[CodeGenPrepare] Freeze condition when transforming select to br

[aqjune]

Summary

This is a simple fix for CodeGenPrepare that freezes branch condition when transforming select to branch.
If it is not frozen, instsimplify or the later pipeline can potentially exploit undefined behavior.

The diff shows optimized form becase D75859 and D76048 already made a few changes to CodeGenPrepare for optimizing freeze(cmp).

[lebedev.ri]

If it is not freezed, instsimplify or the later pipeline can potentially exploit undefined behavior.

Do we actually have instsimplify invocations so late, after CGP? I thought we didn't.

llvm/lib/CodeGen/CodeGenPrepare.cpp

6223

+".frozen"

[aqjune]

InstSimplify is called by CodeGenPrepare itself when visiting phis.

[aqjune]

Rename suffix to .frozen

llvm/lib/CodeGen/CodeGenPrepare.cpp

bool CodeGenPrepare::optimizeSelectInst(SelectInst *SI) {
   // Transform a sequence like this:
   //    start:
   //       %cmp = cmp uge i32 %a, %b
   //       %sel = select i1 %cmp, i32 %c, i32 %d
   //
   // Into:
   //    start:
   //       %cmp = cmp uge i32 %a, %b
-  //       br i1 %cmp, label %select.true, label %select.false
+  //       %cmp.fr = freeze %cmp
+  //       br i1 %cmp.fr, label %select.true, label %select.false
   //    select.true:
   //       br label %select.end
   //    select.false:
   //       br label %select.end
   //    select.end:
   //       %sel = phi i32 [ %c, %select.true ], [ %d, %select.false ]
   //
+  // %cmp should be freezed, otherwise it may introduce undefined behavior.
   // In addition, we may sink instructions that produce %c or %d from
   // the entry block into the destination(s) of the new branch.
   // If the true or false blocks do not contain a sunken instruction, that
   // block and its branch may be optimized away. In that case, one side of the
   // first branch will point directly to select.end, and the corresponding PHI
   // predecessor block will be the start block.
 
   // First, we split the block containing the select into 2 blocks.
bool CodeGenPrepare::optimizeSelectInst(SelectInst *SI) {
   } else if (FalseBlock == nullptr) {
     TT = TrueBlock;
     FT = EndBlock;
     FalseBlock = StartBlock;
   } else {
     TT = TrueBlock;
     FT = FalseBlock;
   }
-  IRBuilder<>(SI).CreateCondBr(SI->getCondition(), TT, FT, SI);
+  IRBuilder<> IB(SI);
+  auto CondFr = IB.CreateFreeze(SI->getCondition(), SI->getName() + ".fr");
+  IB.CreateCondBr(CondFr, TT, FT, SI);
 
   SmallPtrSet<const Instruction *, 2> INS;
   INS.insert(ASI.begin(), ASI.end());
   // Use reverse iterator because later select may use the value of the
   // earlier select, and we need to propagate value through earlier select
   // to get the PHI operand.
   for (auto It = ASI.rbegin(); It != ASI.rend(); ++It) {
     SelectInst *SI = *It;

llvm/test/CodeGen/ARM/2012-08-30-select.ll

 ; RUN: llc < %s -mtriple=thumbv7-apple-ios | FileCheck %s
 ; rdar://12201387
 
 ;CHECK-LABEL: select_s_v_v:
+;CHECK: vmov.i32
 ;CHECK: vmov
 ;CHECK-NEXT: vmov
-;CHECK: vmov.i32
 ;CHECK: bx
 define <16 x i8> @select_s_v_v(<16 x i8> %vec, i32 %avail) {
 entry:
   %and = and i32 %avail, 1
   %tobool = icmp eq i32 %and, 0
   %ret = select i1 %tobool, <16 x i8> %vec, <16 x i8> zeroinitializer
   ret <16 x i8> %ret
 }
 

llvm/test/Transforms/CodeGenPrepare/X86/optimizeSelect-DT.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
 ; RUN: opt -S -codegenprepare < %s | FileCheck %s
 
 target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 define i1 @PR41004(i32 %x, i32 %y, i32 %t1) {
 ; CHECK-LABEL: @PR41004(
 ; CHECK-NEXT:  entry:
-; CHECK-NEXT:    [[T0:%.*]] = icmp eq i32 [[Y:%.*]], 1
+; CHECK-NEXT:    [[MUL_FR:%.*]] = freeze i32 [[Y:%.*]]
+; CHECK-NEXT:    [[T0:%.*]] = icmp eq i32 [[MUL_FR]], 1
 ; CHECK-NEXT:    br i1 [[T0]], label [[SELECT_TRUE_SINK:%.*]], label [[SELECT_END:%.*]]
 ; CHECK:       select.true.sink:
 ; CHECK-NEXT:    [[REM:%.*]] = srem i32 [[X:%.*]], 2
 ; CHECK-NEXT:    br label [[SELECT_END]]
 ; CHECK:       select.end:
 ; CHECK-NEXT:    [[MUL:%.*]] = phi i32 [ [[REM]], [[SELECT_TRUE_SINK]] ], [ 0, [[ENTRY:%.*]] ]
 ; CHECK-NEXT:    [[NEG:%.*]] = add i32 [[T1:%.*]], -1
 ; CHECK-NEXT:    [[ADD:%.*]] = add i32 [[NEG]], [[MUL]]

llvm/test/Transforms/CodeGenPrepare/X86/select.ll

 }
 
 
 ; An 'fdiv' is expensive, so sink it rather than speculatively execute it.
 
 define float @fdiv_true_sink(float %a, float %b) {
 ; CHECK-LABEL: @fdiv_true_sink(
 ; CHECK-NEXT:  entry:
-; CHECK-NEXT:    [[CMP:%.*]] = fcmp ogt float [[A:%.*]], 1.000000e+00
+; CHECK-NEXT:    [[SEL_FR:%.*]] = freeze float [[A:%.*]]
+; CHECK-NEXT:    [[CMP:%.*]] = fcmp ogt float [[SEL_FR]], 1.000000e+00
 ; CHECK-NEXT:    br i1 [[CMP]], label [[SELECT_TRUE_SINK:%.*]], label [[SELECT_END:%.*]]
 ; CHECK:       select.true.sink:
 ; CHECK-NEXT:    [[DIV:%.*]] = fdiv float [[A]], [[B:%.*]]
 ; CHECK-NEXT:    br label [[SELECT_END]]
 ; CHECK:       select.end:
 ; CHECK-NEXT:    [[SEL:%.*]] = phi float [ [[DIV]], [[SELECT_TRUE_SINK]] ], [ 2.000000e+00, [[ENTRY:%.*]] ]
 ; CHECK-NEXT:    ret float [[SEL]]
 ;
 ; DEBUG-LABEL: @fdiv_true_sink(
 ; DEBUG-NEXT:  entry:
-; DEBUG-NEXT:    [[CMP:%.*]] = fcmp ogt float [[A:%.*]], 1.000000e+00
+; DEBUG-NEXT:    [[SEL_FR:%.*]] = freeze float [[A:%.*]]
+; DEBUG-NEXT:    [[CMP:%.*]] = fcmp ogt float [[SEL_FR]], 1.000000e+00, !dbg !24
 ; DEBUG-NEXT:    call void @llvm.dbg.value(metadata i1 [[CMP]]
 ; DEBUG-NEXT:    br i1 [[CMP]], label [[SELECT_TRUE_SINK:%.*]], label [[SELECT_END:%.*]], !dbg
 ; DEBUG:       select.true.sink:
 ; DEBUG-NEXT:    [[DIV:%.*]] = fdiv float [[A]], [[B:%.*]]
 ; DEBUG-NEXT:    call void @llvm.dbg.value(metadata float [[DIV]]
 ; DEBUG-NEXT:    br label [[SELECT_END]], !dbg
 ; DEBUG:       select.end:
 ; DEBUG-NEXT:    [[SEL:%.*]] = phi float [ [[DIV]], [[SELECT_TRUE_SINK]] ], [ 2.000000e+00, [[ENTRY:%.*]] ], !dbg
 ; DEBUG-NEXT:    call void @llvm.dbg.value(metadata float [[SEL]]
 ; DEBUG-NEXT:    ret float [[SEL]]
 ;
 entry:
   %div = fdiv float %a, %b
   %cmp = fcmp ogt float %a, 1.0
   %sel = select i1 %cmp, float %div, float 2.0
   ret float %sel
 }
 
