[CodeGenPrepare] avoid crashing from replacing a phi twice

[JesperAntonsson]

Summary

This is a fix to bug 41052:
https://bugs.llvm.org/show_bug.cgi?id=41052

While trying to optimize a memory instruction in a dead basic block, we end up registering the same phi for replacement twice. This patch avoids registering more than the first replacement candidate for a phi.

[uabelho]

I'll push this for JesperAntonsson in a bit since he's having some environment issues.

lib/CodeGen/CodeGenPrepare.cpp

private:
 
   /// Try to match PHI node to Candidate.
   /// Matcher tracks the matched Phi nodes.
   bool MatchPhiNode(PHINode *PHI, PHINode *Candidate,
                     SmallSetVector<PHIPair, 8> &Matcher,
                     PhiNodeSet &PhiNodesToMatch) {
     SmallVector<PHIPair, 8> WorkList;
     Matcher.insert({ PHI, Candidate });
+    SmallSet<PHINode *, 8> MatchedPHIs;
+    MatchedPHIs.insert(PHI);
     WorkList.push_back({ PHI, Candidate });
     SmallSet<PHIPair, 8> Visited;
     while (!WorkList.empty()) {
       auto Item = WorkList.pop_back_val();
       if (!Visited.insert(Item).second)
         continue;
       // We iterate over all incoming values to Phi to compare them.
       // If values are different and both of them Phi and the first one is a
while (!WorkList.empty()) {
         if (!FirstPhi || !SecondPhi || !PhiNodesToMatch.count(FirstPhi) ||
             FirstPhi->getParent() != SecondPhi->getParent())
           return false;
 
         // If we already matched them then continue.
         if (Matcher.count({ FirstPhi, SecondPhi }))
           continue;
         // So the values are different and does not match. So we need them to
-        // match.
+        // match. (But we register no more than one match per PHI node, so that
+        // we won't later try to replace them twice.)
+        if (!MatchedPHIs.insert(FirstPhi).second)
           Matcher.insert({ FirstPhi, SecondPhi });
         // But me must check it.
         WorkList.push_back({ FirstPhi, SecondPhi });
       }
     }
     return true;
   }
 
   /// For the given set of PHI nodes (in the SimplificationTracker) try

test/CodeGen/X86/codegen-prepare-replacephi.mir

+# RUN: llc -run-pass=codegenprepare -o - %s | FileCheck %s
+
+# This testcase without the accompanying fix triggers the assert
+# "Replacement PHI node is already replaced."
+
+--- |
+  define void @f1() {
+  entry:
+    %arrayidx = getelementptr inbounds [2 x i16], [2 x i16]* undef, i16 0, i16 2
+    %0 = bitcast i16* %arrayidx to i32*
+    %1 = bitcast [2 x i16]* undef to i32*
+    br label %for.cond
+
+  for.cond:
+    %2 = phi i32* [ %0, %entry ], [ %7, %cleanup ]
+    %3 = phi i32* [ %0, %entry ], [ %9, %cleanup ]
+    br label %for.body
+
+  for.body:
+    %4 = phi i32* [ %3, %for.cond ], [ %9, %cleanup ]
+    %5 = phi i32* [ %2, %for.cond ], [ %9, %cleanup ]
+    %6 = phi i32* [ %2, %for.cond ], [ %9, %cleanup ]
+    br i1 false, label %for.cond2, label %if.then
+
+  if.then:
+    store i32 undef, i32* %4, align 1
+    unreachable
+
+  for.cond2:
+    %7 = phi i32* [ %6, %for.body ], [ %7, %if.then5 ], [ %1, %for.cond2 ]
+    %8 = phi i32* [ %5, %for.body ], [ %8, %if.then5 ], [ %1, %for.cond2 ]
+    %9 = phi i32* [ %4, %for.body ], [ %8, %if.then5 ], [ %1, %for.cond2 ]
+    br i1 undef, label %for.cond2, label %if.then5
+
+  if.then5:
+    br i1 undef, label %cleanup, label %for.cond2
+
+  cleanup:
+    br i1 true, label %for.cond, label %for.body
+  }
+
+...
+
+# Sanity check to verify that something got through.
+# CHECK-LABEL: entry: