llvm.org GIT mirror llvm / 6c7043a
Revert Fix a bug w/inbounds invalidation in LFTR Reverting because it breaks a green dragon build: http://green.lab.llvm.org/green/job/clang-stage2-Rthinlto/18208 This reverts r363289 (git commit eb88badff96dacef8fce3f003dec34c2ef6900bf) git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@363427 91177308-0d34-0410-b5e6-96231b3b80d8 Florian Hahn 3 months ago
5 changed file(s) with 63 addition(s) and 137 deletion(s). Raw diff Collapse all Expand all
3030 #include "llvm/ADT/None.h"
3131 #include "llvm/ADT/Optional.h"
3232 #include "llvm/ADT/STLExtras.h"
33 #include "llvm/ADT/SmallSet.h"
3433 #include "llvm/ADT/SmallPtrSet.h"
3534 #include "llvm/ADT/SmallVector.h"
3635 #include "llvm/ADT/Statistic.h"
4241 #include "llvm/Analysis/ScalarEvolutionExpressions.h"
4342 #include "llvm/Analysis/TargetLibraryInfo.h"
4443 #include "llvm/Analysis/TargetTransformInfo.h"
45 #include "llvm/Analysis/ValueTracking.h"
4644 #include "llvm/Transforms/Utils/Local.h"
4745 #include "llvm/IR/BasicBlock.h"
4846 #include "llvm/IR/Constant.h"
20782076 return Phi != getLoopPhiForCounter(IncV, L);
20792077 }
20802078
2081 /// Return true if undefined behavior would provable be executed on the path to
2082 /// OnPathTo if Root produced a posion result. Note that this doesn't say
2083 /// anything about whether OnPathTo is actually executed or whether Root is
2084 /// actually poison. This can be used to assess whether a new use of Root can
2085 /// be added at a location which is control equivalent with OnPathTo (such as
2086 /// immediately before it) without introducing UB which didn't previously
2087 /// exist. Note that a false result conveys no information.
2088 static bool mustExecuteUBIfPoisonOnPathTo(Instruction *Root,
2089 Instruction *OnPathTo,
2090 DominatorTree *DT) {
2091 // Basic approach is to assume Root is poison, propagate poison forward
2092 // through all users we can easily track, and then check whether any of those
2093 // users are provable UB and must execute before out exiting block might
2094 // exit.
2095
2096 // The set of all recursive users we've visited (which are assumed to all be
2097 // poison because of said visit)
2098 SmallSet KnownPoison;
2099 SmallVector Worklist;
2100 Worklist.push_back(Root);
2101 while (!Worklist.empty()) {
2102 const Instruction *I = Worklist.pop_back_val();
2103
2104 // If we know this must trigger UB on a path leading our target.
2105 if (mustTriggerUB(I, KnownPoison) && DT->dominates(I, OnPathTo))
2106 return true;
2107
2108 // If we can't analyze propagation through this instruction, just skip it
2109 // and transitive users. Safe as false is a conservative result.
2110 if (!propagatesFullPoison(I) && I != Root)
2111 continue;
2112
2113 if (KnownPoison.insert(I).second)
2114 for (const User *User : I->users())
2115 Worklist.push_back(cast(User));
2116 }
2117
2118 // Might be non-UB, or might have a path we couldn't prove must execute on
2119 // way to exiting bb.
2120 return false;
2121 }
2122
21232079 /// Recursive helper for hasConcreteDef(). Unfortunately, this currently boils
21242080 /// down to checking that all operands are constant and listing instructions
21252081 /// that may hide undef.
22082164 /// valid count without scaling the address stride, so it remains a pointer
22092165 /// expression as far as SCEV is concerned.
22102166 static PHINode *FindLoopCounter(Loop *L, BasicBlock *ExitingBB,
2211 const SCEV *BECount,
2212 ScalarEvolution *SE, DominatorTree *DT) {
2167 const SCEV *BECount, ScalarEvolution *SE) {
22132168 uint64_t BCWidth = SE->getTypeSizeInBits(BECount->getType());
22142169
22152170 Value *Cond = cast(ExitingBB->getTerminator())->getCondition();
22542209 continue;
22552210 }
22562211
2257 // Avoid introducing undefined behavior due to poison which didn't exist in
2258 // the original program. (Annoyingly, the rules for poison and undef
2259 // propagation are distinct, so this does NOT cover the undef case above.)
2260 // We have to ensure that we don't introduce UB by introducing a use on an
2261 // iteration where said IV produces poison. Our strategy here differs for
2262 // pointers and integer IVs. For integers, we strip and reinfer as needed,
2263 // see code in linearFunctionTestReplace. For pointers, we restrict
2264 // transforms as there is no good way to reinfer inbounds once lost.
2265 if (!Phi->getType()->isIntegerTy() &&
2266 !mustExecuteUBIfPoisonOnPathTo(Phi, ExitingBB->getTerminator(), DT))
2267 continue;
2268
22692212 const SCEV *Init = AR->getStart();
22702213
22712214 if (BestPhi && !AlmostDeadIV(BestPhi, LatchBlock, Cond)) {
23942337 // compare against the post-incremented value, otherwise we must compare
23952338 // against the preincremented value.
23962339 if (ExitingBB == L->getLoopLatch()) {
2397 bool SafeToPostInc = IndVar->getType()->isIntegerTy();
2398 if (!SafeToPostInc) {
2399 // For pointer IVs, we chose to not strip inbounds which requires us not
2400 // to add a potentially UB introducing use. We need to either a) show
2401 // the loop test we're modifying is already in post-inc form, or b) show
2402 // that adding a use must not introduce UB.
2403 Instruction *Inc =
2404 cast(IndVar->getIncomingValueForBlock(L->getLoopLatch()));
2405 ICmpInst *LoopTest = getLoopTest(L, ExitingBB);
2406 SafeToPostInc = LoopTest->getOperand(0) == Inc ||
2407 LoopTest->getOperand(1) == Inc ||
2408 mustExecuteUBIfPoisonOnPathTo(Inc, ExitingBB->getTerminator(), DT);
2409 }
2410 if (SafeToPostInc) {
2411 // Add one to the "backedge-taken" count to get the trip count.
2412 // This addition may overflow, which is valid as long as the comparison
2413 // is truncated to BackedgeTakenCount->getType().
2414 IVCount = SE->getAddExpr(BackedgeTakenCount,
2415 SE->getOne(BackedgeTakenCount->getType()));
2416 // The BackedgeTaken expression contains the number of times that the
2417 // backedge branches to the loop header. This is one less than the
2418 // number of times the loop executes, so use the incremented indvar.
2419 CmpIndVar = IndVar->getIncomingValueForBlock(ExitingBB);
2420 }
2340 // Add one to the "backedge-taken" count to get the trip count.
2341 // This addition may overflow, which is valid as long as the comparison is
2342 // truncated to BackedgeTakenCount->getType().
2343 IVCount = SE->getAddExpr(BackedgeTakenCount,
2344 SE->getOne(BackedgeTakenCount->getType()));
2345 // The BackedgeTaken expression contains the number of times that the
2346 // backedge branches to the loop header. This is one less than the
2347 // number of times the loop executes, so use the incremented indvar.
