[ValueTracking] Let propgatesPoison consider single poison operand.

[fhahn]

Summary

This patch extends propgatesPoison to take an optional PoisonOp
argument. If not nullptr, the passed value must be an operand of I. In
that case, propagatesPoison returns true, if I yields poison or raises
UB if PoisonOp is poison.

This allows propagating poison if the condition of a select is poison.
Among other things, this helps improve results for
programUndefinedIfUndefOrPoison and allows removing special select
handling from directlyImpliesPoison.

[aqjune]

The change looks great to me.

Alive2 proofs for the changed instcombine tests:

Were the InstCombine test changes supposed to be included in this patch?

[nikic]

llvm/include/llvm/Analysis/ValueTracking.h

545

Can we make this function accept (only) a Use?

[reames]

This looks pretty reasonable to me overall. A couple high level suggestions:

• I second the suggestion of taking the new operand as a Use.
• Framing wise, I suggest making it clear that we're restricting the set of operands known to be poison. And that the nullptr value has no restriction. I found your comment and patch framing difficult to decipher. I had to work back to what you meant from the code.

(Edit - dropped my original last point as further consideration indicated it involved too much complexity in reasoning, and could be handled later if desired.)

[fhahn]

In D111643#3058773, @reames wrote:

This looks pretty reasonable to me overall. A couple high level suggestions:

• I second the suggestion of taking the new operand as a Use.

That should be doable with adjusting the callers a bit. I'll update the patch.

• Framing wise, I suggest making it clear that we're restricting the set of operands known to be poison. And that the nullptr value has no restriction. I found your comment and patch framing difficult to decipher. I had to work back to what you meant from the code.

I'll try to make it a bit clearer. I might be mis-interpreting the exact meaning of restricting, but I am not sure if that's entirely accurate. With the nullptr value, we known that at least one of the operands is poison, but we do not know which; if a value is passed, we know that exactly this value is poison.

Extending it to an ArrayRef would mean the following I think: if it is empty, at least one operand is poison, but we do not know which. Otherwise we know that all values in the ArrayRef are poison. I think the ArrayRef could also be used to communicate the fact that both options of a select are poison, hence the select itself is poison.

In D111643#3058379, @aqjune wrote:

The change looks great to me.

Alive2 proofs for the changed instcombine tests:

Were the InstCombine test changes supposed to be included in this patch?

Argh, originally they were, but it turns out there was a problem with early iterations that made us transform the test cases. While it was correct for the test cases, it was not correct in general unfortunately. I added a SCEV IR test in 4cd6cc64edb3833327601fb9eb2b5a9b6fb2bb7f

llvm/include/llvm/Analysis/ValueTracking.h

545

I think that should be possible, it just requires updating a few of the users.

[fhahn]

Change argument from const Value * to const Use *.

[nikic]

llvm/include/llvm/Analysis/ValueTracking.h

545

This isn't really what I had in mind. Why do we need both an Operator and a Use? Can't we make this API accept only a (required) Use and dispatch based on U.getUser()? Are there any usages that don't work on a specific Use?

[fhahn]

Updated to only provide propagatesPoison(const Use &PoisonOp). Note that this requires updating some of the existing users to first determine *which* operand is poison.

[fhahn]

llvm/include/llvm/Analysis/ValueTracking.h

545

That's an option. If we do not want to provide 2 versions of the function this requires updating all users to actually check which operands are poison before calling propagatesPoison. I did that in the latest iteration of the patch. It doesn't look too bad, I am not sure if the convenience of having a version that does not require specifying *which* operand may be poison would still be desirable.

[nikic]

llvm/include/llvm/Analysis/ValueTracking.h

551

nit: Too many new lines

llvm/lib/Analysis/ValueTracking.cpp

5333–5337

The isa<> check is unnecessary -- all Instructions are Operators.

5496–5497

Opr capture is unnecessary.

5627

I guess this is technically not wrong, but muddies the contract of the function a bit. I'd prefer using PoisonOp.getOperandNo() == 0 here.

llvm/lib/Transforms/Instrumentation/PoisonChecking.cpp

292–295

This doesn't look quite right to me, shouldn't this only push a check specifically for poison-propagating operands, rather than for all operands if at least one propagates?

llvm/lib/Transforms/Scalar/IndVarSimplify.cpp

798

It would probably be more elegant to implement this the same as programUndefinedIfUndefOrPoison(), but I'm okay with this for now.

[fhahn]

Address latest comments, thanks!

[fhahn]

llvm/lib/Transforms/Instrumentation/PoisonChecking.cpp

292–295

Agreed, this is more obvious now, but it should retain the original behavior, right? I'd prefer to not pull in a separate functional improvement in this patch if possible.

[nikic]

llvm/lib/Transforms/Instrumentation/PoisonChecking.cpp

292–295

If I understand correctly, ValToPoison computes "this value is definitely poison". Previously, the propagatesPoison() check told you that any poison operand would make the result also poison, so simply or'ing together ValToPoison of all operands was correct. Now that only some operands may propagate, it's no longer correct. For the select case, we should only be using the condition operand, while as written it would or all three operands.

I think your code would be correct if you replaced any_of with all_of, but only picking the right operands seems like it would be cleaner and simpler.

[fhahn]

Finally addressed outstanding comments and added tests for PoisonChecking in 869f60ffa13b.

[fhahn]

llvm/lib/Transforms/Instrumentation/PoisonChecking.cpp

292–295

Updated to check for each operand individually. Added some extra tests in 869f60ffa13bdcb02

[nikic]

llvm/include/llvm/Analysis/ValueTracking.h

631

Shouldn't this be modifying the declaration above?

llvm/lib/Analysis/ValueTracking.cpp

5808

This is incorrect, needs to be synchronized with the YieldsPoison check below.

llvm/lib/Transforms/Instrumentation/PoisonChecking.cpp

293

count/contains. Also the indentation looks broken here.

[fhahn]

Address rebase issues, thanks!

[fhahn]

llvm/include/llvm/Analysis/ValueTracking.h

631

Yeah looks like the rebase went wrong. Should be fixed now, thanks!

llvm/lib/Analysis/ValueTracking.cpp

5808

Yeah looks like the rebase went wrong here. Should be fixed now, thanks!

llvm/lib/Transforms/Instrumentation/PoisonChecking.cpp

293

updated to use count and fixed indent, thanks!

[nikic]

LGTM with updated patch description.

llvm/include/llvm/Analysis/ValueTracking.h

OverflowResult computeOverflowForSignedAdd(const AddOperator *Add,
                                            AssumptionCache *AC = nullptr,
                                            const Instruction *CxtI = nullptr,
                                            const DominatorTree *DT = nullptr);
 OverflowResult computeOverflowForUnsignedSub(const Value *LHS, const Value *RHS,
                                              const DataLayout &DL,
                                              AssumptionCache *AC,
                                              const Instruction *CxtI,
                                              const DominatorTree *DT);
 OverflowResult computeOverflowForSignedSub(const Value *LHS, const Value *RHS,
                                            const DataLayout &DL,
                                            AssumptionCache *AC,
                                            const Instruction *CxtI,
                                            const DominatorTree *DT);
 
 /// Returns true if the arithmetic part of the \p WO 's result is
 /// used only along the paths control dependent on the computation
 /// not overflowing, \p WO being an <op>.with.overflow intrinsic.
 bool isOverflowIntrinsicNoWrap(const WithOverflowInst *WO,
                                const DominatorTree &DT);
 
 /// Determine the possible constant range of an integer or vector of integer
 /// value. This is intended as a cheap, non-recursive check.
 ConstantRange computeConstantRange(const Value *V, bool ForSigned,

 
 /// Return true if this function can prove that the instruction I
 /// is executed for every iteration of the loop L.
 ///
 /// Note that this currently only considers the loop header.
 bool isGuaranteedToExecuteForEveryIteration(const Instruction *I,
                                             const Loop *L);
 
-/// Return true if I yields poison or raises UB if any of its operands is
-/// poison.
-/// Formally, given I = `r = op v1 v2 .. vN`, propagatesPoison returns true
-/// if, for all i, r is evaluated to poison or op raises UB if vi = poison.
-/// If vi is a vector or an aggregate and r is a single value, any poison
-/// element in vi should make r poison or raise UB.
+/// Return true if \p PoisonOp's user yields poison or raises UB if its
+/// operand \p PoisonOp is poison.
+///
+/// If \p PoisonOp is a vector or an aggregate and the operation's result is a
+/// single value, any poison element in /p PoisonOp should make the result
+/// poison or raise UB.
+///
 /// To filter out operands that raise UB on poison, you can use
 /// getGuaranteedNonPoisonOp.
-bool propagatesPoison(const Operator *I);
+bool propagatesPoison(const Use &PoisonOp);
 
 /// Insert operands of I into Ops such that I will trigger undefined behavior
 /// if I is executed and that operand has a poison value.
 void getGuaranteedNonPoisonOps(const Instruction *I,
                                SmallPtrSetImpl<const Value *> &Ops);
+
 /// Insert operands of I into Ops such that I will trigger undefined behavior
 /// if I is executed and that operand is not a well-defined value
 /// (i.e. has undef bits or poison).
 void getGuaranteedWellDefinedOps(const Instruction *I,
                                  SmallPtrSetImpl<const Value *> &Ops);
 
 /// Return true if the given instruction must trigger undefined behavior
 /// when I is executed with any operands which appear in KnownPoison holding
 /// a poison value at the point of execution.
 bool mustTriggerUB(const Instruction *I,
                    const SmallSet<const Value *, 16> &KnownPoison);
 
 /// Return true if this function can prove that if Inst is executed
 /// and yields a poison value or undef bits, then that will trigger
 /// undefined behavior.
 ///
 /// Note that this currently only considers the basic block that is
 /// the parent of Inst.

llvm/lib/Analysis/ScalarEvolution.cpp

bool ScalarEvolution::isAddRecNeverPoison(const Instruction *I, const Loop *L) {
   // PoisonStack.
   Pushed.insert(I);
   PoisonStack.push_back(I);
 
   bool LatchControlDependentOnPoison = false;
   while (!PoisonStack.empty() && !LatchControlDependentOnPoison) {
     const Instruction *Poison = PoisonStack.pop_back_val();
 
-    for (const auto *PoisonUser : Poison->users()) {
-      if (propagatesPoison(cast<Operator>(PoisonUser))) {
+    for (const Use &U : Poison->uses()) {
+      const User *PoisonUser = U.getUser();
+      if (propagatesPoison(U)) {
         if (Pushed.insert(cast<Instruction>(PoisonUser)).second)
           PoisonStack.push_back(cast<Instruction>(PoisonUser));
       } else if (auto *BI = dyn_cast<BranchInst>(PoisonUser)) {
         assert(BI->isConditional() && "Only possibility!");
         if (BI->getParent() == LatchBB) {
           LatchControlDependentOnPoison = true;
           break;
         }

llvm/lib/Analysis/ValueTracking.cpp

static bool directlyImpliesPoison(const Value *ValAssumedPoison,
   if (ValAssumedPoison == V)
     return true;
 
   const unsigned MaxDepth = 2;
   if (Depth >= MaxDepth)
     return false;
 
   if (const auto *I = dyn_cast<Instruction>(V)) {
-    if (propagatesPoison(cast<Operator>(I)))
-      return any_of(I->operands(), [=](const Value *Op) {
-        return directlyImpliesPoison(ValAssumedPoison, Op, Depth + 1);
-      });
+    if (any_of(I->operands(), [=](const Use &Op) {
+          return propagatesPoison(Op) &&
+                 directlyImpliesPoison(ValAssumedPoison, Op, Depth + 1);
+        }))
+      return true;
 
-    // 'select ValAssumedPoison, _, _' is poison.
-    if (const auto *SI = dyn_cast<SelectInst>(I))
-      return directlyImpliesPoison(ValAssumedPoison, SI->getCondition(),
-                                   Depth + 1);
     // V  = extractvalue V0, idx
     // V2 = extractvalue V0, idx2
     // V0's elements are all poison or not. (e.g., add_with_overflow)
     const WithOverflowInst *II;
     if (match(I, m_ExtractValue(m_WithOverflowInst(II))) &&
         (match(ValAssumedPoison, m_ExtractValue(m_Specific(II))) ||
          llvm::is_contained(II->args(), ValAssumedPoison)))
       return true;
while (Dominator) {
     }
 
     if (Cond) {
       if (Cond == V)
         return true;
       else if (PoisonOnly && isa<Operator>(Cond)) {
         // For poison, we can analyze further
         auto *Opr = cast<Operator>(Cond);
-        if (propagatesPoison(Opr) && is_contained(Opr->operand_values(), V))
+        if (any_of(Opr->operands(),
+                   [V](const Use &U) { return V == U && propagatesPoison(U); }))
           return true;
       }
     }
 
     Dominator = Dominator->getIDom();
   }
 
   if (getKnowledgeValidInContext(V, {Attribute::NoUndef}, CtxI, DT, AC))
bool llvm::isGuaranteedToExecuteForEveryIteration(const Instruction *I,
 
   for (const Instruction &LI : *L->getHeader()) {
     if (&LI == I) return true;
     if (!isGuaranteedToTransferExecutionToSuccessor(&LI)) return false;
   }
   llvm_unreachable("Instruction not contained in its own parent basic block.");
 }
 
-bool llvm::propagatesPoison(const Operator *I) {
+bool llvm::propagatesPoison(const Use &PoisonOp) {
+  const Operator *I = cast<Operator>(PoisonOp.getUser());
   switch (I->getOpcode()) {
   case Instruction::Freeze:
-  case Instruction::Select:
   case Instruction::PHI:
   case Instruction::Invoke:
     return false;
+  case Instruction::Select:
+    return PoisonOp.getOperandNo() == 0;
   case Instruction::Call:
     if (auto *II = dyn_cast<IntrinsicInst>(I)) {
       switch (II->getIntrinsicID()) {
       // TODO: Add more intrinsics.
       case Intrinsic::sadd_with_overflow:
       case Intrinsic::ssub_with_overflow:
       case Intrinsic::smul_with_overflow:
       case Intrinsic::uadd_with_overflow:
for (const auto &I : make_range(Begin, End)) {
         continue;
       if (--ScanLimit == 0)
         return false;
       if (mustTriggerUB(&I, YieldsPoison))
         return true;
       if (!isGuaranteedToTransferExecutionToSuccessor(&I))
         return false;
 
-      // If this instruction propagates poison, mark it as poison if any of
-      // its operands are poison
-      if (propagatesPoison(cast<Operator>(&I))) {
-        for (const Value *Op : I.operands()) {
-          if (YieldsPoison.count(Op)) {
-            YieldsPoison.insert(&I);
-            break;
-          }
-        }
-      }
-    }
+      // If an operand is poison and propagates it, mark I as yielding poison.
+      for (const Use &Op : I.operands()) {
+        if (YieldsPoison.count(Op) && propagatesPoison(Op)) {
 
     BB = BB->getSingleSuccessor();
     if (!BB || !Visited.insert(BB).second)
       break;
 
     Begin = BB->getFirstNonPHI()->getIterator();
     End = BB->end();
   }

llvm/lib/Transforms/Instrumentation/PoisonChecking.cpp

for (Instruction &I : BB) {
       if (LocalCheck)
         if (auto *RI = dyn_cast<ReturnInst>(&I))
           if (RI->getNumOperands() != 0) {
             Value *Op = RI->getOperand(0);
             CreateAssertNot(B, getPoisonFor(ValToPoison, Op));
           }
 
       SmallVector<Value*, 4> Checks;
-      if (propagatesPoison(cast<Operator>(&I)))
-        for (Value *V : I.operands())
-          Checks.push_back(getPoisonFor(ValToPoison, V));
+      for (const Use &U : I.operands()) {
+        if (ValToPoison.count(U) && propagatesPoison(U))
+          Checks.push_back(getPoisonFor(ValToPoison, U));
+      }
 
       if (canCreatePoison(cast<Operator>(&I)))
         generateCreationChecks(I, Checks);
       ValToPoison[&I] = buildOrChain(B, Checks);
     }
 
   for (BasicBlock &BB : F)
     for (auto I = BB.begin(); isa<PHINode>(&*I); I++) {

llvm/lib/Transforms/Scalar/IndVarSimplify.cpp

while (!Worklist.empty()) {
     const Instruction *I = Worklist.pop_back_val();
 
     // If we know this must trigger UB on a path leading our target.
     if (mustTriggerUB(I, KnownPoison) && DT->dominates(I, OnPathTo))
       return true;
 
     // If we can't analyze propagation through this instruction, just skip it
     // and transitive users.  Safe as false is a conservative result.
-    if (!propagatesPoison(cast<Operator>(I)) && I != Root)
+    if (I != Root && !any_of(I->operands(), [&KnownPoison](const Use &U) {
+          return KnownPoison.contains(U) && propagatesPoison(U);
+        }))
       continue;
 
     if (KnownPoison.insert(I).second)
       for (const User *User : I->users())
         Worklist.push_back(cast<Instruction>(User));
   }
 
   // Might be non-UB, or might have a path we couldn't prove must execute on
   // way to exiting bb.
   return false;
 }
 
 /// Recursive helper for hasConcreteDef(). Unfortunately, this currently boils

llvm/test/Analysis/ScalarEvolution/exit-count-select-safe.ll

 ; CHECK-NEXT:  Classifying expressions for: @logical_or_3ops_duplicate
 ; CHECK-NEXT:    %i = phi i32 [ 0, %entry ], [ %i.next, %loop ]
 ; CHECK-NEXT:    --> {0,+,1}<%loop> U: full-set S: full-set Exits: (%n umin_seq %m umin_seq %k) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %i.next = add i32 %i, 1
 ; CHECK-NEXT:    --> {1,+,1}<%loop> U: full-set S: full-set Exits: (1 + (%n umin_seq %m umin_seq %k)) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %cond_p4 = select i1 %cond_p0, i1 true, i1 %cond_p1
 ; CHECK-NEXT:    --> (true + ((true + %cond_p0) umin_seq (true + %cond_p1))) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:    %cond_p5 = select i1 %cond_p4, i1 true, i1 %cond_p2
-; CHECK-NEXT:    --> (true + ((true + %cond_p0) umin_seq (true + %cond_p1) umin_seq (true + %cond_p2))) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (true + ((true + %cond_p0) umin_seq ((true + %cond_p1) umin (true + %cond_p2)))) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:    %cond = select i1 %cond_p5, i1 true, i1 %cond_p3
-; CHECK-NEXT:    --> (true + ((true + %cond_p0) umin_seq (true + %cond_p1) umin_seq (true + %cond_p2) umin_seq (true + %cond_p3))) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (true + ((true + %cond_p0) umin_seq ((true + %cond_p1) umin (true + %cond_p2)) umin_seq (true + %cond_p3))) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @logical_or_3ops_duplicate
 ; CHECK-NEXT:  Loop %loop: backedge-taken count is (%n umin_seq %m umin_seq %k)
 ; CHECK-NEXT:  Loop %loop: constant max backedge-taken count is -1
 ; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is (%n umin_seq %m umin_seq %k)
 ; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is (%n umin_seq %m umin_seq %k)
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;

 ; CHECK-NEXT:  Classifying expressions for: @logical_and_2ops_and_constant
 ; CHECK-NEXT:    %i = phi i32 [ 0, %entry ], [ %i.next, %loop ]
 ; CHECK-NEXT:    --> {0,+,1}<%loop> U: [0,43) S: [0,43) Exits: (42 umin %n) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %i.next = add i32 %i, 1
 ; CHECK-NEXT:    --> {1,+,1}<%loop> U: [1,44) S: [1,44) Exits: (1 + (42 umin %n))<nuw><nsw> LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %umin = call i32 @llvm.umin.i32(i32 %n, i32 42)
 ; CHECK-NEXT:    --> (42 umin %n) U: [0,43) S: [0,43) Exits: (42 umin %n) LoopDispositions: { %loop: Invariant }
 ; CHECK-NEXT:    %cond = select i1 %cond_p1, i1 true, i1 %cond_p0
-; CHECK-NEXT:    --> (true + ((true + %cond_p1) umin_seq (true + %cond_p0))) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (true + ((true + %cond_p1) umin (true + %cond_p0))) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @logical_and_2ops_and_constant
 ; CHECK-NEXT:  Loop %loop: backedge-taken count is (42 umin %n)
 ; CHECK-NEXT:  Loop %loop: constant max backedge-taken count is 42
 ; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is (42 umin %n)
 ; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is (42 umin %n)
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;

 ; CHECK-NEXT:  Classifying expressions for: @logical_and_implies_poison1
 ; CHECK-NEXT:    %add = add i32 %n, 1
 ; CHECK-NEXT:    --> (1 + %n) U: full-set S: full-set
 ; CHECK-NEXT:    %i = phi i32 [ 0, %entry ], [ %i.next, %loop ]
 ; CHECK-NEXT:    --> {0,+,1}<%loop> U: full-set S: full-set Exits: ((1 + %n) umin %n) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %i.next = add i32 %i, 1
 ; CHECK-NEXT:    --> {1,+,1}<%loop> U: full-set S: full-set Exits: (1 + ((1 + %n) umin %n)) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %cond = select i1 %cond_p0, i1 %cond_p1, i1 false
-; CHECK-NEXT:    --> (%cond_p0 umin_seq %cond_p1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (%cond_p0 umin %cond_p1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @logical_and_implies_poison1
 ; CHECK-NEXT:  Loop %loop: backedge-taken count is ((1 + %n) umin %n)
 ; CHECK-NEXT:  Loop %loop: constant max backedge-taken count is -1
 ; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is ((1 + %n) umin %n)
 ; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is ((1 + %n) umin %n)
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;

 ; CHECK-NEXT:  Classifying expressions for: @logical_and_implies_poison2
 ; CHECK-NEXT:    %add = add i32 %n, 1
 ; CHECK-NEXT:    --> (1 + %n) U: full-set S: full-set
 ; CHECK-NEXT:    %i = phi i32 [ 0, %entry ], [ %i.next, %loop ]
 ; CHECK-NEXT:    --> {0,+,1}<%loop> U: full-set S: full-set Exits: ((1 + %n) umin %n) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %i.next = add i32 %i, 1
 ; CHECK-NEXT:    --> {1,+,1}<%loop> U: full-set S: full-set Exits: (1 + ((1 + %n) umin %n)) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %cond = select i1 %cond_p0, i1 %cond_p1, i1 false
-; CHECK-NEXT:    --> (%cond_p0 umin_seq %cond_p1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (%cond_p1 umin %cond_p0) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @logical_and_implies_poison2
 ; CHECK-NEXT:  Loop %loop: backedge-taken count is ((1 + %n) umin %n)
 ; CHECK-NEXT:  Loop %loop: constant max backedge-taken count is -1
 ; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is ((1 + %n) umin %n)
 ; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is ((1 + %n) umin %n)
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;

 ; CHECK-NEXT:  Classifying expressions for: @logical_and_implies_poison3
 ; CHECK-NEXT:    %add = add i32 %n, %m
 ; CHECK-NEXT:    --> (%n + %m) U: full-set S: full-set
 ; CHECK-NEXT:    %i = phi i32 [ 0, %entry ], [ %i.next, %loop ]
 ; CHECK-NEXT:    --> {0,+,1}<%loop> U: full-set S: full-set Exits: ((%n + %m) umin %n) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %i.next = add i32 %i, 1
 ; CHECK-NEXT:    --> {1,+,1}<%loop> U: full-set S: full-set Exits: (1 + ((%n + %m) umin %n)) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %cond = select i1 %cond_p0, i1 %cond_p1, i1 false
-; CHECK-NEXT:    --> (%cond_p0 umin_seq %cond_p1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (%cond_p1 umin %cond_p0) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @logical_and_implies_poison3
 ; CHECK-NEXT:  Loop %loop: backedge-taken count is ((%n + %m) umin %n)
 ; CHECK-NEXT:  Loop %loop: constant max backedge-taken count is -1
 ; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is ((%n + %m) umin %n)
 ; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is ((%n + %m) umin %n)
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;

 define i32 @logical_and_implies_poison_noundef(i32 %n, i32 noundef %m) {
 ; CHECK-LABEL: 'logical_and_implies_poison_noundef'
 ; CHECK-NEXT:  Classifying expressions for: @logical_and_implies_poison_noundef
 ; CHECK-NEXT:    %i = phi i32 [ 0, %entry ], [ %i.next, %loop ]
 ; CHECK-NEXT:    --> {0,+,1}<%loop> U: full-set S: full-set Exits: (%n umin %m) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %i.next = add i32 %i, 1
 ; CHECK-NEXT:    --> {1,+,1}<%loop> U: full-set S: full-set Exits: (1 + (%n umin %m)) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %cond = select i1 %cond_p0, i1 %cond_p1, i1 false
-; CHECK-NEXT:    --> (%cond_p0 umin_seq %cond_p1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (%cond_p0 umin %cond_p1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @logical_and_implies_poison_noundef
 ; CHECK-NEXT:  Loop %loop: backedge-taken count is (%n umin %m)
 ; CHECK-NEXT:  Loop %loop: constant max backedge-taken count is -1
 ; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is (%n umin %m)
 ; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is (%n umin %m)
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;

 ; CHECK-NEXT:    --> (%n + %m) U: full-set S: full-set
 ; CHECK-NEXT:    %add1 = add i32 %add, 1
 ; CHECK-NEXT:    --> (1 + %n + %m) U: full-set S: full-set
 ; CHECK-NEXT:    %i = phi i32 [ 0, %entry ], [ %i.next, %loop ]
 ; CHECK-NEXT:    --> {0,+,1}<%loop> U: full-set S: full-set Exits: ((%n + %m) umin (1 + %n + %m)) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %i.next = add i32 %i, 1
 ; CHECK-NEXT:    --> {1,+,1}<%loop> U: full-set S: full-set Exits: (1 + ((%n + %m) umin (1 + %n + %m))) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %cond = select i1 %cond_p0, i1 %cond_p1, i1 false
-; CHECK-NEXT:    --> (%cond_p0 umin_seq %cond_p1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (%cond_p0 umin %cond_p1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @logical_and_implies_poison_complex1
 ; CHECK-NEXT:  Loop %loop: backedge-taken count is ((%n + %m) umin (1 + %n + %m))
 ; CHECK-NEXT:  Loop %loop: constant max backedge-taken count is -1
 ; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is ((%n + %m) umin (1 + %n + %m))
 ; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is ((%n + %m) umin (1 + %n + %m))
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;

 ; CHECK-NEXT:    --> (%n + %m) U: full-set S: full-set
 ; CHECK-NEXT:    %add1 = add i32 %add, %l
 ; CHECK-NEXT:    --> (%n + %m + %l) U: full-set S: full-set
 ; CHECK-NEXT:    %i = phi i32 [ 0, %entry ], [ %i.next, %loop ]
 ; CHECK-NEXT:    --> {0,+,1}<%loop> U: full-set S: full-set Exits: ((%n + %m) umin (%n + %m + %l)) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %i.next = add i32 %i, 1
 ; CHECK-NEXT:    --> {1,+,1}<%loop> U: full-set S: full-set Exits: (1 + ((%n + %m) umin (%n + %m + %l))) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %cond = select i1 %cond_p0, i1 %cond_p1, i1 false
-; CHECK-NEXT:    --> (%cond_p0 umin_seq %cond_p1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (%cond_p0 umin %cond_p1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @logical_and_implies_poison_complex2
 ; CHECK-NEXT:  Loop %loop: backedge-taken count is ((%n + %m) umin (%n + %m + %l))
 ; CHECK-NEXT:  Loop %loop: constant max backedge-taken count is -1
 ; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is ((%n + %m) umin (%n + %m + %l))
 ; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is ((%n + %m) umin (%n + %m + %l))
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;

 ; CHECK-NEXT:  Classifying expressions for: @logical_and_implies_multiple_ops
 ; CHECK-NEXT:    %add = add i32 %n, 1
 ; CHECK-NEXT:    --> (1 + %n) U: full-set S: full-set
 ; CHECK-NEXT:    %i = phi i32 [ 0, %entry ], [ %i.next, %loop ]
 ; CHECK-NEXT:    --> {0,+,1}<%loop> U: full-set S: full-set Exits: (((1 + %n) umin %n) umin_seq %m) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %i.next = add i32 %i, 1
 ; CHECK-NEXT:    --> {1,+,1}<%loop> U: full-set S: full-set Exits: (1 + (((1 + %n) umin %n) umin_seq %m)) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %cond = select i1 %cond_p0, i1 %cond_p1, i1 false
-; CHECK-NEXT:    --> (%cond_p0 umin_seq %cond_p1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (%cond_p0 umin %cond_p1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:    %cond2 = select i1 %cond, i1 %cond_p2, i1 false
-; CHECK-NEXT:    --> (%cond_p0 umin_seq %cond_p1 umin_seq %cond_p2) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> ((%cond_p0 umin %cond_p1) umin_seq %cond_p2) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @logical_and_implies_multiple_ops
 ; CHECK-NEXT:  Loop %loop: backedge-taken count is (((1 + %n) umin %n) umin_seq %m)
 ; CHECK-NEXT:  Loop %loop: constant max backedge-taken count is -1
 ; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is (((1 + %n) umin %n) umin_seq %m)
 ; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is (((1 + %n) umin %n) umin_seq %m)
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;

 }
 
 define i32 @logical_and_implies_multiple_ops2(i32 %n, i32 %m) {
 ; CHECK-LABEL: 'logical_and_implies_multiple_ops2'
 ; CHECK-NEXT:  Classifying expressions for: @logical_and_implies_multiple_ops2
 ; CHECK-NEXT:    %add = add i32 %n, 1
 ; CHECK-NEXT:    --> (1 + %n) U: full-set S: full-set
 ; CHECK-NEXT:    %i = phi i32 [ 0, %entry ], [ %i.next, %loop ]
-; CHECK-NEXT:    --> {0,+,1}<%loop> U: full-set S: full-set Exits: (%n umin_seq %m umin_seq (1 + %n)) LoopDispositions: { %loop: Computable }
+; CHECK-NEXT:    --> {0,+,1}<%loop> U: full-set S: full-set Exits: (%n umin_seq ((1 + %n) umin %m)) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %i.next = add i32 %i, 1
-; CHECK-NEXT:    --> {1,+,1}<%loop> U: full-set S: full-set Exits: (1 + (%n umin_seq %m umin_seq (1 + %n))) LoopDispositions: { %loop: Computable }
+; CHECK-NEXT:    --> {1,+,1}<%loop> U: full-set S: full-set Exits: (1 + (%n umin_seq ((1 + %n) umin %m))) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %cond = select i1 %cond_p0, i1 %cond_p1, i1 false
 ; CHECK-NEXT:    --> (%cond_p0 umin_seq %cond_p1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:    %cond2 = select i1 %cond, i1 %cond_p2, i1 false
-; CHECK-NEXT:    --> (%cond_p0 umin_seq %cond_p1 umin_seq %cond_p2) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (%cond_p0 umin_seq (%cond_p1 umin %cond_p2)) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @logical_and_implies_multiple_ops2
-; CHECK-NEXT:  Loop %loop: backedge-taken count is (%n umin_seq %m umin_seq (1 + %n))
+; CHECK-NEXT:  Loop %loop: backedge-taken count is (%n umin_seq ((1 + %n) umin %m))
 ; CHECK-NEXT:  Loop %loop: constant max backedge-taken count is -1
-; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is (%n umin_seq %m umin_seq (1 + %n))
-; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is (%n umin_seq %m umin_seq (1 + %n))
+; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is (%n umin_seq ((1 + %n) umin %m))
+; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is (%n umin_seq ((1 + %n) umin %m))
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;
 entry:
   %add = add i32 %n, 1
   br label %loop
 loop:
   %i = phi i32 [0, %entry], [%i.next, %loop]

 define i32 @logical_and_zero_arg2(i32 %n) {
 ; CHECK-LABEL: 'logical_and_zero_arg2'
 ; CHECK-NEXT:  Classifying expressions for: @logical_and_zero_arg2
 ; CHECK-NEXT:    %i = phi i32 [ 0, %entry ], [ %i.next, %loop ]
 ; CHECK-NEXT:    --> {0,+,1}<%loop> U: [0,1) S: [0,1) Exits: 0 LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %i.next = add i32 %i, 1
 ; CHECK-NEXT:    --> {1,+,1}<%loop> U: [1,2) S: [1,2) Exits: 1 LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %cond = select i1 %cond_p0, i1 %cond_p1, i1 false
-; CHECK-NEXT:    --> (%cond_p0 umin_seq %cond_p1) U: full-set S: full-set Exits: false LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (%cond_p1 umin %cond_p0) U: full-set S: full-set Exits: false LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @logical_and_zero_arg2
 ; CHECK-NEXT:  Loop %loop: backedge-taken count is 0
 ; CHECK-NEXT:  Loop %loop: constant max backedge-taken count is 0
 ; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is 0
 ; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is 0
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;

llvm/test/Analysis/ScalarEvolution/exit-count-select.ll

 ; NOTE: Assertions have been autogenerated by utils/update_analyze_test_checks.py
 ; RUN: opt -disable-output "-passes=print<scalar-evolution>" %s 2>&1 | FileCheck %s
 
 ; If m is constant, exact-not-taken is umin(n, m)
 ; https://alive2.llvm.org/ce/z/ZTNXgY
 define void @logical_and_m_const(i32 %n) {
 ; CHECK-LABEL: 'logical_and_m_const'
 ; CHECK-NEXT:  Classifying expressions for: @logical_and_m_const
 ; CHECK-NEXT:    %i = phi i32 [ 0, %entry ], [ %i.next, %loop ]
 ; CHECK-NEXT:    --> {0,+,1}<%loop> U: [0,3) S: [0,3) Exits: (2 umin %n) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %i.next = add i32 %i, 1
 ; CHECK-NEXT:    --> {1,+,1}<%loop> U: [1,4) S: [1,4) Exits: (1 + (2 umin %n))<nuw><nsw> LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %cond = select i1 %cond_i, i1 %cond_i2, i1 false
-; CHECK-NEXT:    --> (%cond_i umin_seq %cond_i2) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (%cond_i2 umin %cond_i) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @logical_and_m_const
 ; CHECK-NEXT:  Loop %loop: backedge-taken count is (2 umin %n)
 ; CHECK-NEXT:  Loop %loop: constant max backedge-taken count is 2
 ; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is (2 umin %n)
 ; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is (2 umin %n)
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;

 define void @logical_or_m_const(i32 %n) {
 ; CHECK-LABEL: 'logical_or_m_const'
 ; CHECK-NEXT:  Classifying expressions for: @logical_or_m_const
 ; CHECK-NEXT:    %i = phi i32 [ 0, %entry ], [ %i.next, %loop ]
 ; CHECK-NEXT:    --> {0,+,1}<%loop> U: [0,3) S: [0,3) Exits: (2 umin %n) LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %i.next = add i32 %i, 1
 ; CHECK-NEXT:    --> {1,+,1}<%loop> U: [1,4) S: [1,4) Exits: (1 + (2 umin %n))<nuw><nsw> LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %cond = select i1 %cond_i, i1 true, i1 %cond_i2
-; CHECK-NEXT:    --> (true + ((true + %cond_i) umin_seq (true + %cond_i2))) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
+; CHECK-NEXT:    --> (true + ((true + %cond_i) umin (true + %cond_i2))) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @logical_or_m_const
 ; CHECK-NEXT:  Loop %loop: backedge-taken count is (2 umin %n)
 ; CHECK-NEXT:  Loop %loop: constant max backedge-taken count is 2
 ; CHECK-NEXT:  Loop %loop: symbolic max backedge-taken count is (2 umin %n)
 ; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is (2 umin %n)
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;

llvm/test/Analysis/ScalarEvolution/nsw.ll

 }
 
 define void @select_cond_poison_propagation(ptr %p, i32 %x) nounwind {
 ; CHECK-LABEL: 'select_cond_poison_propagation'
 ; CHECK-NEXT:  Classifying expressions for: @select_cond_poison_propagation
 ; CHECK-NEXT:    %iv = phi i32 [ %iv.next, %loop ], [ 0, %entry ]
 ; CHECK-NEXT:    --> {0,+,1}<nuw><nsw><%loop> U: [0,-2147483648) S: [0,-2147483648) Exits: <<Unknown>> LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %iv.next = add nsw i32 %iv, 1
-; CHECK-NEXT:    --> {1,+,1}<nuw><%loop> U: [1,0) S: [1,0) Exits: <<Unknown>> LoopDispositions: { %loop: Computable }
+; CHECK-NEXT:    --> {1,+,1}<nuw><nsw><%loop> U: [1,-2147483648) S: [1,-2147483648) Exits: <<Unknown>> LoopDispositions: { %loop: Computable }
 ; CHECK-NEXT:    %sel = select i1 %cmp, i32 10, i32 20
 ; CHECK-NEXT:    --> %sel U: [0,31) S: [0,31) Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:    %cond = call i1 @cond()
 ; CHECK-NEXT:    --> %cond U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %loop: Variant }
 ; CHECK-NEXT:  Determining loop execution counts for: @select_cond_poison_propagation
 ; CHECK-NEXT:  Loop %loop: Unpredictable backedge-taken count.
 ; CHECK-NEXT:  Loop %loop: Unpredictable constant max backedge-taken count.
 ; CHECK-NEXT:  Loop %loop: Unpredictable symbolic max backedge-taken count.

