[LoopFlattening] Check for extra uses on Mul

[dmgreen]

Summary

Similar to D138404, we were not guarding against extra uses of the Mul. In most cases other checks would catch the issue due to unsupported instructions in the outer loop, but certain non-canonical loop forms could still get through.

Fixes #59339

[SjoerdMeijer]

Thanks a lot for fixing this!

llvm/test/Transforms/LoopFlatten/pr59339.ll

4

This comment can now be removed, or perhaps better adjusted.

[nikic]

Please avoid unnamed instructions/blocks in tests, which make future updates a PITA. You can avoid this using opt -passes=instnamer.

llvm/lib/Transforms/Scalar/LoopFlatten.cpp

bool IsAddTrunc =
                                   m_Value(MatchedItCount)));
 
     if (!MatchedItCount)
       return false;
 
     LLVM_DEBUG(dbgs() << "Matched multiplication: "; MatchedMul->dump());
     LLVM_DEBUG(dbgs() << "Matched iteration count: "; MatchedItCount->dump());
 
+    // The mul should not have any other uses. Widening may leave trivially dead
+    // uses, which can be ignored.
+    if (count_if(MatchedMul->users(), [](User *U) {
+          return !isInstructionTriviallyDead(cast<Instruction>(U));
+        }) > 1) {
+      LLVM_DEBUG(dbgs() << "Multiply has more than one use\n");
+      return false;
+    }
+
     // Look through extends if the IV has been widened. Don't look through
     // extends if we already looked through a trunc.
     if (Widened && IsAdd &&
         (isa<SExtInst>(MatchedItCount) || isa<ZExtInst>(MatchedItCount))) {
       assert(MatchedItCount->getType() == InnerInductionPHI->getType() &&
              "Unexpected type mismatch in types after widening");
       MatchedItCount = isa<SExtInst>(MatchedItCount)
                            ? dyn_cast<SExtInst>(MatchedItCount)->getOperand(0)

llvm/test/Transforms/LoopFlatten/pr59339.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
 ; RUN: opt < %s -S -opaque-pointers -passes='loop(loop-flatten),verify' -verify-loop-info -verify-dom-info -verify-scev | FileCheck %s
 
 ; FIXME: This incorrectly triggers, thus resulting in a miscompilation.
 ; The problem is that there is a linear use of the induction variable, i*3+j,
 ; but only the part i*3 is used for indexing.
 
 define void @test0(i16* %0, i16* %1) {
 ; CHECK-LABEL: @test0(
-; CHECK-NEXT:    [[FLATTEN_TRIPCOUNT:%.*]] = mul i64 3, 2
 ; CHECK-NEXT:    br label [[DOTPREHEADER:%.*]]
 ; CHECK:       .preheader:
 ; CHECK-NEXT:    [[TMP3:%.*]] = phi i64 [ 0, [[TMP2:%.*]] ], [ [[TMP7:%.*]], [[TMP6:%.*]] ]
 ; CHECK-NEXT:    [[TMP4:%.*]] = mul i64 [[TMP3]], 3
 ; CHECK-NEXT:    [[TMP5:%.*]] = getelementptr i16, ptr [[TMP1:%.*]], i64 [[TMP4]]
 ; CHECK-NEXT:    br label [[TMP9:%.*]]
 ; CHECK:       6:
 ; CHECK-NEXT:    [[TMP7]] = add i64 [[TMP3]], 1
-; CHECK-NEXT:    [[TMP8:%.*]] = icmp slt i64 [[TMP7]], [[FLATTEN_TRIPCOUNT]]
+; CHECK-NEXT:    [[TMP8:%.*]] = icmp slt i64 [[TMP7]], 2
 ; CHECK-NEXT:    br i1 [[TMP8]], label [[DOTPREHEADER]], label [[TMP16:%.*]]
 ; CHECK:       9:
-; CHECK-NEXT:    [[TMP10:%.*]] = phi i64 [ 0, [[DOTPREHEADER]] ]
+; CHECK-NEXT:    [[TMP10:%.*]] = phi i64 [ 0, [[DOTPREHEADER]] ], [ [[TMP14:%.*]], [[TMP9]] ]
 ; CHECK-NEXT:    [[TMP11:%.*]] = load i16, ptr [[TMP5]], align 2
 ; CHECK-NEXT:    [[TMP12:%.*]] = add i64 [[TMP10]], [[TMP4]]
-; CHECK-NEXT:    [[TMP13:%.*]] = getelementptr i16, ptr [[TMP0:%.*]], i64 [[TMP3]]
+; CHECK-NEXT:    [[TMP13:%.*]] = getelementptr i16, ptr [[TMP0:%.*]], i64 [[TMP12]]
 ; CHECK-NEXT:    store i16 [[TMP11]], ptr [[TMP13]], align 2
-; CHECK-NEXT:    [[TMP14:%.*]] = add nuw nsw i64 [[TMP10]], 1
+; CHECK-NEXT:    [[TMP14]] = add nuw nsw i64 [[TMP10]], 1
 ; CHECK-NEXT:    [[TMP15:%.*]] = icmp ult i64 [[TMP14]], 3
-; CHECK-NEXT:    br label [[TMP6]]
+; CHECK-NEXT:    br i1 [[TMP15]], label [[TMP9]], label [[TMP6]]
 ; CHECK:       16:
 ; CHECK-NEXT:    ret void
 ;
 2:
   br label %.preheader
 
 .preheader:
   %3 = phi i64 [ 0, %2 ], [ %7, %6 ]