[llvm] [ValueTracking] Add missing check for two-value PN recurrance matching (PR #152700)

[Ivan R. Ivanov via llvm-commits]

https://github.com/ivanradanov updated https://github.com/llvm/llvm-project/pull/152700

>From 7549fd2f17ccb68b8cad59b7b0085afe93ba1ebe Mon Sep 17 00:00:00 2001
From: Ivan Radanov Ivanov <iivanov at nvidia.com>
Date: Fri, 8 Aug 2025 05:07:40 -0700
Subject: [PATCH 1/3] [ValueTracking] Add missing check for two-value PN
 recurrance matching

When InstTy is a type like IntrinsicInst which can have a variable number of
arguments, we can encounter a case where Opetaion will have fewer than two
arguments and error at the getOperand() calls.
---
 llvm/lib/Analysis/ValueTracking.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/llvm/lib/Analysis/ValueTracking.cpp b/llvm/lib/Analysis/ValueTracking.cpp
index 1e70228905c33..b142fc6cc1334 100644
--- a/llvm/lib/Analysis/ValueTracking.cpp
+++ b/llvm/lib/Analysis/ValueTracking.cpp
@@ -9147,7 +9147,8 @@ static bool matchTwoInputRecurrence(const PHINode *PN, InstTy *&Inst,
     return false;
 
   for (unsigned I = 0; I != 2; ++I) {
-    if (auto *Operation = dyn_cast<InstTy>(PN->getIncomingValue(I))) {
+    if (auto *Operation = dyn_cast<InstTy>(PN->getIncomingValue(I));
+        Operation && Operation->getNumOperands() == 2) {
       Value *LHS = Operation->getOperand(0);
       Value *RHS = Operation->getOperand(1);
       if (LHS != PN && RHS != PN)

>From 8aa5b69737c2245975a8da324b8eb5fb4e78121d Mon Sep 17 00:00:00 2001
From: Ivan Radanov Ivanov <iivanov at nvidia.com>
Date: Fri, 8 Aug 2025 05:53:55 -0700
Subject: [PATCH 2/3] Add test

---
 llvm/unittests/Analysis/ValueTrackingTest.cpp | 31 +++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/llvm/unittests/Analysis/ValueTrackingTest.cpp b/llvm/unittests/Analysis/ValueTrackingTest.cpp
index 6af20065213ac..56b13af5ce9b6 100644
--- a/llvm/unittests/Analysis/ValueTrackingTest.cpp
+++ b/llvm/unittests/Analysis/ValueTrackingTest.cpp
@@ -1310,6 +1310,37 @@ TEST_F(ValueTrackingTest, MatchBinaryIntrinsicRecurrenceNegativeFSHR) {
   EXPECT_FALSE(matchSimpleBinaryIntrinsicRecurrence(II, PN, Init, OtherOp));
 }
 
+TEST_F(ValueTrackingTest, MatchBinaryIntrinsicRecurrenceNonTwoOperand) {
+  auto M = parseModule(R"(
+    declare noundef i32 @llvm.nvvm.read.ptx.sreg.nctaid.x()
+    declare i32 @llvm.umin.i32(i32, i32)
+
+    define void @foo(i32 %arg) {
+    bb:
+      br i1 false, label %bb1, label %bb2
+
+    bb1:                                              ; preds = %bb
+      br label %bb3
+
+    bb2:                                              ; preds = %bb
+      %i = tail call noundef i32 @llvm.nvvm.read.ptx.sreg.nctaid.x()
+      br label %bb3
+
+    bb3:                                              ; preds = %bb2, %bb1
+      %i4 = phi i32 [ 0, %bb1 ], [ %i, %bb2 ]
+      %i6 = tail call noundef i32 @llvm.umin.i32(i32 %i4, i32 %arg)
+      ret void
+    }
+  )");
+
+  auto *F = M->getFunction("foo");
+  auto *II = &cast<IntrinsicInst>(findInstructionByName(F, "i6"));
+  PHINode *PN;
+  Value *Init, *OtherOp;
+  // Check that it does not crash (see PR #152700)
+  EXPECT_FALSE(matchSimpleBinaryIntrinsicRecurrence(II, PN, Init, OtherOp));
+}
+
 TEST_F(ComputeKnownBitsTest, ComputeKnownBits) {
   parseAssembly(
       "define i32 @test(i32 %a, i32 %b) {\n"

>From ab28b457c6a8b8acb464cd831d0bceb2df2b5ce8 Mon Sep 17 00:00:00 2001
From: Ivan Radanov Ivanov <iivanov at nvidia.com>
Date: Fri, 8 Aug 2025 06:01:04 -0700
Subject: [PATCH 3/3] Actually check >= operands

---
 llvm/lib/Analysis/ValueTracking.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/llvm/lib/Analysis/ValueTracking.cpp b/llvm/lib/Analysis/ValueTracking.cpp
index b142fc6cc1334..b0e4b009f3501 100644
--- a/llvm/lib/Analysis/ValueTracking.cpp
+++ b/llvm/lib/Analysis/ValueTracking.cpp
@@ -9148,7 +9148,7 @@ static bool matchTwoInputRecurrence(const PHINode *PN, InstTy *&Inst,
 
   for (unsigned I = 0; I != 2; ++I) {
     if (auto *Operation = dyn_cast<InstTy>(PN->getIncomingValue(I));
-        Operation && Operation->getNumOperands() == 2) {
+        Operation && Operation->getNumOperands() >= 2) {
       Value *LHS = Operation->getOperand(0);
       Value *RHS = Operation->getOperand(1);
       if (LHS != PN && RHS != PN)