[MachineBlockPlacement] Fix UnscheduledPredecessors counter to reflect tail duplication.

[huihuiz]

Summary

When filling worklist, UnscheduledPredecessors counter is increased whenever a MBB
within a BlockChain has any predecessor with different BlockChain. This counter is
decreased during buildChain (scheduled), by walking through every successor of MBB
within the BlockChain, decrease when successor BlockChain is different from current
BlockChain. Assuming BlockFilter condition is satisfied.

However, when a MBB is tail duplicated into it's predecessor, a previously increased
UnscheduledPredecessors counter may not be decreased. The BlockFilter condition may no
longer satisfied. Consider nested loop for example, the new predecessor and successor
are in different LoopBlockSet collected for outer and inner loop. Therefore, causing
an unreleased UnscheduledPredecessors counter for inner loop, causing assertion on
"Attempting to place block with unscheduled predecessors in worklist." when trying to
fill worklist later on.

This patch fixes pr44122.

[huihuiz]

This problem caused assertion on: void (anonymous namespace)::MachineBlockPlacement::fillWorkLists(const llvm::MachineBasicBlock *, SmallPtrSetImpl<(anonymous namespace)::BlockChain *> &, const (anonymous namespace)::MachineBlockPlacement::BlockFilterSet *, bool): Assertion `Chain.UnscheduledPredecessors == 0 && "Attempting to place block with unscheduled predecessors in worklist."' failed.

My apologies for not able to get a test case here. I try really hard to reduce a test case, but failed.

[huihuiz]

Adding some more detailed explanation:

When tail duplicator duplicate BB into its predecessor, for cases tail duplicator decides to delete BB:

PredBB [PredChain]                PredBB [PredChain]
     \                             /  \
      BB [BBChain]         =>   Succ0  Succ1
     /   \
Succ0 Succ1

For cases PredChain is different from BBChain, the UnscheduledPredecessors will be set to 1 for BBChain during fillWorkLists.
Assuming Succ1's BlockChain is equal to BBChain.
The previously set UnscheduledPredecessors for BBChain will not be decreased. Because Succ1 may not be included in the BlockFilter associated with the Loop of PredBB.
Since LoopBlockSet is collected at the very beginning of buildLoopChains, and tail duplication will not update the BlockFilter(LoopBlockSet).

[Carrot]

More interesting problem is why fillWorkLists is called with a removed BB? From the code around of callers of fillWorkLists, we can see the removed BB is still in MachineFunction or MachineLoop data structure, we should also delete removed BB from there.

llvm/lib/CodeGen/MachineBlockPlacement.cpp

2957

Since BB is completely duplicated and removed, why not simply delete it from BlockToChain?

[huihuiz]

Actually fillWorkLists is not called for the deleted BB, but the MBBs of BBChain. The BB is deleted, and removed from BBChain. Also removed from MachineLoopInfo.
Here BBChain will have an unreleased UnscheduledPredecessors counter, when calling fillWorkLists for any MBBs within BBChain, this assertion will happen.

[Carrot]

The explanation looks helpful for understanding the problem.
thanks

[huihuiz]

llvm/lib/CodeGen/MachineBlockPlacement.cpp

2957

The deleted BB is removed from its associated BlockChain, and removed from MachineBlockInfo.

[huihuiz]

Just realize I forget to mention how the BB is removed.

llvm/lib/CodeGen/MachineBlockPlacement.cpp

2907

This is the logic where BB is removed from the Chain and Chain Map. It's called in TailDuplicator::tailDuplicateAndUpdate(), when BB is dead and tailduplicator decides to removed it (removeDeadBlock).

[huihuiz]

Guys, any thoughts on this?

[Carrot]

The original code doesn't correctly handle the case that the duplicated BB comes from a chain contains multiple BBs. So your patch looks reasonable to me. Could you enhance your comment to emphasize this case. It's better to make the comments of following loop more clearer. The current comments looks similar and confusing.

Considering duplicate a BB from a chain with multiple BBs, there is another bug in lambda RemovalCallback. If the duplicated BB is removed from a worklist, the following BB in same chain should be added to the worklist.

[huihuiz]

Addressed reviewer feedback -- add more explanation in comments.

[Carrot]

llvm/lib/CodeGen/MachineBlockPlacement.cpp

2969

With current layout algorithm it is uncommon to build BBChain before placing PredBB, the most possible situation is BB is a loop header, and PredBB is not in the same loop. Could you write a test case with this hint?

2970

Think about it more and I found it is more complex than the code snippet.

1. Even BB is not completely removed, the UnscheduledPredecessors should also be decremented by the number of actual duplications. The code should be similar to the following loop.

2. In your sample code, there was a UnscheduledPredecessors for the edge PredBB -> BB, even BB is duplicated into PredBB, there is still an edge (PredBB + BB) -> Succ1, so there is another UnscheduledPredecessors, it doesn't impact the total number of UnscheduledPredecessors for BBChain. Only when BB doesn't fall through/jump to any other block in BBChain, then UnscheduledPredecessors can be decremented for the duplication. Could you double check if your failure is in this case?

[huihuiz]

Add reduced test case

[huihuiz]

llvm/lib/CodeGen/MachineBlockPlacement.cpp

2969

That's actually not right.

Consider, BBChain is the inner loop, PredBB is in the outer loop.
BBChain for inner loop is build before outer loop (PredChain)

2970

Please refer to my test case.

The updated CFG PredBB -> Succ1 cat not make sure UnscheduledPredecessors is released through markBlockSuccessors.
As PredBB is in the outer loop's LoopBlockSet, and Succ1 is in the inner loop's LoopBlockSet.

[huihuiz]

Ping.

Any objections with this approach?

[apazos]

The change looks good to me. Thanks for adding the test!

llvm/test/CodeGen/ARM/block-placement-tail-duplication.mir

5 ↗

(On Diff #230705)

You might want to add REQUIRES: asserts. Or maybe explain what the CHECK-NOT: bb.14.bb58 means

[huihuiz]

Updated test checking.

Removed CHECK lines, as we are checking this test no longer cause assertion crash.

[huihuiz]

I would like to merge this patch, please let me know if there are any objections?

[Carrot]

llvm/lib/CodeGen/MachineBlockPlacement.cpp

2932

Another related problem.
After RemBB is removed from WorkList, the following BB in the same chain should be added to WorkList.

2969

I can't figure out what's the difference between the two comments.

2970

When work on outer loop, the BBs in inner loop are also included in LoopBlockSet. When BB is duplicated into PredBB, the edge (PredBB + BB) -> Succ1 must be added to SuccChain.UnscheduledPredecessors. Fortunately the loop at line 2982 already handled this case. So we don't need to worry about it.

But you still need to decrement BBChain.UnscheduledPredecessors for actual duplication, even if BB is not completely duplicated and removed.

[huihuiz]

llvm/lib/CodeGen/MachineBlockPlacement.cpp

2932

There is no need for special handling, when done building Loop Chain, all MBB within the function will be checked again to see if there's need to be added to WorkList. Refer to Line:2604

2970

When work on outer loop, the BBs in inner loop are NOT included in LoopBlockSet for the outer loop.

When BB is duplicated into PredBB, the edge (PredBB + BB) -> Succ1 must be added to SuccChain.UnscheduledPredecessors. Fortunately the loop at line 2982 already handled this case. So we don't need to worry about it.
-> also not right.
-> The PredBB is not in the LoopBlockSet for SuccChain, the SuccChain.UnscheduledPredecessors has been increased in respect to PredBB earlier in fillWorkList

But you still need to decrement BBChain.UnscheduledPredecessors for actual duplication, even if BB is not completely duplicated and removed.
-> if BB is not completely removed, then should leave to markBlockSuccessors to decrease the UnscheduledPredecessors counter

[Carrot]

llvm/lib/CodeGen/MachineBlockPlacement.cpp

2932

Please keep in mind this file tries to layout code optimally.

2970

Please read the code in function collectLoopBlockSet. Also it is intentionally to leave cold BBs from inner loop to be processed with outer loop to get better I$ behavior.

For the handling of UnscheduledPredecessors. It records the number of cross chain edges.
In normal situation, it is constructed in fillWorkList, and decreased when predecessor is placed.
But when tail duplication occurred, the number of cross chain edges changed, so UnscheduledPredecessors must be adjusted accordingly. There are two possibilities:

• reduced cross chain edges, this is the root cause of your problem, but a completely duplicated and removed BB is really a special case.
• increased cross chain edges, it is handled by loop at line 2982, please read it carefully, it is a good template for your patch.

[huihuiz]

Hey @Carrot , really appreciated your time on it.

For the test case provided, I am pretty sure inner loop and outer loop are in different Loop Chain.

From your comments, I still don't understand are there any problems/concerns with the fix proposed?
Are you suggesting merging the proposed fix into loop Line:2982? But that's not very clear, I would prefer to have a separate logic.

[Carrot]

In D70030#1767393, @huihuiz wrote:

Hey @Carrot , really appreciated your time on it.

For the test case provided, I am pretty sure inner loop and outer loop are in different Loop Chain.

This is correct. I already mentioned it in Nov 15. Thanks for the test case.

From your comments, I still don't understand are there any problems/concerns with the fix proposed?
Are you suggesting merging the proposed fix into loop Line:2982? But that's not very clear, I would prefer to have a separate logic.

The main problem is the fix should be applied to all duplication even if BB is not removed.

[huihuiz]

"The main problem is the fix should be applied to all duplication even if BB is not removed."
-> Make sense, thank you for pointing this out.

Please let me know if there are any different opinions?

[huihuiz]

Hey @Carrot ,

Please let me know if you have any further concerns?

[Carrot]

llvm/lib/CodeGen/MachineBlockPlacement.cpp

2976

Here if BBChain.UnscheduledPredecessors == 0, then there is something wrong.

2979

This condition also applies to your code, so the original if statement should not be changed.

[huihuiz]

llvm/lib/CodeGen/MachineBlockPlacement.cpp

2976

already guarded under "BBChain.UnscheduledPredecessors != 0"

2979

Yes, I was also debating about this.

[Carrot]

llvm/lib/CodeGen/MachineBlockPlacement.cpp

2976

You should not hide this kind of compiler internal error. Even do nothing is better than hide it. Of course a better choice is assert it.

3039

Replace BlockToChain[Pred] with PredChain.

[huihuiz]

llvm/lib/CodeGen/MachineBlockPlacement.cpp

2976

I don't think so. Assert here may not be good idea.

Refer to line:620, this also make sure not decrementing on an already zero UnscheduledPredecessors counter.

// This is a cross-chain edge that is within the loop, so decrement the
 // loop predecessor count of the destination chain.
 if (SuccChain.UnscheduledPredecessors == 0 ||
     --SuccChain.UnscheduledPredecessors > 0)
   continue;

Please let me know if you can agree with this? I am trying not to waste each other's time on endless arguing.

[Carrot]

llvm/lib/CodeGen/MachineBlockPlacement.cpp

2976

Nobody wants to argue with you for no reason! If you want your patch to be accepted quickly, please try to understand the algorithm carefully.

This code looks also want to hide something wrong, so not a good practice.

I may change my idea if you can find some reasonable situation that SuccChain.UnscheduledPredecessors <= 0 when there are still cross chain edges flow to SuccChain.

[arsenm]

llvm/test/CodeGen/ARM/block-placement-tail-duplication_pr44122.mir

8

I would expect you to be able to drop the IR section entirely and reduce this

[arsenm]

llvm/test/CodeGen/ARM/block-placement-tail-duplication_pr44122.mir

614–619

Can you reduce this at all? llvm-reduce for MIR can at least drop the IR references making it easier to delete the IR section. The block reduction still needs to be pushed

[huihuiz]

The test attached no longer trigger assertion "Attempting to place block with unscheduled predecessors in worklist.".
I am not currently active on this issue.
I also don't have much experience in MachineBlockPlacement.

But if anyone sees concerns of current implementation MachineBlockPlacement. Please feel free to revisit.

llvm/lib/CodeGen/MachineBlockPlacement.cpp

   DuplicatedToOriginalLPred = DuplicatedToLPred;
   // Iteratively try to duplicate again. It can happen that a block that is
   // duplicated into is still small enough to be duplicated again.
   // No need to call markBlockSuccessors in this case, as the blocks being
   // duplicated from here on are already scheduled.
   // Note that DuplicatedToLPred always implies Removed.
   while (DuplicatedToLPred) {
     assert(Removed && "Block must have been removed to be duplicated into its "
            "layout predecessor.");
     MachineBasicBlock *DupBB, *DupPred;
     // The removal callback causes Chain.end() to be updated when a block is
     // removed. On the first pass through the loop, the chain end should be the
     // same as it was on function entry. On subsequent passes, because we are
     // duplicating the block at the end of the chain, if it is removed the
     // chain will have shrunk by one block.
     BlockChain::iterator ChainEnd = Chain.end();
     DupBB = *(--ChainEnd);
     // Now try to duplicate again.
     if (ChainEnd == Chain.begin())
       break;
     DupPred = *std::prev(ChainEnd);
     Removed = maybeTailDuplicateBlock(DupBB, DupPred, Chain, BlockFilter,
                                       PrevUnplacedBlockIt,
                                       DuplicatedToLPred);
   }
   // If BB was duplicated into LPred, it is now scheduled. But because it was
   // removed, markChainSuccessors won't be called for its chain. Instead we
   // call markBlockSuccessors for LPred to achieve the same effect. This must go
   // at the end because repeating the tail duplication can increase the number
   // of unscheduled predecessors.
   LPred = *std::prev(Chain.end());
   if (DuplicatedToOriginalLPred)
     markBlockSuccessors(Chain, LPred, LoopHeaderBB, BlockFilter);
   return true;
 }
 
 /// Tail duplicate \p BB into (some) predecessors if profitable.
 /// \p BB    - Basic block that may be duplicated
 /// \p LPred - Chosen layout predecessor of \p BB
 /// \p Chain - Chain to which \p LPred belongs, and \p BB will belong.
 /// \p BlockFilter - Set of blocks that belong to the loop being laid out.
 ///                  Used to identify which blocks to update predecessor
 ///                  counts.
 /// \p PrevUnplacedBlockIt - Iterator pointing to the last block that was
 ///                          chosen in the given order due to unnatural CFG
 ///                          only needed if \p BB is removed and
 ///                          \p PrevUnplacedBlockIt pointed to \p BB.
 /// \p DuplicatedToLPred - True if the block was duplicated into LPred. Will
 ///                        only be true if the block was removed.
 /// \return  - True if the block was duplicated into all preds and removed.
 bool MachineBlockPlacement::maybeTailDuplicateBlock(
     MachineBasicBlock *BB, MachineBasicBlock *LPred,
     BlockChain &Chain, BlockFilterSet *BlockFilter,
     MachineFunction::iterator &PrevUnplacedBlockIt,
     bool &DuplicatedToLPred) {
   DuplicatedToLPred = false;
   if (!shouldTailDuplicate(BB))
     return false;
 
   LLVM_DEBUG(dbgs() << "Redoing tail duplication for Succ#" << BB->getNumber()
                     << "\n");
 
   // This has to be a callback because none of it can be done after
   // BB is deleted.
   bool Removed = false;
   auto RemovalCallback =
       [&](MachineBasicBlock *RemBB) {
         // Signal to outer function
         Removed = true;
 
         // Conservative default.
         bool InWorkList = true;
         // Remove from the Chain and Chain Map
         if (BlockToChain.count(RemBB)) {
           BlockChain *Chain = BlockToChain[RemBB];
           InWorkList = Chain->UnscheduledPredecessors == 0;
           Chain->remove(RemBB);
           BlockToChain.erase(RemBB);
         }
 
         // Handle the unplaced block iterator
         if (&(*PrevUnplacedBlockIt) == RemBB) {
           PrevUnplacedBlockIt++;
         }
 
         // Handle the Work Lists
         if (InWorkList) {
           SmallVectorImpl<MachineBasicBlock *> &RemoveList = BlockWorkList;
           if (RemBB->isEHPad())

         LLVM_DEBUG(dbgs() << "TailDuplicator deleted block: "
                           << getBlockName(RemBB) << "\n");
       };
   auto RemovalCallbackRef =
       function_ref<void(MachineBasicBlock*)>(RemovalCallback);
 
   SmallVector<MachineBasicBlock *, 8> DuplicatedPreds;
   bool IsSimple = TailDup.isSimpleBB(BB);
+  BlockChain &BBChain = *BlockToChain[BB];
   TailDup.tailDuplicateAndUpdate(IsSimple, BB, LPred,
                                  &DuplicatedPreds, &RemovalCallbackRef);
 
   // Update UnscheduledPredecessors to reflect tail-duplication.
   DuplicatedToLPred = false;
   for (MachineBasicBlock *Pred : DuplicatedPreds) {
     // We're only looking for unscheduled predecessors that match the filter.
     BlockChain* PredChain = BlockToChain[Pred];
     if (Pred == LPred)
       DuplicatedToLPred = true;
     if (Pred == LPred || (BlockFilter && !BlockFilter->count(Pred))
         || PredChain == &Chain)
       continue;
+    // Decrease UnscheduledPredecessors previously set for duplicated BB's
+    // BlockChain. Building PredChain may not release the
+    // UnscheduledPredecessors counter for BBChain, as Succ1 may not be in the
+    // LoopBlockSet collected for PredChain.
+    //
+    // PredBB [PredChain]        PredBB [PredChain]
+    //     \                             /  \
+    //      BB [BBChain]       =>   Succ0  Succ1 [BBChain]
+    //     /   \
+    //  Succ0 Succ1 [BBChain]
+    if (&BBChain != BlockToChain[Pred] && BBChain.UnscheduledPredecessors != 0)
+      --BBChain.UnscheduledPredecessors;
     for (MachineBasicBlock *NewSucc : Pred->successors()) {
       if (BlockFilter && !BlockFilter->count(NewSucc))
         continue;
       BlockChain *NewChain = BlockToChain[NewSucc];
       if (NewChain != &Chain && NewChain != PredChain)
         NewChain->UnscheduledPredecessors++;
     }
   }

