From: Max Kazantsev <max.kazantsev@azul.com>
Date: Thu, 19 Jul 2018 01:46:21 +0000 (+0000)
Subject: [SCEV] Fix buggy behavior in getAddExpr with truncs
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=62b518b75a780a3bc75982cbe54b0e7bc262aa6e;p=llvm

[SCEV] Fix buggy behavior in getAddExpr with truncs

SCEV tries to constant-fold arguments of trunc operands in SCEVAddExpr, and when it does
that, it passes wrong flags into the recursion. It is only valid to pass flags that are proved for
narrow type into a computation in wider type if we can prove that trunc instruction doesn't
actually change the value. If it did lose some meaningful bits, we may end up proving wrong
no-wrap flags for sum of arguments of trunc.

In the provided test we end up with `nuw` where it shouldn't be because of this bug.

The solution is to conservatively pass `SCEV::FlagAnyWrap` which is always a valid thing to do.

Reviewed By: sanjoy
Differential Revision: https://reviews.llvm.org/D49471


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@337435 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/lib/Analysis/ScalarEvolution.cpp b/lib/Analysis/ScalarEvolution.cpp
index 6480c2c076d..08f0d2939be 100644
--- a/lib/Analysis/ScalarEvolution.cpp
+++ b/lib/Analysis/ScalarEvolution.cpp
@@ -2413,7 +2413,7 @@ const SCEV *ScalarEvolution::getAddExpr(SmallVectorImpl<const SCEV *> &Ops,
     }
     if (Ok) {
       // Evaluate the expression in the larger type.
-      const SCEV *Fold = getAddExpr(LargeOps, Flags, Depth + 1);
+      const SCEV *Fold = getAddExpr(LargeOps, SCEV::FlagAnyWrap, Depth + 1);
       // If it folds to something simple, use it. Otherwise, don't.
       if (isa<SCEVConstant>(Fold) || isa<SCEVUnknown>(Fold))
         return getTruncateExpr(Fold, Ty);
diff --git a/test/Analysis/ScalarEvolution/truncate.ll b/test/Analysis/ScalarEvolution/truncate.ll
index 878f7b3b31b..7ae6908fc20 100644
--- a/test/Analysis/ScalarEvolution/truncate.ll
+++ b/test/Analysis/ScalarEvolution/truncate.ll
@@ -73,3 +73,37 @@ bb34:                                             ; preds = %bb25
   %tmp36 = icmp ugt i32 %tmp16, 52
   br i1 %tmp36, label %bb3, label %bb13
 }
+
+; Make sure that no nuw flag is assigned to %tmp27, otherwise we will have a
+; poisoned value.
+define void @no_nuw(i64 %param)  {
+
+; CHECK-LABEL: Classifying expressions for: @no_nuw
+; CHECK:         %tmp27 = add i64 %tmp20, -1
+; CHECK-NOT:    (-1 + %tmp20)<nuw>
+; CHECK-NEXT:    -->  (-1 + %tmp20) U:
+
+bb:
+  %shift = shl i64 %param, 58
+  br label %bb18
+
+bb18:                                             ; preds = %bb36, %bb
+  %tmp20 = phi i64 [ %shift, %bb ], [ 0, %bb36 ]
+  %tmp21 = phi i64 [ 0, %bb ], [ %tmp24, %bb36 ]
+  %tmp22 = phi i32 [ -6, %bb ], [ %tmp46, %bb36 ]
+  %tmp25 = add i32 %tmp22, 1
+  %tmp26 = sext i32 %tmp25 to i64
+  %tmp27 = add i64 %tmp20, -1
+  %tmp28 = mul i64 %tmp27, %tmp26
+  %tmp29 = icmp ult i64 %tmp21, 1048576
+  br i1 %tmp29, label %bb36, label %bb30
+
+bb30:                                             ; preds = %bb18
+  ret void
+
+bb36:                                             ; preds = %bb18
+  %tmp24 = add nuw i64 %tmp21, 1
+  %tmp45 = trunc i64 %tmp28 to i32
+  %tmp46 = sub i32 %tmp22, %tmp45
+  br label %bb18
+}