[ValueTracking] Branch on poison is UB, branch cond is non-poison.

[fhahn]

Summary

According to LangRef, branching on a poison condition is UB, hence the
condition should be guaranteed to not be poison.

This allows us to deduce additional nsw/nuw in some cases.

The changes in test/Transforms/LoopVectorize/consecutive-ptr-uniforms.ll
are required because add nuw %i, -1 means %i can only be 0.

The changes in test/Transforms/LoopUnroll/runtime-small-upperbound.ll
are required, because previously we had a max trip count of 4 and 6
respectively (instead of 3 and 5), because SCEV assumed the additions in
the loops could overflow and the initial value could be just below UMAX,
with the first add overflowing. I also tried to update the test to cover
all possible combinations.

[efriedma]

This has rather more impact than I was expecting... but I guess this sort of reasoning was missing before, to some extent.

LGTM

[jdoerfert]

Nice :)

[efriedma]

Actually, thinking about it a bit more, I'm not completely comfortable with landing this yet. We still have a few known issues with IR transforms that don't correctly freeze branch conditions, and I'm afraid the interaction here might expose them as miscompiles.

[nlopes]

The passes we are aware that introduce branch on poison are: IndVarSimplify, LoopUnswitch, SimpleLoopUnswitch, and SimpifyCFG.
(https://web.ist.utl.pt/nuno.lopes/alive2/index.php?hash=4beb2b117e2fdd2c)

I tend to agree with Eli that this patch may help triggering end-to-end miscompilations. But it's otherwise correct; nice catch!

[fhahn]

In D80875#2065190, @efriedma wrote:

Actually, thinking about it a bit more, I'm not completely comfortable with landing this yet. We still have a few known issues with IR transforms that don't correctly freeze branch conditions, and I'm afraid the interaction here might expose them as miscompiles.

Sounds good to me! I've filed https://bugs.llvm.org/show_bug.cgi?id=46144 to collect/keep information of the passes that need fixing. I guess it's fine to wait with landing this patch until most issues have been resolved.

[fhahn]

Added now behind a flag: a461fa64bb37

llvm/lib/Analysis/ValueTracking.cpp

case Instruction::AtomicRMW:
       return cast<AtomicRMWInst>(I)->getPointerOperand();
 
     case Instruction::UDiv:
     case Instruction::SDiv:
     case Instruction::URem:
     case Instruction::SRem:
       return I->getOperand(1);
 
+    case Instruction::Br: {
+      const auto *BranchI = cast<BranchInst>(I);
+      if (!BranchI->isConditional())
+        return nullptr;
+      return BranchI->getCondition();
+    }
+
     case Instruction::Call:
       if (auto *II = dyn_cast<IntrinsicInst>(I)) {
         switch (II->getIntrinsicID()) {
         case Intrinsic::assume:
           return II->getArgOperand(0);
         default:
           return nullptr;
         }

llvm/test/Analysis/ScalarEvolution/limit-depth.ll

; CHECK-NEXT:  -->  (2 * 3 * 4 * 5 * 6 * 7 * %a * %b * %c * %d * %e * %f)
   %s1 = mul i32 %p1, %p2
   %s2 = mul i32 %s1, %p3
   ret void
 }
 
 define void @test_sext(i32 %a, i32 %b, i32 %c, i32 %d, i32 %e, i32 %f) {
 ; CHECK-LABEL: @test_sext
 ; CHECK:        %se2 = sext i64 %iv2.inc to i128
-; CHECK-NEXT:   -->  {(1 + (sext i64 {(sext i32 (1 + %a) to i64),+,1}<nsw><%loop> to i128))<nsw>,+,1}<nsw><%loop2>
+; CHECK-NEXT:   -->  {(1 + (sext i64 {(sext i32 (1 + %a)<nsw> to i64),+,1}<nsw><%loop> to i128))<nsw>,+,1}<nsw><%loop2>
 entry:
   br label %loop
 
 loop:
   %iv = phi i32 [ %a, %entry ], [ %iv.inc, %loop ]
   %iv.inc = add nsw i32 %iv, 1
   %cond = icmp sle i32 %iv.inc, 50
   br i1 %cond, label %loop, label %between

 exit:
   %ze2 = zext i64 %iv2.inc to i128
   ret void
 }
 
 define void @test_trunc(i32 %a, i32 %b, i32 %c, i32 %d, i32 %e, i32 %f) {
 ; CHECK-LABEL: @test_trunc
 ; CHECK:          %trunc2 = trunc i64 %iv2.inc to i32
-; CHECK-NEXT:     -->  {(trunc i64 (1 + {7,+,1}<%loop>) to i32),+,1}<%loop2>
+; CHECK-NEXT:     -->  {(trunc i64 (1 + {7,+,1}<%loop>)<nuw> to i32),+,1}<%loop2>
 entry:
   br label %loop
 
 loop:
   %iv = phi i128 [ 6, %entry ], [ %iv.inc, %loop ]
   %iv.inc = add nsw i128 %iv, 1
   %cond = icmp sle i128 %iv.inc, 50
   br i1 %cond, label %loop, label %between

llvm/test/Analysis/ScalarEvolution/trip-count12.ll

 ; RUN: opt < %s -analyze -scalar-evolution | FileCheck %s
 
 ; CHECK: Determining loop execution counts for: @test
-; CHECK: Loop %for.body: backedge-taken count is ((-2 + %len) /u 2)
+; CHECK: Loop %for.body: backedge-taken count is ((-2 + %len)<nsw> /u 2)
 ; CHECK: Loop %for.body: max backedge-taken count is 1073741823
 
 define zeroext i16 @test(i16* nocapture %p, i32 %len) nounwind readonly {
 entry:
   %cmp2 = icmp sgt i32 %len, 1
   br i1 %cmp2, label %for.body.preheader, label %for.end
 
 for.body.preheader:                               ; preds = %entry

llvm/test/Analysis/ScalarEvolution/trip-count9.ll

loop:
   br i1 %t, label %loop, label %exit
 exit:
   ret void
 }
 
 define void @nsw_startx(i4 %n, i4 %x) {
 ; CHECK-LABEL: 'nsw_startx'
 ; CHECK-NEXT:  Determining loop execution counts for: @nsw_startx
-; CHECK-NEXT:  Loop %loop: backedge-taken count is (-1 + (-1 * %x) + ((1 + %x) smax %n))
+; CHECK-NEXT:  Loop %loop: backedge-taken count is (-1 + (-1 * %x) + ((1 + %x)<nsw> smax %n))
 ; CHECK-NEXT:  Loop %loop: max backedge-taken count is -1
-; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is (-1 + (-1 * %x) + ((1 + %x) smax %n))
+; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is (-1 + (-1 * %x) + ((1 + %x)<nsw> smax %n))
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;
 entry:
   %s = icmp sgt i4 %n, 0
   br i1 %s, label %loop, label %exit
 loop:
   %i = phi i4 [ %x, %entry ], [ %i.next, %loop ]
   %i.next = add nsw i4 %i, 1
   %t = icmp slt i4 %i.next, %n
   br i1 %t, label %loop, label %exit
 exit:
   ret void
 }
 
 define void @nsw_startx_step2(i4 %n, i4 %x) {
 ; CHECK-LABEL: 'nsw_startx_step2'
 ; CHECK-NEXT:  Determining loop execution counts for: @nsw_startx_step2
-; CHECK-NEXT:  Loop %loop: backedge-taken count is ((-1 + (-1 * %x) + ((2 + %x) smax %n)) /u 2)
+; CHECK-NEXT:  Loop %loop: backedge-taken count is ((-1 + (-1 * %x) + ((2 + %x)<nsw> smax %n)) /u 2)
 ; CHECK-NEXT:  Loop %loop: max backedge-taken count is 7
-; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is ((-1 + (-1 * %x) + ((2 + %x) smax %n)) /u 2)
+; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is ((-1 + (-1 * %x) + ((2 + %x)<nsw> smax %n)) /u 2)
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;
 entry:
   %s = icmp sgt i4 %n, 0
   br i1 %s, label %loop, label %exit
 loop:
   %i = phi i4 [ %x, %entry ], [ %i.next, %loop ]
loop:
   br i1 %t, label %loop, label %exit
 exit:
   ret void
 }
 