llvm/test/CodeGen/ARM/block-placement-tail-duplication_pr44122.mir

+# RUN: llc -o /dev/null %s -run-pass=block-placement -mtriple=thumbv7-unknown-linux-gnueabi \
+# RUN: -verify-machineinstrs -O3
+# REQUIRES: asserts
+
+# The test used to cause Assertion `Chain.UnscheduledPredecessors == 0 && \
+# "Attempting to place block with unscheduled predecessors in worklist."' failed.
+
+--- |
+  ; ModuleID = 'test.ll'
+  source_filename = "test.ll"
+  target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
+  target triple = "thumbv7-unknown-linux-gnueabi"
+
+  %0 = type { i16, i16, [1 x %1] }
+  %1 = type { i32 }
+  %2 = type { i8, [3 x i8] }
+  %3 = type { %0*, %0*, %4*, i32, i32, %0*, %0**, i8, i8, i8, i32, %0*, i32, %4* }
+  %4 = type { %0*, %4*, %4*, %4*, %4*, %4*, %4*, i32, i32, i8, i8, i8, i8 }
+
+  @g1 = external dso_local unnamed_addr global i1, align 4
+  @g2 = external dso_local unnamed_addr global %0*, align 4
+
+  declare dso_local %0* @func1(%0*, i32) local_unnamed_addr #0
+
+  declare dso_local i32 @func2(...) local_unnamed_addr #0
+
+  declare dso_local %0* @func3(i32, %0*) local_unnamed_addr #0
+
+  declare dso_local fastcc %0* @func4(%0*, %0*) unnamed_addr #0
+
+  declare dso_local fastcc i32 @func5(%0*, i32) unnamed_addr #0
+
+  declare dso_local fastcc i32 @func6(%0*, %0*, i32) unnamed_addr #0
+
+  declare dso_local i32 @func7(%0*, %0**, %0*, i32) local_unnamed_addr #0
+
+  declare dso_local fastcc %0* @func8(%0*, %0*) unnamed_addr #0
+
+  declare dso_local fastcc void @func9(%2*, %0*) unnamed_addr #0
+
+  define internal fastcc void @test_func(%0* %arg, i32 %arg1) unnamed_addr #0 !prof !0 !PGOFuncName !1 {
+  bb:
+    %tmp = load %0*, %0** undef, align 4, !tbaa !2
+    store %0* %arg, %0** @g2, align 4, !tbaa !5
+    %0 = zext i16 undef to i32
+    switch i32 %0, label %bb101 [
+      i32 41, label %bb2
+      i32 44, label %bb6
+      i32 43, label %bb4
+    ], !prof !7
+
+  bb2:                                              ; preds = %bb
+    %tmp3 = alloca %3, align 8
+    %tmp9 = icmp eq i16 undef, 112
+    br i1 %tmp9, label %bb10, label %bb13, !prof !8
+
+  bb4:                                              ; preds = %bb
+    %tmp5 = tail call fastcc %0* @func8(%0* undef, %0* null) #2
+    unreachable
+
+  bb6:                                              ; preds = %bb
+    %tmp7 = tail call fastcc %0* @func8(%0* nonnull %tmp, %0* %arg) #2
+    unreachable
+
+  bb10:                                             ; preds = %bb2
+    %tmp11 = tail call fastcc %0* @func8(%0* undef, %0* %arg) #2
+    %tmp12 = tail call i32 @func7(%0* %arg, %0** nonnull undef, %0* %tmp11, i32 1) #3
+    unreachable
+
+  bb13:                                             ; preds = %bb2
+    br label %bb14
+
+  bb14:                                             ; preds = %bb13, %bb88
+    %tmp16 = phi i32 [ %tmp96, %bb88 ], [ 0, %bb13 ]
+    %tmp17 = getelementptr inbounds %3, %3* %tmp3, i32 %tmp16, i32 0
+    %tmp18 = load %0*, %0** undef, align 4, !tbaa !2
+    %tmp19 = load %0*, %0** undef, align 4, !tbaa !2
+    %tmp20 = tail call fastcc %0* @func4(%0* %tmp19, %0* %arg) #2
+    store i1 false, i1* @g1, align 4
+    %tmp21 = getelementptr inbounds %3, %3* %tmp3, i32 %tmp16, i32 1
+    store %0* %tmp19, %0** %tmp21, align 4, !tbaa !9
+    br label %bb22
+
+  bb22:                                             ; preds = %bb22, %bb14
+    %tmp23 = icmp eq %4* undef, null
+    br i1 %tmp23, label %bb24, label %bb22, !prof !12
+
+  bb24:                                             ; preds = %bb22
+    br i1 undef, label %bb27.preheader, label %bb25, !prof !13
+
+  bb27.preheader:                                   ; preds = %bb24
+    %tmp28 = icmp sgt i32 undef, 63
+    br i1 %tmp28, label %bb29, label %bb32
+
+  bb25:                                             ; preds = %bb24
+    br label %bb41
+
+  bb29:                                             ; preds = %bb27.preheader
+    %tmp30 = tail call %0* @func3(i32 undef, %0* undef) #3
+    %tmp31 = icmp eq %0* %tmp30, null
+    br i1 %tmp31, label %bb34, label %bb36, !prof !14
+
+  bb32:                                             ; preds = %bb27.preheader
+    %tmp33 = tail call fastcc i32 @func5(%0* nonnull undef, i32 undef) #2
+    unreachable
+
+  bb34:                                             ; preds = %bb29
+    %tmp35 = tail call %0* @func1(%0* undef, i32 undef) #3
+    unreachable
+
+  bb36:                                             ; preds = %bb29
+    %tmp38 = icmp eq %0* %tmp19, %tmp20
+    %tmp39 = select i1 %tmp38, %0* null, %0* %tmp20, !prof !15
+    %tmp40 = icmp eq %4* null, null
+    br i1 %tmp40, label %bb81, label %bb41, !prof !16
+
+  bb41:                                             ; preds = %bb36, %bb25
+    %tmp42 = phi %0* [ undef, %bb25 ], [ %tmp39, %bb36 ]
+    %tmp43 = phi %0* [ undef, %bb25 ], [ %tmp30, %bb36 ]
+    %tmp44 = load %4*, %4** undef, align 4, !tbaa !17
+    %tmp451 = bitcast %4* %tmp44 to %0**
+    %tmp46 = load %0*, %0** %tmp451, align 4, !tbaa !19
+    %tmp47 = tail call i32 bitcast (i32 (...)* @func2 to i32 (%0*, %0*)*)(%0* nonnull %tmp19, %0* %tmp46) #3
+    %tmp48 = tail call i32 bitcast (i32 (...)* @func2 to i32 (%0*, %0*)*)(%0* nonnull %tmp42, %0* undef) #3
+    br i1 undef, label %bb49, label %bb51, !prof !20
+
+  bb49:                                             ; preds = %bb41
+    br label %bb51
+
+  bb51:                                             ; preds = %bb49, %bb41
+    %tmp52 = phi %0* [ null, %bb49 ], [ %tmp43, %bb41 ]
+    br i1 undef, label %bb53, label %bb58, !prof !21
+
+  bb53:                                             ; preds = %bb51
+    %1 = bitcast %4* %tmp44 to %0**
+    %tmp54 = load %0*, %0** %1, align 4, !tbaa !19
+    %tmp55 = tail call i32 bitcast (i32 (...)* @func2 to i32 (%0*, %0*)*)(%0* %tmp54, %0* nonnull %tmp18) #3
+    %tmp56 = icmp eq i32 %tmp55, 0
+    %tmp57 = select i1 %tmp56, %0* %tmp52, %0* %tmp18
+    br label %bb58
+
+  bb58:                                             ; preds = %bb53, %bb51
+    %tmp59 = phi %0* [ %tmp57, %bb53 ], [ %tmp52, %bb51 ]
+    %tmp60 = getelementptr inbounds %4, %4* %tmp44, i32 0, i32 3
+    %tmp61 = load %4*, %4** %tmp60, align 4, !tbaa !22
+    %tmp62 = icmp eq %4* %tmp61, null
+    br i1 %tmp62, label %bb81, label %bb63.preheader, !prof !23
+
+  bb63.preheader:                                   ; preds = %bb58
+    br label %bb63
+
+  bb63:                                             ; preds = %bb63.preheader, %bb76
+    %tmp64 = phi %4* [ %tmp79, %bb76 ], [ %tmp61, %bb63.preheader ]
+    %tmp65 = phi %0* [ %tmp77, %bb76 ], [ %tmp59, %bb63.preheader ]
+    %tmp66 = icmp eq %0* %tmp65, null
+    br i1 %tmp66, label %bb70, label %bb67, !prof !24
+
+  bb67:                                             ; preds = %bb63
+    %tmp69 = select i1 undef, %0* %tmp65, %0* null
+    br label %bb70
+
+  bb70:                                             ; preds = %bb67, %bb63
+    %tmp71 = phi %0* [ %tmp69, %bb67 ], [ null, %bb63 ]
+    br i1 undef, label %bb72, label %bb76, !prof !21
+
+  bb72:                                             ; preds = %bb70
+    %tmp73 = tail call i32 bitcast (i32 (...)* @func2 to i32 (%0*, %0*)*)(%0* undef, %0* nonnull %tmp18) #3
+    %tmp74 = icmp eq i32 %tmp73, 0
+    %tmp75 = select i1 %tmp74, %0* %tmp71, %0* %tmp18
+    br label %bb76
+
+  bb76:                                             ; preds = %bb72, %bb70
+    %tmp77 = phi %0* [ %tmp75, %bb72 ], [ %tmp71, %bb70 ]
+    %tmp78 = getelementptr inbounds %4, %4* %tmp64, i32 0, i32 3
+    %tmp79 = load %4*, %4** %tmp78, align 4, !tbaa !22
+    %tmp80 = icmp eq %4* %tmp79, null
+    br i1 %tmp80, label %bb81, label %bb63, !prof !25, !llvm.loop !26
+
+  bb81:                                             ; preds = %bb76, %bb58, %bb36
+    %tmp82 = phi %4* [ %tmp44, %bb58 ], [ null, %bb36 ], [ %tmp44, %bb76 ]
+    br label %bb98
+
+  bb83:                                             ; preds = %bb98
+    %tmp84 = tail call fastcc i32 @func6(%0* undef, %0* undef, i32 1) #2
+    unreachable
+
+  bb85:                                             ; preds = %bb98
+    %tmp86 = tail call i32 @func7(%0* %arg, %0** nonnull undef, %0* undef, i32 0) #3
+    %tmp87 = icmp eq i32 %tmp86, 0
+    br i1 %tmp87, label %bb98, label %bb88, !prof !29
+
+  bb88:                                             ; preds = %bb85
+    %tmp89 = load %0*, %0** %tmp17, align 4, !tbaa !30
+    %tmp90 = getelementptr inbounds %0, %0* %tmp89, i32 0, i32 2, i32 1
+    %tmp91 = bitcast %1* %tmp90 to %0**
+    %tmp92 = load %0*, %0** %tmp91, align 4, !tbaa !2
+    %tmp93 = tail call fastcc %0* @func8(%0* %tmp92, %0* %arg) #2
+    store i1 false, i1* @g1, align 4
+    %tmp94 = tail call fastcc %0* @func4(%0* %tmp18, %0* %arg) #2
+    %tmp95 = getelementptr inbounds %0, %0* %arg, i32 0, i32 2, i32 4, i32 0
+    store i32 -1, i32* %tmp95, align 4, !tbaa !2
+    %tmp96 = add nuw nsw i32 %tmp16, 1
+    %tmp97 = icmp eq i32 %tmp96, 1
+    br i1 %tmp97, label %bb102, label %bb14, !prof !31
+
+  bb98:                                             ; preds = %bb85, %bb81
+    %tmp100 = icmp eq %4* %tmp82, null
+    br i1 %tmp100, label %bb85, label %bb83, !prof !32
+
+  bb101:                                            ; preds = %bb
+    unreachable
+
+  bb102:                                            ; preds = %bb88
+    call fastcc void @func9(%2* nonnull undef, %0* %tmp) #2
+    ret void
+  }
+
+  ; Function Attrs: nounwind
+  declare void @llvm.stackprotector(i8*, i8**) #1
+
+  attributes #0 = { "target-cpu"="krait" "use-soft-float"="false" }
+  attributes #1 = { nounwind }
+  attributes #2 = { nobuiltin }
+  attributes #3 = { nobuiltin nounwind }
+
+  !0 = !{!"function_entry_count", i64 197149}
+  !1 = !{!"test.c:test_func"}
+  !2 = !{!3, !3, i64 0}
+  !3 = !{!"omnipotent char", !4, i64 0}
+  !4 = !{!"Simple C/C++ TBAA"}
+  !5 = !{!6, !6, i64 0}
+  !6 = !{!"any pointer", !3, i64 0}
+  !7 = !{!"branch_weights", i32 28105, i32 -1692644931, i32 13898, i32 14052}
+  !8 = !{!"branch_weights", i32 45068, i32 -232627912}
+  !9 = !{!10, !6, i64 4}
+  !10 = !{!"set", !6, i64 0, !6, i64 4, !6, i64 8, !11, i64 12, !11, i64 16, !6, i64 20, !6, i64 24, !3, i64 28, !3, i64 29, !3, i64 30, !3, i64 32, !6, i64 36, !11, i64 40, !6, i64 44}
+  !11 = !{!"int", !3, i64 0}
+  !12 = !{!"branch_weights", i32 310178, i32 424764}
+  !13 = !{!"branch_weights", i32 13444, i32 16}
+  !14 = !{!"branch_weights", i32 14, i32 83517}
+  !15 = !{!"branch_weights", i32 168705, i32 11570}
+  !16 = !{!"branch_weights", i32 1684884186, i32 462599462}
+  !17 = !{!18, !6, i64 20}
+  !18 = !{!"table_elt", !6, i64 0, !6, i64 4, !6, i64 8, !6, i64 12, !6, i64 16, !6, i64 20, !6, i64 24, !11, i64 28, !3, i64 32, !3, i64 36, !3, i64 37, !3, i64 38, !3, i64 39}
+  !19 = !{!18, !6, i64 0}
+  !20 = !{!"branch_weights", i32 1, i32 1682}
+  !21 = !{!"branch_weights", i32 45831, i32 53367}
+  !22 = !{!18, !6, i64 12}
+  !23 = !{!"branch_weights", i32 180274, i32 99632}
+  !24 = !{!"branch_weights", i32 58556, i32 149}
+  !25 = !{!"branch_weights", i32 180274, i32 1}
+  !26 = distinct !{!26, !27, !28}
+  !27 = !{!"llvm.loop.peeled.count", i32 1}
+  !28 = !{!"llvm.loop.unroll.disable"}
+  !29 = !{!"branch_weights", i32 18889, i32 180218}
+  !30 = !{!10, !6, i64 0}
+  !31 = !{!"branch_weights", i32 197150, i32 180274}
+  !32 = !{!"branch_weights", i32 159995, i32 39168}
+
+...
+---
+name:            test_func
+alignment:       2