2348 CmpIndVar = IndVar->getIncomingValueForBlock(ExitingBB);
24212349 }
24222350
24232351 // It may be necessary to drop nowrap flags on the incrementing instruction
27172645 if (BETakenCount->isZero())
27182646 continue;
27192647
2720 PHINode *IndVar = FindLoopCounter(L, ExitingBB, BETakenCount, SE, DT);
2648 PHINode *IndVar = FindLoopCounter(L, ExitingBB, BETakenCount, SE);
27212649 if (!IndVar)
27222650 continue;
27232651
2727 ; CHECK-NEXT: br label [[FOR_BODY21_I:%.*]]
2828 ; CHECK: for.body21.i:
2929 ; CHECK-NEXT: [[DESTYPIXELPTR_010_I:%.*]] = phi i8* [ null, [[FOR_BODY21_LR_PH_I]] ], [ [[INCDEC_PTR_I:%.*]], [[IF_END_I126:%.*]] ]
30 ; CHECK-NEXT: [[X_09_I:%.*]] = phi i32 [ 0, [[FOR_BODY21_LR_PH_I]] ], [ [[INC_I125:%.*]], [[IF_END_I126]] ]
3130 ; CHECK-NEXT: br i1 undef, label [[IF_END_I126]], label [[IF_ELSE_I124:%.*]]
3231 ; CHECK: if.else.i124:
3332 ; CHECK-NEXT: store i8 undef, i8* [[DESTYPIXELPTR_010_I]], align 1
3433 ; CHECK-NEXT: br label [[IF_END_I126]]
3534 ; CHECK: if.end.i126:
3635 ; CHECK-NEXT: [[INCDEC_PTR_I]] = getelementptr inbounds i8, i8* [[DESTYPIXELPTR_010_I]], i32 1
37 ; CHECK-NEXT: [[INC_I125]] = add nuw i32 [[X_09_I]], 1
38 ; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i32 [[INC_I125]], undef
36 ; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8* [[INCDEC_PTR_I]], null
3937 ; CHECK-NEXT: br i1 [[EXITCOND]], label [[FOR_BODY21_I]], label [[FOR_END_I129_LOOPEXIT:%.*]]
4038 ; CHECK: for.end.i129.loopexit:
4139 ; CHECK-NEXT: br label [[FOR_END_I129]]
300300 ; PTR64-NEXT: [[CMP1604192:%.*]] = icmp ult i8* undef, [[ADD_PTR1603]]
301301 ; PTR64-NEXT: br i1 [[CMP1604192]], label [[FOR_BODY_PREHEADER:%.*]], label [[FOR_END1609:%.*]]
302302 ; PTR64: for.body.preheader:
303 ; PTR64-NEXT: [[SCEVGEP:%.*]] = getelementptr [512 x i8], [512 x i8]* [[BASE]], i64 1, i64 0
303304 ; PTR64-NEXT: br label [[FOR_BODY:%.*]]
304305 ; PTR64: for.body:
305306 ; PTR64-NEXT: [[R_17193:%.*]] = phi i8* [ [[INCDEC_PTR1608:%.*]], [[FOR_BODY]] ], [ null, [[FOR_BODY_PREHEADER]] ]
306307 ; PTR64-NEXT: [[INCDEC_PTR1608]] = getelementptr i8, i8* [[R_17193]], i64 1
307 ; PTR64-NEXT: [[CMP1604:%.*]] = icmp ult i8* [[INCDEC_PTR1608]], [[ADD_PTR1603]]
308 ; PTR64-NEXT: br i1 [[CMP1604]], label [[FOR_BODY]], label [[FOR_END1609_LOOPEXIT:%.*]]
308 ; PTR64-NEXT: [[EXITCOND:%.*]] = icmp ne i8* [[INCDEC_PTR1608]], [[SCEVGEP]]
309 ; PTR64-NEXT: br i1 [[EXITCOND]], label [[FOR_BODY]], label [[FOR_END1609_LOOPEXIT:%.*]]
309310 ; PTR64: for.end1609.loopexit:
310311 ; PTR64-NEXT: br label [[FOR_END1609]]
311312 ; PTR64: for.end1609:
319320 ; PTR32-NEXT: [[CMP1604192:%.*]] = icmp ult i8* undef, [[ADD_PTR1603]]
320321 ; PTR32-NEXT: br i1 [[CMP1604192]], label [[FOR_BODY_PREHEADER:%.*]], label [[FOR_END1609:%.*]]
321322 ; PTR32: for.body.preheader:
323 ; PTR32-NEXT: [[SCEVGEP:%.*]] = getelementptr [512 x i8], [512 x i8]* [[BASE]], i32 1, i32 0
322324 ; PTR32-NEXT: br label [[FOR_BODY:%.*]]
323325 ; PTR32: for.body:
324326 ; PTR32-NEXT: [[R_17193:%.*]] = phi i8* [ [[INCDEC_PTR1608:%.*]], [[FOR_BODY]] ], [ null, [[FOR_BODY_PREHEADER]] ]
325327 ; PTR32-NEXT: [[INCDEC_PTR1608]] = getelementptr i8, i8* [[R_17193]], i64 1