llvm/test/Instrumentation/PoisonChecking/ub-checks.ll

 
 define noundef i32 @select_cond_may_be_poison(i32 %a, i32 %b) {
 ; CHECK-LABEL: @select_cond_may_be_poison(
 ; CHECK-NEXT:    [[TMP1:%.*]] = call { i32, i1 } @llvm.uadd.with.overflow.i32(i32 [[A:%.*]], i32 1)
 ; CHECK-NEXT:    [[TMP2:%.*]] = extractvalue { i32, i1 } [[TMP1]], 1
 ; CHECK-NEXT:    [[ADD:%.*]] = add nuw i32 [[A]], 1
 ; CHECK-NEXT:    [[T:%.*]] = trunc i32 [[ADD]] to i1
 ; CHECK-NEXT:    [[SEL:%.*]] = select i1 [[T]], i32 [[ADD]], i32 [[B:%.*]]
+; CHECK-NEXT:    [[TMP3:%.*]] = xor i1 [[TMP2]], true
+; CHECK-NEXT:    call void @__poison_checker_assert(i1 [[TMP3]])
 ; CHECK-NEXT:    ret i32 [[SEL]]
 ;
   %add = add nuw i32 %a, 1
   %t = trunc i32 %add to i1
   %sel = select i1 %t, i32 %add, i32 %b
   ret i32 %sel
 }
 

llvm/unittests/Analysis/ValueTrackingTest.cpp

std::string AsmHead =
       "declare i64 @llvm.llround.f32(float)\n"
       "declare i32 @llvm.lrint.f32(float)\n"
       "declare i64 @llvm.llrint.f32(float)\n"
       "declare float @llvm.fmuladd.f32(float, float, float)\n"
       "define void @f(i32 %x, i32 %y, float %fx, float %fy, "
       "i1 %cond, i8* %p) {\n";
   std::string AsmTail = "  ret void\n}";
   // (propagates poison?, IR instruction)
-  SmallVector<std::pair<bool, std::string>, 32> Data = {
-      {true, "add i32 %x, %y"},
-      {true, "add nsw nuw i32 %x, %y"},
-      {true, "ashr i32 %x, %y"},
-      {true, "lshr exact i32 %x, 31"},
-      {true, "fadd float %fx, %fy"},
-      {true, "fsub float %fx, %fy"},
-      {true, "fmul float %fx, %fy"},
-      {true, "fdiv float %fx, %fy"},
-      {true, "frem float %fx, %fy"},
-      {true, "fneg float %fx"},
-      {true, "fcmp oeq float %fx, %fy"},
-      {true, "icmp eq i32 %x, %y"},
-      {true, "getelementptr i8, i8* %p, i32 %x"},
-      {true, "getelementptr inbounds i8, i8* %p, i32 %x"},
-      {true, "bitcast float %fx to i32"},
-      {false, "select i1 %cond, i32 %x, i32 %y"},
-      {false, "freeze i32 %x"},
-      {true, "udiv i32 %x, %y"},
-      {true, "urem i32 %x, %y"},
-      {true, "sdiv exact i32 %x, %y"},
-      {true, "srem i32 %x, %y"},
-      {false, "call i32 @g(i32 %x)"},
-      {true, "call {i32, i1} @llvm.sadd.with.overflow.i32(i32 %x, i32 %y)"},
-      {true, "call {i32, i1} @llvm.ssub.with.overflow.i32(i32 %x, i32 %y)"},
-      {true, "call {i32, i1} @llvm.smul.with.overflow.i32(i32 %x, i32 %y)"},
-      {true, "call {i32, i1} @llvm.uadd.with.overflow.i32(i32 %x, i32 %y)"},
-      {true, "call {i32, i1} @llvm.usub.with.overflow.i32(i32 %x, i32 %y)"},
-      {true, "call {i32, i1} @llvm.umul.with.overflow.i32(i32 %x, i32 %y)"},
-      {false, "call float @llvm.sqrt.f32(float %fx)"},
-      {false, "call float @llvm.powi.f32.i32(float %fx, i32 %x)"},
-      {false, "call float @llvm.sin.f32(float %fx)"},
-      {false, "call float @llvm.cos.f32(float %fx)"},
-      {false, "call float @llvm.pow.f32(float %fx, float %fy)"},
-      {false, "call float @llvm.exp.f32(float %fx)"},
-      {false, "call float @llvm.exp2.f32(float %fx)"},
-      {false, "call float @llvm.log.f32(float %fx)"},
-      {false, "call float @llvm.log10.f32(float %fx)"},
-      {false, "call float @llvm.log2.f32(float %fx)"},
-      {false, "call float @llvm.fma.f32(float %fx, float %fx, float %fy)"},
-      {false, "call float @llvm.fabs.f32(float %fx)"},
-      {false, "call float @llvm.minnum.f32(float %fx, float %fy)"},
-      {false, "call float @llvm.maxnum.f32(float %fx, float %fy)"},
-      {false, "call float @llvm.minimum.f32(float %fx, float %fy)"},
-      {false, "call float @llvm.maximum.f32(float %fx, float %fy)"},
-      {false, "call float @llvm.copysign.f32(float %fx, float %fy)"},
-      {false, "call float @llvm.floor.f32(float %fx)"},
-      {false, "call float @llvm.ceil.f32(float %fx)"},
-      {false, "call float @llvm.trunc.f32(float %fx)"},
-      {false, "call float @llvm.rint.f32(float %fx)"},
-      {false, "call float @llvm.nearbyint.f32(float %fx)"},
-      {false, "call float @llvm.round.f32(float %fx)"},
-      {false, "call float @llvm.roundeven.f32(float %fx)"},
-      {false, "call i32 @llvm.lround.f32(float %fx)"},
-      {false, "call i64 @llvm.llround.f32(float %fx)"},
-      {false, "call i32 @llvm.lrint.f32(float %fx)"},
-      {false, "call i64 @llvm.llrint.f32(float %fx)"},
-      {false, "call float @llvm.fmuladd.f32(float %fx, float %fx, float %fy)"}};
+  SmallVector<std::tuple<bool, std::string, unsigned>, 32> Data = {
+      {true, "add i32 %x, %y", 0},
+      {true, "add i32 %x, %y", 1},
+      {true, "add nsw nuw i32 %x, %y", 0},
+      {true, "add nsw nuw i32 %x, %y", 1},
+      {true, "ashr i32 %x, %y", 0},
+      {true, "ashr i32 %x, %y", 1},
+      {true, "lshr exact i32 %x, 31", 0},
+      {true, "lshr exact i32 %x, 31", 1},
+      {true, "fadd float %fx, %fy", 0},
+      {true, "fadd float %fx, %fy", 1},
+      {true, "fsub float %fx, %fy", 0},
+      {true, "fsub float %fx, %fy", 1},
+      {true, "fmul float %fx, %fy", 0},
+      {true, "fmul float %fx, %fy", 1},
+      {true, "fdiv float %fx, %fy", 0},
+      {true, "fdiv float %fx, %fy", 1},
+      {true, "frem float %fx, %fy", 0},
+      {true, "frem float %fx, %fy", 1},
+      {true, "fneg float %fx", 0},
+      {true, "fcmp oeq float %fx, %fy", 0},
+      {true, "fcmp oeq float %fx, %fy", 1},
+      {true, "icmp eq i32 %x, %y", 0},
+      {true, "icmp eq i32 %x, %y", 1},
+      {true, "getelementptr i8, i8* %p, i32 %x", 0},
+      {true, "getelementptr i8, i8* %p, i32 %x", 1},
+      {true, "getelementptr inbounds i8, i8* %p, i32 %x", 0},
+      {true, "getelementptr inbounds i8, i8* %p, i32 %x", 1},
+      {true, "bitcast float %fx to i32", 0},
+      {true, "select i1 %cond, i32 %x, i32 %y", 0},
+      {false, "select i1 %cond, i32 %x, i32 %y", 1},
+      {false, "select i1 %cond, i32 %x, i32 %y", 2},
+      {false, "freeze i32 %x", 0},
+      {true, "udiv i32 %x, %y", 0},
+      {true, "udiv i32 %x, %y", 1},
+      {true, "urem i32 %x, %y", 0},
+      {true, "urem i32 %x, %y", 1},
+      {true, "sdiv exact i32 %x, %y", 0},
+      {true, "sdiv exact i32 %x, %y", 1},
+      {true, "srem i32 %x, %y", 0},
+      {true, "srem i32 %x, %y", 1},
+      {false, "call i32 @g(i32 %x)", 0},
+      {false, "call i32 @g(i32 %x)", 1},
+      {true, "call {i32, i1} @llvm.sadd.with.overflow.i32(i32 %x, i32 %y)", 0},
+      {true, "call {i32, i1} @llvm.ssub.with.overflow.i32(i32 %x, i32 %y)", 0},
+      {true, "call {i32, i1} @llvm.smul.with.overflow.i32(i32 %x, i32 %y)", 0},
+      {true, "call {i32, i1} @llvm.uadd.with.overflow.i32(i32 %x, i32 %y)", 0},
+      {true, "call {i32, i1} @llvm.usub.with.overflow.i32(i32 %x, i32 %y)", 0},
+      {true, "call {i32, i1} @llvm.umul.with.overflow.i32(i32 %x, i32 %y)", 0},
+      {false, "call float @llvm.sqrt.f32(float %fx)", 0},
+      {false, "call float @llvm.powi.f32.i32(float %fx, i32 %x)", 0},
+      {false, "call float @llvm.sin.f32(float %fx)", 0},
+      {false, "call float @llvm.cos.f32(float %fx)", 0},
+      {false, "call float @llvm.pow.f32(float %fx, float %fy)", 0},
+      {false, "call float @llvm.exp.f32(float %fx)", 0},
+      {false, "call float @llvm.exp2.f32(float %fx)", 0},
+      {false, "call float @llvm.log.f32(float %fx)", 0},
+      {false, "call float @llvm.log10.f32(float %fx)", 0},
+      {false, "call float @llvm.log2.f32(float %fx)", 0},
+      {false, "call float @llvm.fma.f32(float %fx, float %fx, float %fy)", 0},
+      {false, "call float @llvm.fabs.f32(float %fx)", 0},
+      {false, "call float @llvm.minnum.f32(float %fx, float %fy)", 0},
+      {false, "call float @llvm.maxnum.f32(float %fx, float %fy)", 0},
+      {false, "call float @llvm.minimum.f32(float %fx, float %fy)", 0},
+      {false, "call float @llvm.maximum.f32(float %fx, float %fy)", 0},
+      {false, "call float @llvm.copysign.f32(float %fx, float %fy)", 0},
+      {false, "call float @llvm.floor.f32(float %fx)", 0},
+      {false, "call float @llvm.ceil.f32(float %fx)", 0},
+      {false, "call float @llvm.trunc.f32(float %fx)", 0},
+      {false, "call float @llvm.rint.f32(float %fx)", 0},
+      {false, "call float @llvm.nearbyint.f32(float %fx)", 0},
+      {false, "call float @llvm.round.f32(float %fx)", 0},
+      {false, "call float @llvm.roundeven.f32(float %fx)", 0},
+      {false, "call i32 @llvm.lround.f32(float %fx)", 0},
+      {false, "call i64 @llvm.llround.f32(float %fx)", 0},
+      {false, "call i32 @llvm.lrint.f32(float %fx)", 0},
+      {false, "call i64 @llvm.llrint.f32(float %fx)", 0},
+      {false, "call float @llvm.fmuladd.f32(float %fx, float %fx, float %fy)",
+       0}};
 
   std::string AssemblyStr = AsmHead;
   for (auto &Itm : Data)
-    AssemblyStr += Itm.second + "\n";
+    AssemblyStr += std::get<1>(Itm) + "\n";
   AssemblyStr += AsmTail;
 
   LLVMContext Context;
   SMDiagnostic Error;
   auto M = parseAssemblyString(AssemblyStr, Error, Context);
   assert(M && "Bad assembly?");
 
   auto *F = M->getFunction("f");
   assert(F && "Bad assembly?");
 
   auto &BB = F->getEntryBlock();
 
   int Index = 0;
   for (auto &I : BB) {
     if (isa<ReturnInst>(&I))
       break;
-    EXPECT_EQ(propagatesPoison(cast<Operator>(&I)), Data[Index].first)
+    bool ExpectedVal = std::get<0>(Data[Index]);
+    unsigned OpIdx = std::get<2>(Data[Index]);
+    EXPECT_EQ(propagatesPoison(I.getOperandUse(OpIdx)), ExpectedVal)
         << "Incorrect answer at instruction " << Index << " = " << I;
     Index++;
   }
 }
 
 TEST_F(ValueTrackingTest, programUndefinedIfPoison) {
   parseAssembly("declare i32 @any_num()"
                 "define void @test(i32 %mask) {\n"