[LVI] Look through negations when evaluating conditions

[loladiro]

Summary

This teaches LVI (and thus CVP) to extract range information
from branches whose condition is negated using (xor %c, true).
The implementation is relatively straightforward, simply computing
the inverse of the relevant lattice information.

I think the biggest question here is why this negation shows up
here at all. After all, it should always be possible for some
other pass to fold such a negation into a branch, comparison or
some other logical operation. Indeed, instcombine does just that.
However, these negations can be otherwise fairly persistent, e.g.
instsimplify is not able to exchange branch conditions from
negations. In addition, jumpthreading, which sits at the same
point in default pass pipeline also handles this pattern, which
adds further evidence that we might expect these negations to
not have been canonicalized away yet at this point in the pass
pipeline.

In the particular case I was looking at there was a bit of a
circular dependency where flags computed by cvp were needed
by instcombine, and incstombine's folding of the negation was
needed for cvp. Adding a second instombine pass would have
worked of course, but instcombine can be somewhat expensive,
so it appeared desirable to not require it to have run
before cvp (as is the case in the default pass pipeline).

[nikic]

llvm/lib/Analysis/LazyValueInfo.cpp

1207

Hm, I don't think this is correct if N is and and/or, or generally in any case where the returned lattice value does not represent the condition exactly, but is a superset. Inversion would exclude that difference between the exact set and superset. I'd suggest adding a test case for some case where getValueFromCondition() performs an approximation.

Could we instead flip isTrueDest, i.e. do something like this at the top?

Value *N;
if (match(Cond, m_Not(m_Value(N)))) {
  isTrueDest = !isTrueDest;
  Cond = N;
}

[loladiro]

llvm/lib/Analysis/LazyValueInfo.cpp

1207

Good catch, though I don't think that would be correct either, because then the caching logic is incorrect. However, I think we could just add isTrueDest to the cache key and then this should work fine. Let me do that.

[loladiro]

Updated to fix bug when lattice overapproximates a value

[nikic]

LGTM

In the particular case I was looking at there was a bit of a
circular dependency where flags computed by cvp were needed
by instcombine, and incstombine's folding of the negation was
needed for cvp

You might want to add a PhaseOrdering test to make sure your case keeps working.

llvm/lib/Analysis/LazyValueInfo.cpp

1184

interested

llvm/lib/Analysis/LazyValueInfo.cpp

 //===- LazyValueInfo.cpp - Value constraint analysis ------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
ConstantRange Range =
       A.getConstantRange().intersectWith(B.getConstantRange());
   // Note: An empty range is implicitly converted to unknown or undef depending
   // on MayIncludeUndef internally.
   return ValueLatticeElement::getRange(
       std::move(Range), /*MayIncludeUndef=*/A.isConstantRangeIncludingUndef() ||
                             B.isConstantRangeIncludingUndef());
 }
 
+static ValueLatticeElement inverse(const ValueLatticeElement &A)
+{
+  if (A.isUnknown() || A.isUndef() || A.isOverdefined())
+    return A;
+
+  if (A.isConstant())
+    return ValueLatticeElement::getNot(A.getConstant());
+
+  if (A.isNotConstant())
+    return ValueLatticeElement::get(A.getNotConstant());
+
+  ConstantRange Range = A.getConstantRange().inverse();
+  return ValueLatticeElement::getRange(Range, A.isConstantRangeIncludingUndef());
+}
+
 //===----------------------------------------------------------------------===//
 //                          LazyValueInfoCache Decl
 //===----------------------------------------------------------------------===//
 
 namespace {
   /// A callback value handle updates the cache when values are erased.
   class LazyValueInfoCache;
   struct LVIValueHandle final : public CallbackVH {
static ValueLatticeElement getValueFromOverflowCondition(
 
   // If overflow is false, %x is constrained to NWR. If overflow is true, %x is
   // constrained to it's inverse (all values that might cause overflow).
   if (IsTrueDest)
     NWR = NWR.inverse();
   return ValueLatticeElement::getRange(NWR);
 }
 
 static std::optional<ValueLatticeElement>
 getValueFromConditionImpl(Value *Val, Value *Cond, bool isTrueDest,
                           bool isRevisit,
                           SmallDenseMap<Value *, ValueLatticeElement> &Visited,
                           SmallVectorImpl<Value *> &Worklist) {
   if (!isRevisit) {
     if (ICmpInst *ICI = dyn_cast<ICmpInst>(Cond))
       return getValueFromICmpCondition(Val, ICI, isTrueDest);
 
     if (auto *EVI = dyn_cast<ExtractValueInst>(Cond))
       if (auto *WO = dyn_cast<WithOverflowInst>(EVI->getAggregateOperand()))
         if (EVI->getNumIndices() == 1 && *EVI->idx_begin() == 1)
           return getValueFromOverflowCondition(Val, WO, isTrueDest);
   }
 
+  Value *N;
+  if (match(Cond, m_Not(m_Value(N)))) {
+    auto NV = Visited.find(N);
+    if (NV == Visited.end()) {
+      Worklist.push_back(N);
+      return std::nullopt;
+    }
+    return inverse(NV->second);
+  }
+
   Value *L, *R;
   bool IsAnd;
   if (match(Cond, m_LogicalAnd(m_Value(L), m_Value(R))))
     IsAnd = true;
   else if (match(Cond, m_LogicalOr(m_Value(L), m_Value(R))))
     IsAnd = false;
   else
     return ValueLatticeElement::getOverdefined();

llvm/test/Transforms/CorrelatedValuePropagation/basic.ll

;
   store i1 %c2, i1* %p
   %c3 = icmp ule i8 %xor, 175
   store i1 %c3, i1* %p
   %c4 = icmp ult i8 %xor, 175
   store i1 %c4, i1* %p
   ret void
 }
 
+define i1 @xor_neg_cond(i32 %a) {
+; CHECK-LABEL: @xor_neg_cond(
+; CHECK-NEXT:    [[CMP1:%.*]] = icmp eq i32 [[A:%.*]], 10
+; CHECK-NEXT:    [[XOR:%.*]] = xor i1 [[CMP1]], true
+; CHECK-NEXT:    br i1 [[XOR]], label [[EXIT:%.*]], label [[GUARD:%.*]]
+; CHECK:       guard:
+; CHECK-NEXT:    ret i1 true
+; CHECK:       exit:
+; CHECK-NEXT:    ret i1 false
+;
+  %cmp1 = icmp eq i32 %a, 10
+  %xor = xor i1 %cmp1, true
+  br i1 %xor, label %exit, label %guard
+
+guard:
+  %cmp2 = icmp eq i32 %a, 10
+  ret i1 %cmp2
+
+exit:
+  ret i1 false
+}
+
 declare i32 @llvm.uadd.sat.i32(i32, i32)
 declare i32 @llvm.usub.sat.i32(i32, i32)
 declare i32 @llvm.sadd.sat.i32(i32, i32)
 declare i32 @llvm.ssub.sat.i32(i32, i32)
 declare void @llvm.assume(i1)