replica
/
hanchenye-llvm-project
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Re-apply [SCEV] Fix isLoopEntryGuardedByCond usage 

ScalarEvolution::isKnownPredicate invokes isLoopEntryGuardedByCond without check
that SCEV is available at entry point of the loop. It is incorrect and fixed by patch.

To bugs additionally fixed:
assert is moved after the check whether loop is not a nullptr.
Usage of isLoopEntryGuardedByCond in ScalarEvolution::isImpliedCondOperandsViaNoOverflow
is guarded by isAvailableAtLoopEntry.

Reviewers: sanjoy, mkazantsev, anna, dorit, reames
Reviewed By: mkazantsev
Subscribers: llvm-commits
Differential Revision: https://reviews.llvm.org/D42417

llvm-svn: 324204
This commit is contained in:
Serguei Katkov 2018-02-05 05:49:47 +00:00
parent 0923542c61
commit ec7029c286
3 changed files with 77 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
llvm/lib/Analysis/ScalarEvolution.cpp
View File

@ -8669,7 +8669,8 @@ bool ScalarEvolution::isKnownPredicate(ICmpInst::Predicate Pred,
bool RightGuarded = false;
if (LAR) {
const Loop *L = LAR->getLoop();
if (isLoopEntryGuardedByCond(L, Pred, LAR->getStart(), RHS) &&
if (isAvailableAtLoopEntry(RHS, L) &&
isLoopEntryGuardedByCond(L, Pred, LAR->getStart(), RHS) &&
isLoopBackedgeGuardedByCond(L, Pred, LAR->getPostIncExpr(*this), RHS)) {
if (!RAR) return true;
LeftGuarded = true;
@ -8677,7 +8678,8 @@ bool ScalarEvolution::isKnownPredicate(ICmpInst::Predicate Pred,
}
if (RAR) {
const Loop *L = RAR->getLoop();
if (isLoopEntryGuardedByCond(L, Pred, LHS, RAR->getStart()) &&
if (isAvailableAtLoopEntry(LHS, L) &&
isLoopEntryGuardedByCond(L, Pred, LHS, RAR->getStart()) &&
isLoopBackedgeGuardedByCond(L, Pred, LHS, RAR->getPostIncExpr(*this))) {
if (!LAR) return true;
RightGuarded = true;
@ -9062,6 +9064,12 @@ ScalarEvolution::isLoopEntryGuardedByCond(const Loop *L,
// (interprocedural conditions notwithstanding).
if (!L) return false;
// Both LHS and RHS must be available at loop entry.
assert(isAvailableAtLoopEntry(LHS, L) &&
"LHS is not available at Loop Entry");
assert(isAvailableAtLoopEntry(RHS, L) &&
"RHS is not available at Loop Entry");
if (isKnownPredicateViaConstantRanges(Pred, LHS, RHS))
return true;
@ -9418,7 +9426,8 @@ bool ScalarEvolution::isImpliedCondOperandsViaNoOverflow(
}
// Try to prove (1) or (2), as needed.
return isLoopEntryGuardedByCond(L, Pred, FoundRHS,
return isAvailableAtLoopEntry(FoundRHS, L) &&
isLoopEntryGuardedByCond(L, Pred, FoundRHS,
getConstant(FoundRHSLimit));
}

19
llvm/lib/Transforms/Scalar/InductiveRangeCheckElimination.cpp
View File

@ -934,9 +934,9 @@ LoopStructure::parseLoopStructure(ScalarEvolution &SE,
return None;
}
if (!SE.isLoopEntryGuardedByCond(
&L, BoundPred, IndVarStart,
SE.getAddExpr(RightSCEV, Step))) {
if (!SE.isAvailableAtLoopEntry(RightSCEV, &L) ||
!SE.isLoopEntryGuardedByCond(&L, BoundPred, IndVarStart,
SE.getAddExpr(RightSCEV, Step))) {
FailureReason = "Induction variable start not bounded by upper limit";
return None;
}
@ -948,7 +948,8 @@ LoopStructure::parseLoopStructure(ScalarEvolution &SE,
RightValue = B.CreateAdd(RightValue, One);
}
} else {
if (!SE.isLoopEntryGuardedByCond(&L, BoundPred, IndVarStart, RightSCEV)) {
if (!SE.isAvailableAtLoopEntry(RightSCEV, &L) ||
!SE.isLoopEntryGuardedByCond(&L, BoundPred, IndVarStart, RightSCEV)) {
FailureReason = "Induction variable start not bounded by upper limit";
return None;
}
@ -1014,9 +1015,10 @@ LoopStructure::parseLoopStructure(ScalarEvolution &SE,
return None;
}
if (!SE.isLoopEntryGuardedByCond(
&L, BoundPred, IndVarStart,
SE.getMinusSCEV(RightSCEV, SE.getOne(RightSCEV->getType())))) {
if (!SE.isAvailableAtLoopEntry(RightSCEV, &L) ||
!SE.isLoopEntryGuardedByCond(
&L, BoundPred, IndVarStart,
SE.getMinusSCEV(RightSCEV, SE.getOne(RightSCEV->getType())))) {
FailureReason = "Induction variable start not bounded by lower limit";
return None;
}
@ -1028,7 +1030,8 @@ LoopStructure::parseLoopStructure(ScalarEvolution &SE,
RightValue = B.CreateSub(RightValue, One);
}
} else {
if (!SE.isLoopEntryGuardedByCond(&L, BoundPred, IndVarStart, RightSCEV)) {
if (!SE.isAvailableAtLoopEntry(RightSCEV, &L) ||
!SE.isLoopEntryGuardedByCond(&L, BoundPred, IndVarStart, RightSCEV)) {
FailureReason = "Induction variable start not bounded by lower limit";
return None;
}

54
llvm/test/Transforms/IndVarSimplify/inner-loop.ll Normal file
View File

@ -0,0 +1,54 @@
; RUN: opt < %s -indvars -S | FileCheck %s
; This is regression test for the bug in ScalarEvolution::isKnownPredicate.
; It does not check whether SCEV is available at loop entry before invoking
; and utility function isLoopEntryGuardedByCond and that leads to miscompile.
target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128-ni:1"
target triple = "x86_64-unknown-linux-gnu"
declare void @foo(i64)
declare void @bar(i32)
define void @test(i8* %arr) {
entry:
br label %outer_header
outer_header:
%i = phi i32 [40, %entry], [%i.next, %outer_latch]
%i.64 = sext i32 %i to i64
br label %inner_header
inner_header:
%j = phi i32 [27, %outer_header], [%j.next, %inner_backedge]
%j1 = zext i32 %j to i64
; The next 4 lines are required for avoid widening of %j and
; SCEV at %cmp would not be AddRec.
%gep = getelementptr inbounds i8, i8* %arr, i64 %j1
%ld = load i8, i8* %gep
%ec = icmp eq i8 %ld, 0
br i1 %ec, label %return, label %inner_backedge
inner_backedge:
%cmp = icmp ult i32 %j, %i
%s = select i1 %cmp, i32 %i, i32 %j
; Select should not be simplified because if
; %i == 26 and %j == 27, %s should be equal to %j.
; In case of a bug the instruction is simplified to
; %s = select i1 true, i32 %0, i32 %j
; CHECK-NOT: %s = select i1 true
call void @bar(i32 %s)
%j.next = add nsw i32 %j, -2
%cond = icmp ult i32 %j, 3
br i1 %cond, label %outer_latch, label %inner_header
outer_latch:
%i.next = add i32 %i, -1
%cond2 = icmp sgt i32 %i.next, 13
; This line is just for forcing widening of %i
call void @foo(i64 %i.64)
br i1 %cond2, label %outer_header, label %return
return:
ret void
}