From 0fed3ad4cb880f52a5385d695ac7367c074c09c5 Mon Sep 17 00:00:00 2001
From: Philip Reames <listmail@philipreames.com>
Date: Fri, 1 Dec 2017 20:57:19 +0000
Subject: [PATCH] [IndVars] Fix a bug introduced in r317012

Turns out we can have comparisons which are indirect users of the induction variable that we can make invariant.  In this case, there is no loop invariant value contributing and we'd fail an assert.

The test case was found by a java fuzzer and reduced.  It's a real cornercase.  You have to have a static loop which we've already proven only executes once, but haven't broken the backedge on, and an inner phi whose result can be constant folded by SCEV using exit count reasoning but not proven by isKnownPredicate.  To my knowledge, only the fuzzer has hit this case.



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@319583 91177308-0d34-0410-b5e6-96231b3b80d8
---
 lib/Transforms/Utils/SimplifyIndVar.cpp            | 16 +++++++++---
 .../IndVarSimplify/loop-invariant-conditions.ll    | 30 ++++++++++++++++++++++
 2 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/lib/Transforms/Utils/SimplifyIndVar.cpp b/lib/Transforms/Utils/SimplifyIndVar.cpp
index fce7f8b81ba..96b51396c9b 100644
--- a/lib/Transforms/Utils/SimplifyIndVar.cpp
+++ b/lib/Transforms/Utils/SimplifyIndVar.cpp
@@ -200,13 +200,23 @@ bool SimplifyIndvar::makeIVComparisonInvariant(ICmpInst *ICmp,
   // TODO: Support multiple entry loops?  (We currently bail out of these in
   // the IndVarSimplify pass)
   if (auto *BB = L->getLoopPredecessor()) {
-    Value *Incoming = PN->getIncomingValueForBlock(BB);
-    const SCEV *IncomingS = SE->getSCEV(Incoming);
-    CheapExpansions[IncomingS] = Incoming;
+    const int Idx = PN->getBasicBlockIndex(BB);
+    if (Idx >= 0) {
+      Value *Incoming = PN->getIncomingValue(Idx);
+      const SCEV *IncomingS = SE->getSCEV(Incoming);
+      CheapExpansions[IncomingS] = Incoming;
+    }
   }
   Value *NewLHS = CheapExpansions[InvariantLHS];
   Value *NewRHS = CheapExpansions[InvariantRHS];
 
+  if (!NewLHS)
+    if (auto *ConstLHS = dyn_cast<SCEVConstant>(InvariantLHS))
+      NewLHS = ConstLHS->getValue();
+  if (!NewRHS)
+    if (auto *ConstRHS = dyn_cast<SCEVConstant>(InvariantRHS))
+      NewRHS = ConstRHS->getValue();
+
   if (!NewLHS || !NewRHS)
     // We could not find an existing value to replace either LHS or RHS.
     // Generating new instructions has subtler tradeoffs, so avoid doing that
diff --git a/test/Transforms/IndVarSimplify/loop-invariant-conditions.ll b/test/Transforms/IndVarSimplify/loop-invariant-conditions.ll
index 1c8eb93869a..70cf714ba9f 100644
--- a/test/Transforms/IndVarSimplify/loop-invariant-conditions.ll
+++ b/test/Transforms/IndVarSimplify/loop-invariant-conditions.ll
@@ -295,6 +295,36 @@ for.end:                                          ; preds = %if.end, %entry
   ret void
 }
 
+; check that we handle conditions with loop invariant operands which
+; *aren't* in the header - this is a very rare and fragile case where
+; we have a "loop" which is known to run exactly one iteration but
+; haven't yet simplified the uses of the IV
+define void @test10() {
+; CHECK-LABEL: @test10
+entry:
+  br label %loop
+
+loop:
+  %phi1 = phi i32 [ %phi2, %latch ], [ 0, %entry ]
+  %dec = add i32 %phi1, -1
+  br i1 false, label %left, label %right
+
+left:
+  br label %latch
+
+right:
+  br label %latch
+
+latch:
+  %phi2 = phi i32 [ %phi1, %left ], [ %dec, %right ]
+  ; CHECK: %cmp = icmp slt i32 -1, undef
+  %cmp = icmp slt i32 %phi2, undef
+  br i1 true, label %exit, label %loop
+
+exit:
+  ret void
+}
+
 !1 = !{i64 -1, i64 100}
 
 
-- 
2.11.0