+exposesReturnsTwice: false
+legalized:       false
+regBankSelected: false
+selected:        false
+failedISel:      false
+tracksRegLiveness: true
+hasWinCFI:       false
+registers:       []
+liveins:
+  - { reg: '$r0', virtual-reg: '' }
+frameInfo:
+  isFrameAddressTaken: false
+  isReturnAddressTaken: false
+  hasStackMap:     false
+  hasPatchPoint:   false
+  stackSize:       64
+  offsetAdjustment: -40
+  maxAlignment:    4
+  adjustsStack:    true
+  hasCalls:        true
+  stackProtector:  ''
+  maxCallFrameSize: 0
+  cvBytesOfCalleeSavedRegisters: 0
+  hasOpaqueSPAdjustment: false
+  hasVAStart:      false
+  hasMustTailInVarArgFunc: false
+  localFrameSize:  0
+  savePoint:       ''
+  restorePoint:    ''
+fixedStack:      []
+stack:
+  - { id: 0, name: tmp3, type: variable-sized, offset: -40, alignment: 1, 
+      stack-id: default, callee-saved-register: '', callee-saved-restored: true, 
+      local-offset: 0, debug-info-variable: '', debug-info-expression: '', 
+      debug-info-location: '' }
+  - { id: 1, name: '', type: spill-slot, offset: -44, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 2, name: '', type: spill-slot, offset: -48, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 3, name: '', type: spill-slot, offset: -52, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 4, name: '', type: spill-slot, offset: -56, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 5, name: '', type: spill-slot, offset: -60, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 6, name: '', type: default, offset: -40, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 7, name: '', type: spill-slot, offset: -4, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '$lr', callee-saved-restored: false, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 8, name: '', type: spill-slot, offset: -8, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '$r11', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 9, name: '', type: spill-slot, offset: -12, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '$r10', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 10, name: '', type: spill-slot, offset: -16, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '$r9', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 11, name: '', type: spill-slot, offset: -20, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '$r8', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 12, name: '', type: spill-slot, offset: -24, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '$r7', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 13, name: '', type: spill-slot, offset: -28, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '$r6', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 14, name: '', type: spill-slot, offset: -32, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '$r5', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+  - { id: 15, name: '', type: spill-slot, offset: -36, size: 4, alignment: 4, 
+      stack-id: default, callee-saved-register: '$r4', callee-saved-restored: true, 
+      debug-info-variable: '', debug-info-expression: '', debug-info-location: '' }
+callSites:       []
+constants:       []
+machineFunctionInfo: {}
+body:             |
+  bb.0.bb:
+    successors: %bb.3(0x7ffffffd), %bb.1(0x00000003)
+    liveins: $r0, $r4, $r5, $r6, $r8, $r9, $r10, $r11, $lr
+
+    $sp = frame-setup t2STMDB_UPD $sp, 14, $noreg, killed $r4, killed $r5, killed $r6, $r7, killed $r8, killed $r9, killed $r10, killed $r11, killed $lr
+    frame-setup CFI_INSTRUCTION def_cfa_offset 36
+    frame-setup CFI_INSTRUCTION offset $lr, -4
+    frame-setup CFI_INSTRUCTION offset $r11, -8
+    frame-setup CFI_INSTRUCTION offset $r10, -12
+    frame-setup CFI_INSTRUCTION offset $r9, -16
+    frame-setup CFI_INSTRUCTION offset $r8, -20
+    frame-setup CFI_INSTRUCTION offset $r7, -24
+    frame-setup CFI_INSTRUCTION offset $r6, -28
+    frame-setup CFI_INSTRUCTION offset $r5, -32
+    frame-setup CFI_INSTRUCTION offset $r4, -36
+    $r7 = frame-setup t2ADDri $sp, 12, 14, $noreg, $noreg
+    frame-setup CFI_INSTRUCTION def_cfa $r7, 24
+    $sp = frame-setup tSUBspi $sp, 7, 14, $noreg
+    $r9 = tMOVr killed $r0, 14, $noreg
+    $r0 = t2MOVi16 target-flags(arm-lo16) @g2, 14, $noreg
+    $r0 = t2MOVTi16 killed $r0, target-flags(arm-hi16) @g2, 14, $noreg
+    renamable $r1 = t2LDRi12 undef renamable $r0, 0, 14, $noreg :: (load 4 from `%0** undef`, !tbaa !2)
+    t2STRi12 renamable $r9, killed renamable $r0, 0, 14, $noreg :: (store 4 into @g2, !tbaa !5)
+    renamable $r0 = t2MOVi 0, 14, $noreg, $noreg
+    t2CMPri renamable $r0, 0, 14, $noreg, implicit-def $cpsr
+    t2Bcc %bb.3, 1, $cpsr
+
+  bb.1.bb:
+    successors: %bb.24(0x2aaaaaab), %bb.2(0x55555555)
+    liveins: $cpsr, $r1, $r9
+
+    t2Bcc %bb.24, 1, killed $cpsr
+
+  bb.2.bb6:
+    successors:
+    liveins: $r9, $r1
+
+    $r0 = tMOVr killed $r1, 14, $noreg
+    $r1 = tMOVr killed $r9, 14, $noreg
+    tBL 14, $noreg, @func8, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit killed $r0, implicit killed $r1, implicit-def $sp, implicit-def dead $r0
+
+  bb.3.bb2:
+    successors: %bb.25(0x00000001), %bb.4(0x7fffffff)
+    liveins: $r0, $r1, $r9
+
+    t2STRi8 killed renamable $r1, $r7, -36, 14, $noreg :: (store 4 into %stack.5)
+    renamable $r1 = t2SUBri $sp, 48, 14, $noreg, $noreg
+    t2STRi8 renamable $r1, $r7, -28, 14, $noreg :: (store 4 into %stack.3)
+    $sp = tMOVr killed $r1, 14, $noreg
+    t2CMPri killed renamable $r0, 0, 14, $noreg, implicit-def $cpsr
+    t2Bcc %bb.25, 1, killed $cpsr
+
+  bb.4.bb13:
+    successors: %bb.5(0x80000000)
+    liveins: $r9
+
+    $r4 = t2MOVi16 target-flags(arm-lo16) @g1, 14, $noreg
+    renamable $r6 = t2MOVi 0, 14, $noreg, $noreg
+    $r4 = t2MOVTi16 killed $r4, target-flags(arm-hi16) @g1, 14, $noreg
+    renamable $r11 = t2MOVi 0, 14, $noreg, $noreg
+    t2STRi8 renamable $r9, $r7, -32, 14, $noreg :: (store 4 into %stack.4)
+
+  bb.5.bb14:
+    successors: %bb.6(0x80000000)
+    liveins: $r4, $r6, $r9, $r11
+
+    renamable $r5 = t2LDRi12 undef renamable $r0, 0, 14, $noreg :: (load 4 from `%0** undef`, !tbaa !2)
+    $r1 = tMOVr killed $r9, 14, $noreg
+    $r0 = tMOVr $r5, 14, $noreg
+    tBL 14, $noreg, @func4, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit killed $r0, implicit killed $r1, implicit-def $sp, implicit-def $r0
+    renamable $r1 = t2LDRi8 $r7, -28, 14, $noreg :: (load 4 from %stack.3)
+    $r9 = tMOVr killed $r0, 14, $noreg
+    renamable $r0 = t2ADDrs renamable $r11, renamable $r11, 10, 14, $noreg, $noreg
+    t2STRBi12 renamable $r6, killed renamable $r4, 0, 14, $noreg :: (store 1 into @g1, align 4)
+    renamable $r4 = t2ADDrs killed renamable $r1, killed renamable $r0, 34, 14, $noreg, $noreg
+    t2STRi12 renamable $r5, renamable $r4, 4, 14, $noreg :: (store 4 into %ir.tmp21, !tbaa !9)
+
+  bb.6.bb22:
+    successors: %bb.7(0x36058b42), %bb.6(0x49fa74be)
+    liveins: $r4, $r5, $r6, $r9, $r11
+
+    t2CMPri renamable $r6, 0, 14, $noreg, implicit-def $cpsr
+    t2Bcc %bb.6, 1, $cpsr
+
+  bb.7.bb24:
+    successors: %bb.8(0x7fd90c67), %bb.26(0x0026f399)
+    liveins: $cpsr, $r4, $r5, $r9, $r11
+
+    t2STRi8 renamable $r5, $r7, -24, 14, $noreg :: (store 4 into %stack.2)
+    t2Bcc %bb.26, 1, killed $cpsr
+
+  bb.8.bb27.preheader:
+    successors: %bb.9(0x7fffffff), %bb.27(0x00000001)
+    liveins: $r4, $r5, $r9, $r11
+
+    t2CMPri undef renamable $r0, 63, 14, $noreg, implicit-def $cpsr
+    t2Bcc %bb.27, 13, killed $cpsr
+
+  bb.9.bb29:
+    successors: %bb.28(0x00000001), %bb.10(0x7fffffff)
+    liveins: $r4, $r5, $r9, $r11
+
+    tBL 14, $noreg, @func3, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit undef $r0, implicit undef $r1, implicit-def $sp, implicit-def $r0
+    t2CMPri $r0, 0, 14, $noreg, implicit-def $cpsr
+    t2Bcc %bb.28, 0, killed $cpsr
+
+  bb.10.bb36:
+    successors: %bb.19(0x646d4ada), %bb.11(0x1b92b526)
+    liveins: $r4, $r5, $r9, $r11, $r0
+
+    renamable $r10 = t2SUBrr killed renamable $r5, renamable $r9, 14, $noreg, def $cpsr
+    $r8 = tMOVr killed $r0, 14, $noreg
+    renamable $r0 = t2MOVi 0, 14, $noreg, $noreg
+    BUNDLE implicit-def dead $itstate, implicit-def $r10, implicit killed $r9, implicit killed $cpsr, implicit killed $r10 {
+      t2IT 1, 8, implicit-def $itstate
+      $r10 = t2MOVr killed renamable $r9, 1, killed $cpsr, $noreg, implicit killed renamable $r10, implicit internal killed $itstate
+    }
+    renamable $r9 = t2LDRi8 $r7, -32, 14, $noreg :: (load 4 from %stack.4)
+    t2STRi8 killed renamable $r0, $r7, -20, 14, $noreg :: (store 4 into %stack.1)
+    renamable $r0 = t2MOVi 1, 14, $noreg, $noreg
+    t2CMPri killed renamable $r0, 0, 14, $noreg, implicit-def $cpsr
+    t2Bcc %bb.19, 1, killed $cpsr
+
+  bb.11.bb41:
+    successors: %bb.13(0x3b2351c6), %bb.12(0x44dcae3a)
+    liveins: $r4, $r8, $r9, $r10, $r11
+
+    renamable $r1 = t2LDRi12 undef renamable $r0, 0, 14, $noreg :: (load 4 from `%4** undef`, !tbaa !17)
+    $r0 = t2LDRi8 $r7, -24, 14, $noreg :: (load 4 from %stack.2)
+    t2STRi8 $r1, $r7, -20, 14, $noreg :: (store 4 into %stack.1)
+    renamable $r1 = t2LDRi12 killed renamable $r1, 0, 14, $noreg :: (load 4 from %ir.tmp451, !tbaa !19)
+    tBL 14, $noreg, @func2, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit killed $r0, implicit killed $r1, implicit-def $sp, implicit-def dead $r0
+    $r0 = tMOVr killed $r10, 14, $noreg
+    tBL 14, $noreg, @func2, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit killed $r0, implicit undef $r1, implicit-def $sp, implicit-def dead $r0
+    renamable $r0 = t2MOVi 0, 14, $noreg, $noreg
+    t2CMPri renamable $r0, 0, 14, $noreg, implicit-def $cpsr
+    $r10 = tMOVr killed $r9, 14, $noreg
+    BUNDLE implicit-def dead $itstate, implicit-def $r8, implicit killed $cpsr, implicit killed $r8 {
+      t2IT 0, 8, implicit-def $itstate
+      renamable $r8 = t2MOVi 0, 0, killed $cpsr, $noreg, implicit killed $r8, implicit internal killed $itstate
+    }
+    t2CMPri killed renamable $r0, 0, 14, $noreg, implicit-def $cpsr
+    t2Bcc %bb.13, 0, killed $cpsr
+
+  bb.12:
+    successors: %bb.14(0x80000000)
+    liveins: $r4, $r11, $r8, $r10
+
+    renamable $r6 = t2LDRi8 $r7, -20, 14, $noreg :: (load 4 from %stack.1)
+    t2B %bb.14, 14, $noreg
+
+  bb.13.bb53:
+    successors: %bb.14(0x80000000)
+    liveins: $r4, $r11, $r10, $r8
+
+    renamable $r6 = t2LDRi8 $r7, -20, 14, $noreg :: (load 4 from %stack.1)
+    renamable $r5 = t2LDRi8 $r7, -24, 14, $noreg :: (load 4 from %stack.2)
+    renamable $r0 = t2LDRi12 renamable $r6, 0, 14, $noreg :: (load 4 from %ir.1, !tbaa !19)
+    $r1 = tMOVr $r5, 14, $noreg
+    tBL 14, $noreg, @func2, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit killed $r0, implicit killed $r1, implicit-def $sp, implicit-def $r0
+    t2CMPri killed renamable $r0, 0, 14, $noreg, implicit-def $cpsr
+    BUNDLE implicit-def dead $itstate, implicit-def $r8, implicit killed $r5, implicit killed $cpsr, implicit killed $r8 {
+      t2IT 1, 8, implicit-def $itstate
+      $r8 = t2MOVr killed renamable $r5, 1, killed $cpsr, $noreg, implicit killed renamable $r8, implicit internal killed $itstate
+    }
+
+  bb.14.bb58:
+    successors: %bb.18(0x5e661501), %bb.15(0x2199eafe)
+    liveins: $r4, $r11, $r10, $r8, $r6
+
+    renamable $r6 = t2LDRi12 killed renamable $r6, 12, 14, $noreg :: (load 4 from %ir.tmp60, !tbaa !22), (load 4 from %ir.tmp78, !tbaa !22)
+    t2CMPri renamable $r6, 0, 14, $noreg, implicit-def $cpsr
+    t2Bcc %bb.18, 0, killed $cpsr
+
+  bb.15.bb63:
+    successors: %bb.16(0x3b2351c6), %bb.17(0x44dcae3a)
+    liveins: $r4, $r6, $r8, $r10, $r11
+
+    t2CMPri killed renamable $r8, 0, 14, $noreg, implicit-def $cpsr
+    renamable $r0 = t2MOVi 0, 14, $noreg, $noreg
+    t2CMPri killed renamable $r0, 0, 14, $noreg, implicit-def $cpsr
+    renamable $r9 = t2MOVi 0, 14, $noreg, $noreg
+    t2Bcc %bb.17, 1, killed $cpsr
+
+  bb.16.bb72:
+    successors: %bb.17(0x80000000)
+    liveins: $r4, $r6, $r9, $r10, $r11
+
+    renamable $r5 = t2LDRi8 $r7, -24, 14, $noreg :: (load 4 from %stack.2)
+    $r1 = tMOVr $r5, 14, $noreg
+    tBL 14, $noreg, @func2, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit undef $r0, implicit killed $r1, implicit-def $sp, implicit-def $r0
+    t2CMPri killed renamable $r0, 0, 14, $noreg, implicit-def $cpsr
+    BUNDLE implicit-def dead $itstate, implicit-def $r9, implicit killed $r5, implicit killed $cpsr, implicit killed $r9 {
+      t2IT 1, 8, implicit-def $itstate
+      $r9 = t2MOVr killed renamable $r5, 1, killed $cpsr, $noreg, implicit killed renamable $r9, implicit internal killed $itstate
+    }
+
+  bb.17.bb76:
+    successors: %bb.14(0x80000000)
+    liveins: $r4, $r6, $r11, $r10, $r9
+
+    $r8 = tMOVr killed $r9, 14, $noreg
+    t2B %bb.14, 14, $noreg
+
+  bb.18:
+    successors: %bb.19(0x80000000)
+    liveins: $r4, $r11, $r10
+
+    $r9 = tMOVr killed $r10, 14, $noreg
+
+  bb.19.bb81:
+    successors: %bb.20(0x80000000)
+    liveins: $r4, $r9, $r11
+
+    $r8, $r5 = t2LDRDi8 $r7, -24, 14, $noreg :: (load 4 from %stack.2), (load 4 from %stack.1)
+    renamable $r6 = t2MOVi 0, 14, $noreg, $noreg
+
+  bb.20.bb98:
+    successors: %bb.21(0x7fffffff), %bb.29(0x00000001)
+    liveins: $r4, $r5, $r6, $r8, $r9, $r11
+
+    t2CMPri renamable $r5, 0, 14, $noreg, implicit-def $cpsr
+    t2Bcc %bb.29, 1, killed $cpsr
+
+  bb.21.bb85:
+    successors: %bb.20(0x0c24a766), %bb.22(0x73db589a)
+    liveins: $r4, $r5, $r6, $r8, $r9, $r11
+
+    $r0 = tMOVr $r9, 14, $noreg
+    $r3 = t2MOVi 0, 14, $noreg, $noreg
+    tBL 14, $noreg, @func7, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit killed $r0, implicit undef $r1, implicit undef $r2, implicit killed $r3, implicit-def $sp, implicit-def $r0
+    t2CMPri killed renamable $r0, 0, 14, $noreg, implicit-def $cpsr
+    t2Bcc %bb.20, 0, killed $cpsr
+
+  bb.22.bb88:
+    successors: %bb.23(0x42dc9697), %bb.5(0x3d236969)
+    liveins: $r4, $r6, $r8, $r9, $r11
+
+    renamable $r0 = t2LDRi12 killed renamable $r4, 0, 14, $noreg :: (load 4 from %ir.tmp17, !tbaa !30)
+    $r1 = tMOVr $r9, 14, $noreg
+    renamable $r0 = t2LDRi12 killed renamable $r0, 8, 14, $noreg :: (load 4 from %ir.tmp91, !tbaa !2)
+    tBL 14, $noreg, @func8, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit killed $r0, implicit killed $r1, implicit-def $sp, implicit-def dead $r0
+    $r4 = t2MOVi16 target-flags(arm-lo16) @g1, 14, $noreg
+    $r0 = tMOVr killed $r8, 14, $noreg
+    $r1 = tMOVr $r9, 14, $noreg
+    $r4 = t2MOVTi16 killed $r4, target-flags(arm-hi16) @g1, 14, $noreg
+    t2STRBi12 renamable $r6, renamable $r4, 0, 14, $noreg :: (store 1 into @g1, align 4)
+    tBL 14, $noreg, @func4, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit killed $r0, implicit killed $r1, implicit-def $sp, implicit-def dead $r0
+    renamable $r11 = nuw nsw t2ADDri killed renamable $r11, 1, 14, $noreg, $noreg
+    t2CMPri renamable $r11, 1, 14, $noreg, implicit-def $cpsr
+    renamable $r0 = t2MOVi -1, 14, $noreg, $noreg
+    t2STRi12 killed renamable $r0, renamable $r9, 20, 14, $noreg :: (store 4 into %ir.tmp95, !tbaa !2)
+    t2Bcc %bb.5, 1, killed $cpsr
+
+  bb.23.bb102:
+    $r1 = t2LDRi8 $r7, -36, 14, $noreg :: (load 4 from %stack.5)
+    tBL 14, $noreg, @func9, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit undef $r0, implicit killed $r1, implicit-def $sp
+    $r4 = t2SUBri $r7, 12, 14, $noreg, $noreg
+    $sp = tMOVr killed $r4, 14, $noreg
+    $sp = t2LDMIA_RET $sp, 14, $noreg, def $r4, def $r5, def $r6, def $r7, def $r8, def $r9, def $r10, def $r11, def $pc
+
+  bb.24.bb4:
+    successors:
+
+    $r1 = t2MOVi 0, 14, $noreg, $noreg
+    tBL 14, $noreg, @func8, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit undef $r0, implicit killed $r1, implicit-def $sp, implicit-def dead $r0
+
+  bb.25.bb10:
+    successors:
+    liveins: $r9
+
+    $r1 = tMOVr $r9, 14, $noreg
+    tBL 14, $noreg, @func8, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit undef $r0, implicit killed $r1, implicit-def $sp, implicit-def $r0
+    $r2 = tMOVr killed $r0, 14, $noreg
+    $r0 = tMOVr killed $r9, 14, $noreg
+    $r3 = t2MOVi 1, 14, $noreg, $noreg
+    tBL 14, $noreg, @func7, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit killed $r0, implicit undef $r1, implicit killed $r2, implicit killed $r3, implicit-def $sp, implicit-def dead $r0
+
+  bb.26.bb25:
+    successors: %bb.11(0x80000000)
+    liveins: $r4, $r11
+
+    renamable $r9 = t2LDRi8 $r7, -32, 14, $noreg :: (load 4 from %stack.4)
+    renamable $r10 = IMPLICIT_DEF
+    renamable $r8 = IMPLICIT_DEF
+    t2B %bb.11, 14, $noreg
+
+  bb.27.bb32:
+    successors:
+
+    tBL 14, $noreg, @func5, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit undef $r0, implicit undef $r1, implicit-def $sp, implicit-def dead $r0
+
+  bb.28.bb34:
+    successors:
+
+    tBL 14, $noreg, @func1, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit undef $r0, implicit undef $r1, implicit-def $sp, implicit-def dead $r0
+
+  bb.29.bb83:
+    $r2 = t2MOVi 1, 14, $noreg, $noreg
+    tBL 14, $noreg, @func6, csr_aapcs, implicit-def dead $lr, implicit $sp, implicit undef $r0, implicit undef $r1, implicit killed $r2, implicit-def $sp, implicit-def dead $r0
+
+...