llvm.org GIT mirror llvm / 7e76879
[ValueTracking] Make poison propagation more aggressive Summary: Motivation: fix PR31181 without regression (the actual fix is still in progress). However, the actual content of PR31181 is not relevant here. This change makes poison propagation more aggressive in the following cases: 1. poision * Val == poison, for any Val. In particular, this changes existing intentional and documented behavior in these two cases: a. Val is 0 b. Val is 2^k * N 2. poison << Val == poison, for any Val 3. getelementptr is poison if any input is poison I think all of these are justified (and are axiomatically true in the new poison / undef model): 1a: we need poison * 0 to be poison to allow transforms like these: A * (B + C) ==> A * B + A * C If poison * 0 were 0 then the above transform could not be allowed since e.g. we could have A = poison, B = 1, C = -1, making the LHS poison * (1 + -1) = poison * 0 = 0 and the RHS poison * 1 + poison * -1 = poison + poison = poison 1b: we need e.g. poison * 4 to be poison since we want to allow A * 4 ==> A + A + A + A If poison * 4 were a value with all of their bits poison except the last four; then we'd not be able to do this transform since then if A were poison the LHS would only be "partially" poison while the RHS would be "full" poison. 2: Same reasoning as (1b), we'd like have the following kinds transforms be legal: A << 1 ==> A + A Reviewers: majnemer, efriedma Subscribers: mcrosier, llvm-commits Differential Revision: https://reviews.llvm.org/D30185 git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@295809 91177308-0d34-0410-b5e6-96231b3b80d8 Sanjoy Das 3 years ago
4 changed file(s) with 34 addition(s) and 84 deletion(s). Raw diff Collapse all Expand all
38153815 case Instruction::Trunc:
38163816 case Instruction::BitCast:
38173817 case Instruction::AddrSpaceCast:
3818 case Instruction::Mul:
3819 case Instruction::Shl:
3820 case Instruction::GetElementPtr:
38183821 // These operations all propagate poison unconditionally. Note that poison
38193822 // is not any particular value, so xor or subtraction of poison with
38203823 // itself still yields poison, not zero.
38263829 // multiple output bits. A replicated poison bit is still poison.
38273830 return true;
38283831
3829 case Instruction::Shl: {
3830 // Left shift *by* a poison value is poison. The number of
3831 // positions to shift is unsigned, so no negative values are
3832 // possible there. Left shift by zero places preserves poison. So
3833 // it only remains to consider left shift of poison by a positive
3834 // number of places.
3835 //
3836 // A left shift by a positive number of places leaves the lowest order bit
3837 // non-poisoned. However, if such a shift has a no-wrap flag, then we can
3838 // make the poison operand violate that flag, yielding a fresh full-poison
3839 // value.
3840 auto *OBO = cast(I);
3841 return OBO->hasNoUnsignedWrap() || OBO->hasNoSignedWrap();
3842 }
3843
3844 case Instruction::Mul: {
3845 // A multiplication by zero yields a non-poison zero result, so we need to
3846 // rule out zero as an operand. Conservatively, multiplication by a
3847 // non-zero constant is not multiplication by zero.
3848 //
3849 // Multiplication by a non-zero constant can leave some bits
3850 // non-poisoned. For example, a multiplication by 2 leaves the lowest
3851 // order bit unpoisoned. So we need to consider that.
3852 //
3853 // Multiplication by 1 preserves poison. If the multiplication has a
3854 // no-wrap flag, then we can make the poison operand violate that flag
3855 // when multiplied by any integer other than 0 and 1.
3856 auto *OBO = cast(I);
3857 if (OBO->hasNoUnsignedWrap() || OBO->hasNoSignedWrap()) {
3858 for (Value *V : OBO->operands()) {
3859 if (auto *CI = dyn_cast(V)) {
3860 // A ConstantInt cannot yield poison, so we can assume that it is
3861 // the other operand that is poison.
3862 return !CI->isZero();
3863 }
3864 }
3865 }
3866 return false;
3867 }
3868
38693832 case Instruction::ICmp:
38703833 // Comparing poison with any value yields poison. This is why, for
38713834 // instance, x s< (x +nsw 1) can be folded to true.
38723835 return true;
3873
3874 case Instruction::GetElementPtr:
3875 // A GEP implicitly represents a sequence of additions, subtractions,
3876 // truncations, sign extensions and multiplications. The multiplications
3877 // are by the non-zero sizes of some set of types, so we do not have to be
3878 // concerned with multiplication by zero. If the GEP is in-bounds, then
3879 // these operations are implicitly no-signed-wrap so poison is propagated
3880 // by the arguments above for Add, Sub, Trunc, SExt and Mul.
3881 return cast(I)->isInBounds();
38823836
38833837 default:
38843838 return false;
99 ; AddRec: {{{(28 + (4 * (-4 + (3 * %m)) * %o) + %A),+,(8 * %m * %o)}<%for.i>,+,(12 * %o)}<%for.j>,+,20}<%for.k>
1010 ; CHECK: Base offset: %A
1111 ; CHECK: ArrayDecl[UnknownSize][%m][%o] with elements of 4 bytes.
12 ; CHECK: ArrayRef[{3,+,2}<%for.i>][{-4,+,3}<%for.j>][{7,+,5}<%for.k>]
12 ; CHECK: ArrayRef[{3,+,2}<%for.i>][{-4,+,3}<nw><%for.j>][{7,+,5}<%for.k>]
1313
1414 define void @foo(i64 %n, i64 %m, i64 %o, i32* nocapture %A) #0 {
1515 entry:
1010 ; AddRec: {{((%m * %b * 8) + %A),+,(2 * %m * 8)}<%for.i>,+,(2 * 8)}<%for.j>
1111 ; CHECK: Base offset: %A
1212 ; CHECK: ArrayDecl[UnknownSize][%m] with elements of 8 bytes.
13 ; CHECK: ArrayRef[{%b,+,2}<%for.i>][{0,+,2}<%for.j>]
13 ; CHECK: ArrayRef[{%b,+,2}<nsw><%for.i>][{0,+,2}<%for.j>]
1414
1515
1616 define void @foo(i64 %n, i64 %m, i64 %b, double* %A) {
271271 ret void
272272 }
273273
274 ; Without inbounds, GEP does not propagate poison in the very
275 ; conservative approach used here.
276 define void @test-add-no-inbounds(float* %input, i32 %offset, i32 %numIterations) {
277 ; CHECK-LABEL: @test-add-no-inbounds
278 entry:
279 br label %loop
280 loop:
281 %i = phi i32 [ %nexti, %loop ], [ 0, %entry ]
282
283 ; CHECK: %index32 =
284 ; CHECK: --> {%offset,+,1}
274 ; Any poison input makes getelementptr produce poison
275 define void @test-gep-propagates-poison(float* %input, i32 %offset, i32 %numIterations) {
276 ; CHECK-LABEL: @test-gep-propagates-poison
277 entry:
278 br label %loop
279 loop:
280 %i = phi i32 [ %nexti, %loop ], [ 0, %entry ]
281
282 ; CHECK: %index32 =
283 ; CHECK: --> {%offset,+,1}
285284 %index32 = add nsw i32 %i, %offset
286285
287286 %ptr = getelementptr float, float* %input, i32 %index32
316315 ret void
317316 }
318317
319 ; Multiplication by a non-constant should not propagate poison in the
320 ; very conservative approach used here.
321 define void @test-add-mul-no-propagation(float* %input, i32 %offset, i32 %numIterations) {
322 ; CHECK-LABEL: @test-add-mul-no-propagation
323 entry:
324 br label %loop
325 loop:
326 %i = phi i32 [ %nexti, %loop ], [ 0, %entry ]
327
328 ; CHECK: %index32 =
329 ; CHECK: --> {%offset,+,1}
318 ; Any poison input to multiplication propages poison.
319 define void @test-mul-propagates-poison(float* %input, i32 %offset, i32 %numIterations) {
320 ; CHECK-LABEL: @test-mul-propagates-poison
321 entry:
322 br label %loop
323 loop:
324 %i = phi i32 [ %nexti, %loop ], [ 0, %entry ]
325
326 ; CHECK: %index32 =
327 ; CHECK: --> {%offset,+,1}
330328 %index32 = add nsw i32 %i, %offset
331329
332330 %indexmul = mul nsw i32 %index32, %offset
339337 ret void
340338 }
341339
342 ; Multiplication by a non-zero constant does not propagate poison
343 ; without a no-wrap flag.
344 define void @test-add-mul-no-propagation2(float* %input, i32 %offset, i32 %numIterations) {
345 ; CHECK-LABEL: @test-add-mul-no-propagation2
346 entry:
347 br label %loop
348 loop:
349 %i = phi i32 [ %nexti, %loop ], [ 0, %entry ]
350
351 ; CHECK: %index32 =
352 ; CHECK: --> {%offset,+,1}
340 define void @test-mul-propagates-poison-2(float* %input, i32 %offset, i32 %numIterations) {
341 ; CHECK-LABEL: @test-mul-propagates-poison-2
342 entry:
343 br label %loop
344 loop:
345 %i = phi i32 [ %nexti, %loop ], [ 0, %entry ]
346
347 ; CHECK: %index32 =
348 ; CHECK: --> {%offset,+,1}
353349 %index32 = add nsw i32 %i, %offset
354350
355351 %indexmul = mul i32 %index32, 2