[llvm] [IndVarSimplify] Handle the case where both operands are the same when widening IV (PR #135207)

[Yingwei Zheng via llvm-commits]

https://github.com/dtcxzyw created https://github.com/llvm/llvm-project/pull/135207

`WidenIV::widenWithVariantUse` assumes that exactly one of the binop operands is the IV to be widened. This miscompilation happens when it tries to sign-extend the "NonIV" operand while the IV is zero-extended.
Closes https://github.com/llvm/llvm-project/issues/135182.

BTW, I found that `WidenIV::cloneArithmeticIVUser` makes the same assumption as this method. But it looks safe.


>From 9207e62438753d52de44170724a90a29ad58c119 Mon Sep 17 00:00:00 2001
From: Yingwei Zheng <dtcxzyw2333 at gmail.com>
Date: Fri, 11 Apr 2025 00:17:51 +0800
Subject: [PATCH 1/2] [IndVarSimplify] Add pre-commit tests. NFC.

---
 .../Transforms/IndVarSimplify/pr135182.ll     | 27 +++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 llvm/test/Transforms/IndVarSimplify/pr135182.ll

diff --git a/llvm/test/Transforms/IndVarSimplify/pr135182.ll b/llvm/test/Transforms/IndVarSimplify/pr135182.ll
new file mode 100644
index 0000000000000..48607ea92d523
--- /dev/null
+++ b/llvm/test/Transforms/IndVarSimplify/pr135182.ll
@@ -0,0 +1,27 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 5
+; RUN: opt -S -passes=indvars < %s | FileCheck %s
+
+target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
+
+define i32 @pr135182() {
+; CHECK-LABEL: define i32 @pr135182() {
+; CHECK-NEXT:  [[ENTRY:.*:]]
+; CHECK-NEXT:    br label %[[FOR_BODY:.*]]
+; CHECK:       [[FOR_BODY]]:
+; CHECK-NEXT:    br i1 false, label %[[FOR_BODY]], label %[[FOR_END:.*]]
+; CHECK:       [[FOR_END]]:
+; CHECK-NEXT:    ret i32 131048
+;
+entry:
+  br label %for.body
+
+for.body:
+  %indvar = phi i16 [ -12, %entry ], [ %indvar.next, %for.body ]
+  %add = add i16 %indvar, %indvar
+  %ext = zext i16 %add to i32
+  %indvar.next = add i16 %indvar, 1
+  br i1 false, label %for.body, label %for.end
+
+for.end:
+  ret i32 %ext
+}

>From dc3c046068762df3c5b24da8d52fa671cb04f582 Mon Sep 17 00:00:00 2001
From: Yingwei Zheng <dtcxzyw2333 at gmail.com>
Date: Fri, 11 Apr 2025 00:34:13 +0800
Subject: [PATCH 2/2] [IndVarSimplify] Handle the case where both operands are
 the same when widening IV

---
 llvm/lib/Transforms/Utils/SimplifyIndVar.cpp    | 3 +++
 llvm/test/Transforms/IndVarSimplify/pr135182.ll | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp b/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp
index 7b9c5c77cbe98..5a76bec017655 100644
--- a/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp
+++ b/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp
@@ -1743,6 +1743,9 @@ bool WidenIV::widenWithVariantUse(WidenIV::NarrowIVDefUse DU) {
     // TODO: Support case for NarrowDef = NarrowUse->getOperand(1).
     if (NarrowUse->getOperand(0) != NarrowDef)
       return false;
+    // We cannot use a different extend kind for the same operand.
+    if (NarrowUse->getOperand(1) == NarrowDef)
+      return false;
     if (!SE->isKnownNegative(RHS))
       return false;
     bool ProvedSubNUW = SE->isKnownPredicateAt(ICmpInst::ICMP_UGE, LHS,
diff --git a/llvm/test/Transforms/IndVarSimplify/pr135182.ll b/llvm/test/Transforms/IndVarSimplify/pr135182.ll
index 48607ea92d523..1db96872cffc4 100644
--- a/llvm/test/Transforms/IndVarSimplify/pr135182.ll
+++ b/llvm/test/Transforms/IndVarSimplify/pr135182.ll
@@ -10,7 +10,7 @@ define i32 @pr135182() {
 ; CHECK:       [[FOR_BODY]]:
 ; CHECK-NEXT:    br i1 false, label %[[FOR_BODY]], label %[[FOR_END:.*]]
 ; CHECK:       [[FOR_END]]:
-; CHECK-NEXT:    ret i32 131048
+; CHECK-NEXT:    ret i32 65512
 ;
 entry:
   br label %for.body