From 6260cf71d3013124cb0ab901e5de058843fd9bbe Mon Sep 17 00:00:00 2001
From: Philip Reames <listmail@philipreames.com>
Date: Fri, 1 Dec 2017 20:57:19 +0000
Subject: [PATCH] [IndVars] Fix a bug introduced in r317012

Turns out we can have comparisons which are indirect users of the induction variable that we can make invariant.  In this case, there is no loop invariant value contributing and we'd fail an assert.

The test case was found by a java fuzzer and reduced.  It's a real cornercase.  You have to have a static loop which we've already proven only executes once, but haven't broken the backedge on, and an inner phi whose result can be constant folded by SCEV using exit count reasoning but not proven by isKnownPredicate.  To my knowledge, only the fuzzer has hit this case.

llvm-svn: 319583
---
 llvm/lib/Transforms/Utils/SimplifyIndVar.cpp  | 16 ++++++++--
 .../loop-invariant-conditions.ll              | 30 +++++++++++++++++++
 2 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp b/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp
index fce7f8b81bac..96b51396c9b6 100644
--- a/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp
+++ b/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp
@@ -200,13 +200,23 @@ bool SimplifyIndvar::makeIVComparisonInvariant(ICmpInst *ICmp,
   // TODO: Support multiple entry loops?  (We currently bail out of these in
   // the IndVarSimplify pass)
   if (auto *BB = L->getLoopPredecessor()) {
-    Value *Incoming = PN->getIncomingValueForBlock(BB);
-    const SCEV *IncomingS = SE->getSCEV(Incoming);
-    CheapExpansions[IncomingS] = Incoming;
+    const int Idx = PN->getBasicBlockIndex(BB);
+    if (Idx >= 0) {
+      Value *Incoming = PN->getIncomingValue(Idx);
+      const SCEV *IncomingS = SE->getSCEV(Incoming);
+      CheapExpansions[IncomingS] = Incoming;
+    }
   }
   Value *NewLHS = CheapExpansions[InvariantLHS];
   Value *NewRHS = CheapExpansions[InvariantRHS];
 
+  if (!NewLHS)
+    if (auto *ConstLHS = dyn_cast<SCEVConstant>(InvariantLHS))
+      NewLHS = ConstLHS->getValue();
+  if (!NewRHS)
+    if (auto *ConstRHS = dyn_cast<SCEVConstant>(InvariantRHS))
+      NewRHS = ConstRHS->getValue();
+
   if (!NewLHS || !NewRHS)
     // We could not find an existing value to replace either LHS or RHS.
     // Generating new instructions has subtler tradeoffs, so avoid doing that
diff --git a/llvm/test/Transforms/IndVarSimplify/loop-invariant-conditions.ll b/llvm/test/Transforms/IndVarSimplify/loop-invariant-conditions.ll
index 1c8eb93869ad..70cf714ba9f2 100644
--- a/llvm/test/Transforms/IndVarSimplify/loop-invariant-conditions.ll
+++ b/llvm/test/Transforms/IndVarSimplify/loop-invariant-conditions.ll
@@ -295,6 +295,36 @@ for.end:                                          ; preds = %if.end, %entry
   ret void
 }
 
+; check that we handle conditions with loop invariant operands which
+; *aren't* in the header - this is a very rare and fragile case where
+; we have a "loop" which is known to run exactly one iteration but
+; haven't yet simplified the uses of the IV
+define void @test10() {
+; CHECK-LABEL: @test10
+entry:
+  br label %loop
+
+loop:
+  %phi1 = phi i32 [ %phi2, %latch ], [ 0, %entry ]
+  %dec = add i32 %phi1, -1
+  br i1 false, label %left, label %right
+
+left:
+  br label %latch
+
+right:
+  br label %latch
+
+latch:
+  %phi2 = phi i32 [ %phi1, %left ], [ %dec, %right ]
+  ; CHECK: %cmp = icmp slt i32 -1, undef
+  %cmp = icmp slt i32 %phi2, undef
+  br i1 true, label %exit, label %loop
+
+exit:
+  ret void
+}
+
 !1 = !{i64 -1, i64 100}
 
 
-- 
GitLab