326 ; PTR32-NEXT: [[CMP1604:%.*]] = icmp ult i8* [[INCDEC_PTR1608]], [[ADD_PTR1603]]
327 ; PTR32-NEXT: br i1 [[CMP1604]], label [[FOR_BODY]], label [[FOR_END1609_LOOPEXIT:%.*]]
328 ; PTR32-NEXT: [[EXITCOND:%.*]] = icmp ne i8* [[INCDEC_PTR1608]], [[SCEVGEP]]
329 ; PTR32-NEXT: br i1 [[EXITCOND]], label [[FOR_BODY]], label [[FOR_END1609_LOOPEXIT:%.*]]
328330 ; PTR32: for.end1609.loopexit:
329331 ; PTR32-NEXT: br label [[FOR_END1609]]
330332 ; PTR32: for.end1609:
2424 ; CHECK-NEXT: entry:
2525 ; CHECK-NEXT: br label [[LOOP:%.*]]
2626 ; CHECK: loop:
27 ; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), [[ENTRY:%.*]] ], [ [[TMP3:%.*]], [[CONT:%.*]] ]
28 ; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1
29 ; CHECK-NEXT: br i1 [[ALWAYS_FALSE:%.*]], label [[NEVER_EXECUTED:%.*]], label [[CONT]]
30 ; CHECK: never_executed:
31 ; CHECK-NEXT: store volatile i8 0, i8* [[TMP3]]
32 ; CHECK-NEXT: br label [[CONT]]
33 ; CHECK: cont:
34 ; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8* [[TMP3]], getelementptr (i8, i8* getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), i64 246)
35 ; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]]
36 ; CHECK: exit:
37 ; CHECK-NEXT: ret void
38 ;
39 entry:
40 br label %loop
41
42 loop:
43 %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %cont ]
44 %p.0 = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), %entry ], [ %tmp3, %cont ]
45 %tmp3 = getelementptr inbounds i8, i8* %p.0, i64 1
46 br i1 %always_false, label %never_executed, label %cont
47
48 never_executed:
49 store volatile i8 0, i8* %tmp3
50 br label %cont
51
52 cont:
53 %tmp4 = add i8 %i.0, 1
54 %tmp5 = icmp ult i8 %tmp4, -10
55 br i1 %tmp5, label %loop, label %exit
56
57 exit:
58 ret void
59 }
60
61 ; Similiar to above, but shows how we currently guard non-constant
62 ; memory operands in a manner which hides the latent miscompile.
63 define void @neg_dynamically_dead_inbounds2(i8* %a, i1 %always_false) #0 {
64 ; CHECK-LABEL: @neg_dynamically_dead_inbounds2(
65 ; CHECK-NEXT: entry:
66 ; CHECK-NEXT: br label [[LOOP:%.*]]
67 ; CHECK: loop:
2768 ; CHECK-NEXT: [[I_0:%.*]] = phi i8 [ 0, [[ENTRY:%.*]] ], [ [[TMP4:%.*]], [[CONT:%.*]] ]
28 ; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), [[ENTRY]] ], [ [[TMP3:%.*]], [[CONT]] ]
69 ; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ [[A:%.*]], [[ENTRY]] ], [ [[TMP3:%.*]], [[CONT]] ]
2970 ; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1
3071 ; CHECK-NEXT: br i1 [[ALWAYS_FALSE:%.*]], label [[NEVER_EXECUTED:%.*]], label [[CONT]]
3172 ; CHECK: never_executed:
4384
4485 loop:
4586 %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %cont ]
46 %p.0 = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), %entry ], [ %tmp3, %cont ]
87 %p.0 = phi i8* [ %a, %entry ], [ %tmp3, %cont ]
4788 %tmp3 = getelementptr inbounds i8, i8* %p.0, i64 1
4889 br i1 %always_false, label %never_executed, label %cont
4990
60101 ret void
61102 }
62103
63 ; Similiar to above, but shows how we currently guard non-constant
64 ; memory operands in a manner which hides the latent miscompile.
65 define void @neg_dynamically_dead_inbounds2(i8* %a, i1 %always_false) #0 {
66 ; CHECK-LABEL: @neg_dynamically_dead_inbounds2(
67 ; CHECK-NEXT: entry:
68 ; CHECK-NEXT: br label [[LOOP:%.*]]
69 ; CHECK: loop:
70 ; CHECK-NEXT: [[I_0:%.*]] = phi i8 [ 0, [[ENTRY:%.*]] ], [ [[TMP4:%.*]], [[CONT:%.*]] ]
71 ; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ [[A:%.*]], [[ENTRY]] ], [ [[TMP3:%.*]], [[CONT]] ]
72 ; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1
73 ; CHECK-NEXT: br i1 [[ALWAYS_FALSE:%.*]], label [[NEVER_EXECUTED:%.*]], label [[CONT]]
74 ; CHECK: never_executed:
75 ; CHECK-NEXT: store volatile i8 0, i8* [[TMP3]]
76 ; CHECK-NEXT: br label [[CONT]]
77 ; CHECK: cont:
78 ; CHECK-NEXT: [[TMP4]] = add nuw i8 [[I_0]], 1
79 ; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8 [[TMP4]], -10
80 ; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]]
81 ; CHECK: exit:
82 ; CHECK-NEXT: ret void
83 ;
84 entry:
85 br label %loop
86
87 loop:
88 %i.0 = phi i8 [ 0, %entry ], [ %tmp4, %cont ]
89 %p.0 = phi i8* [ %a, %entry ], [ %tmp3, %cont ]
90 %tmp3 = getelementptr inbounds i8, i8* %p.0, i64 1
91 br i1 %always_false, label %never_executed, label %cont
92
93 never_executed:
94 store volatile i8 0, i8* %tmp3
95 br label %cont
96
97 cont:
98 %tmp4 = add i8 %i.0, 1
99 %tmp5 = icmp ult i8 %tmp4, -10
100 br i1 %tmp5, label %loop, label %exit
101
102 exit:
103 ret void
104 }
105
106104 define void @dom_store_preinc() #0 {
107105 ; CHECK-LABEL: @dom_store_preinc(
108106 ; CHECK-NEXT: entry:
111109 ; CHECK-NEXT: [[P_0:%.*]] = phi i8* [ getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), [[ENTRY:%.*]] ], [ [[TMP3:%.*]], [[LOOP]] ]
112110 ; CHECK-NEXT: store volatile i8 0, i8* [[P_0]]
113111 ; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1
114 ; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8* [[P_0]], getelementptr (i8, i8* getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), i64 245)
112 ; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8* [[TMP3]], getelementptr (i8, i8* getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), i64 246)
115113 ; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]]
116114 ; CHECK: exit:
117115 ; CHECK-NEXT: ret void
166166 ; CHECK-NEXT: [[TMP2:%.*]] = load i8, i8* [[DOT0]], align 1
167167 ; CHECK-NEXT: [[TMP3]] = getelementptr inbounds i8, i8* [[P_0]], i64 1
168168 ; CHECK-NEXT: store i8 [[TMP2]], i8* [[P_0]], align 1
169 ; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8* [[P_0]], getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 239)
169 ; CHECK-NEXT: [[EXITCOND:%.*]] = icmp ne i8* [[TMP3]], getelementptr (i8, i8* getelementptr inbounds ([240 x i8], [240 x i8]* @data, i64 0, i64 0), i64 240)
170170 ; CHECK-NEXT: br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT:%.*]]
171171 ; CHECK: exit:
172172 ; CHECK-NEXT: ret void