 define float @fdiv_false_sink(float %a, float %b) {
 ; CHECK-LABEL: @fdiv_false_sink(
 ; CHECK-NEXT:  entry:
-; CHECK-NEXT:    [[CMP:%.*]] = fcmp ogt float [[A:%.*]], 3.000000e+00
+; CHECK-NEXT:    [[SEL_FR:%.*]] = freeze float [[A:%.*]]
+; CHECK-NEXT:    [[CMP:%.*]] = fcmp ogt float [[SEL_FR]], 3.000000e+00
 ; CHECK-NEXT:    br i1 [[CMP]], label [[SELECT_END:%.*]], label [[SELECT_FALSE_SINK:%.*]]
 ; CHECK:       select.false.sink:
 ; CHECK-NEXT:    [[DIV:%.*]] = fdiv float [[A]], [[B:%.*]]
 ; CHECK-NEXT:    br label [[SELECT_END]]
 ; CHECK:       select.end:
 ; CHECK-NEXT:    [[SEL:%.*]] = phi float [ 4.000000e+00, [[ENTRY:%.*]] ], [ [[DIV]], [[SELECT_FALSE_SINK]] ]
 ; CHECK-NEXT:    ret float [[SEL]]
 ;
 ; DEBUG-LABEL: @fdiv_false_sink(
 ; DEBUG-NEXT:  entry:
-; DEBUG-NEXT:    [[CMP:%.*]] = fcmp ogt float [[A:%.*]], 3.000000e+00
+; DEBUG-NEXT:    [[SEL_FR:%.*]] = freeze float [[A:%.*]]
+; DEBUG-NEXT:    [[CMP:%.*]] = fcmp ogt float [[SEL_FR]], 3.000000e+00, !dbg !33
 ; DEBUG-NEXT:    call void @llvm.dbg.value(metadata i1 [[CMP]]
 ; DEBUG-NEXT:    br i1 [[CMP]], label [[SELECT_END:%.*]], label [[SELECT_FALSE_SINK:%.*]], !dbg
 ; DEBUG:       select.false.sink:
 ; DEBUG-NEXT:    [[DIV:%.*]] = fdiv float [[A]], [[B:%.*]]
 ; DEBUG-NEXT:    call void @llvm.dbg.value(metadata float [[DIV]]
 ; DEBUG-NEXT:    br label [[SELECT_END]], !dbg
 ; DEBUG:       select.end:
 ; DEBUG-NEXT:    [[SEL:%.*]] = phi float [ 4.000000e+00, [[ENTRY:%.*]] ], [ [[DIV]], [[SELECT_FALSE_SINK]] ], !dbg
 ; DEBUG-NEXT:    call void @llvm.dbg.value(metadata float [[SEL]]
 ; DEBUG-NEXT:    ret float [[SEL]], !dbg
 ;
 entry:
   %div = fdiv float %a, %b
   %cmp = fcmp ogt float %a, 3.0
   %sel = select i1 %cmp, float 4.0, float %div
   ret float %sel
 }
 
 define float @fdiv_both_sink(float %a, float %b) {
 ; CHECK-LABEL: @fdiv_both_sink(
 ; CHECK-NEXT:  entry:
-; CHECK-NEXT:    [[CMP:%.*]] = fcmp ogt float [[A:%.*]], 5.000000e+00
+; CHECK-NEXT:    [[SEL_FR:%.*]] = freeze float [[A:%.*]]
+; CHECK-NEXT:    [[CMP:%.*]] = fcmp ogt float [[SEL_FR]], 5.000000e+00
 ; CHECK-NEXT:    br i1 [[CMP]], label [[SELECT_TRUE_SINK:%.*]], label [[SELECT_FALSE_SINK:%.*]]
 ; CHECK:       select.true.sink:
 ; CHECK-NEXT:    [[DIV1:%.*]] = fdiv float [[A]], [[B:%.*]]
 ; CHECK-NEXT:    br label [[SELECT_END:%.*]]
 ; CHECK:       select.false.sink:
 ; CHECK-NEXT:    [[DIV2:%.*]] = fdiv float [[B]], [[A]]
 ; CHECK-NEXT:    br label [[SELECT_END]]
 ; CHECK:       select.end: