createAddRecFromPHI(PHINode *PN) {
     // We can generalize this saying that i is the shifted value of BEValue
     // by one iteration:
     //   PHI(f(0), f({1,+,1})) --> f({0,+,1})
-    const SCEV *Shifted = SCEVShiftRewriter::rewrite(BEValue, L, *this);
-    const SCEV *Start = SCEVInitRewriter::rewrite(Shifted, L, *this, false);
-    if (Shifted != getCouldNotCompute() &&
-        Start != getCouldNotCompute()) {
-      const SCEV *StartVal = getSCEV(StartValueV);
-      if (Start == StartVal) {
-        // Okay, for the entire analysis of this edge we assumed the PHI
-        // to be symbolic.  We now need to go back and purge all of the
-        // entries for the scalars that use the symbolic expression.
-        forgetMemoizedResults(SymbolicName);
-        insertValueToMap(PN, Shifted);
-        return Shifted;
+
+    // Do not allow refinement in rewriting of BEValue.
+    if (isGuaranteedNotToCauseUB(BEValue)) {
----------------
nikic wrote:

Poison is still a problem if we, for example, replace `0` with `0 *  %a`. Maybe a bit tricky to get things in the right form so it doesn't simplify, but something like `phi(0, zext({1,+,1}) * %a)` (where the addrec is not nuw so zext doesn't fold) might do? The shifted form would be `zext({0,+,1}) * %a` and the shifted start would be `zext(0) * a` which is `0`. But we can't replace 0 by `zext({0,+,1}) * %a`, as it may be more poisonous.

https://github.com/llvm/llvm-project/pull/117152