 define void @even_nsw_startx(i4 %n, i4 %x) {
 ; CHECK-LABEL: 'even_nsw_startx'
 ; CHECK-NEXT:  Determining loop execution counts for: @even_nsw_startx
-; CHECK-NEXT:  Loop %loop: backedge-taken count is (-1 + (-1 * %x) + ((1 + %x) smax (2 * %n)))
+; CHECK-NEXT:  Loop %loop: backedge-taken count is (-1 + (-1 * %x) + ((1 + %x)<nsw> smax (2 * %n)))
 ; CHECK-NEXT:  Loop %loop: max backedge-taken count is -2
-; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is (-1 + (-1 * %x) + ((1 + %x) smax (2 * %n)))
+; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is (-1 + (-1 * %x) + ((1 + %x)<nsw> smax (2 * %n)))
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;
 entry:
   %m = shl i4 %n, 1
   %s = icmp sgt i4 %m, 0
   br i1 %s, label %loop, label %exit
 loop:
   %i = phi i4 [ %x, %entry ], [ %i.next, %loop ]
   %i.next = add nsw i4 %i, 1
   %t = icmp slt i4 %i.next, %m
   br i1 %t, label %loop, label %exit
 exit:
   ret void
 }
 
 define void @even_nsw_startx_step2(i4 %n, i4 %x) {
 ; CHECK-LABEL: 'even_nsw_startx_step2'
 ; CHECK-NEXT:  Determining loop execution counts for: @even_nsw_startx_step2
-; CHECK-NEXT:  Loop %loop: backedge-taken count is ((-1 + (-1 * %x) + ((2 + %x) smax (2 * %n))) /u 2)
+; CHECK-NEXT:  Loop %loop: backedge-taken count is ((-1 + (-1 * %x) + ((2 + %x)<nsw> smax (2 * %n))) /u 2)
 ; CHECK-NEXT:  Loop %loop: max backedge-taken count is 7
-; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is ((-1 + (-1 * %x) + ((2 + %x) smax (2 * %n))) /u 2)
+; CHECK-NEXT:  Loop %loop: Predicated backedge-taken count is ((-1 + (-1 * %x) + ((2 + %x)<nsw> smax (2 * %n))) /u 2)
 ; CHECK-NEXT:   Predicates:
 ; CHECK:       Loop %loop: Trip multiple is 1
 ;
 entry:
   %m = shl i4 %n, 1
   %s = icmp sgt i4 %m, 0
   br i1 %s, label %loop, label %exit
 loop:
   %i = phi i4 [ %x, %entry ], [ %i.next, %loop ]
   %i.next = add nsw i4 %i, 2
   %t = icmp slt i4 %i.next, %m
   br i1 %t, label %loop, label %exit
 exit:
   ret void
 }

llvm/test/Transforms/IndVarSimplify/X86/loop-invariant-conditions.ll

 ; CHECK-LABEL: @test4_neg(
 ; CHECK-NEXT:  entry:
 ; CHECK-NEXT:    [[TMP0:%.*]] = icmp sgt i64 [[START:%.*]], 0
 ; CHECK-NEXT:    [[SMAX:%.*]] = select i1 [[TMP0]], i64 [[START]], i64 0
 ; CHECK-NEXT:    [[TMP1:%.*]] = add nuw i64 [[SMAX]], 1
 ; CHECK-NEXT:    br label [[LOOP:%.*]]
 ; CHECK:       loop:
 ; CHECK-NEXT:    [[INDVARS_IV:%.*]] = phi i64 [ [[START]], [[ENTRY:%.*]] ], [ [[INDVARS_IV_NEXT:%.*]], [[BACKEDGE:%.*]] ]
-; CHECK-NEXT:    [[INDVARS_IV_NEXT]] = add i64 [[INDVARS_IV]], 1
+; CHECK-NEXT:    [[INDVARS_IV_NEXT]] = add nsw i64 [[INDVARS_IV]], 1
 ; CHECK-NEXT:    [[CMP:%.*]] = icmp eq i64 [[INDVARS_IV_NEXT]], 25
 ; CHECK-NEXT:    br i1 [[CMP]], label [[BACKEDGE]], label [[FOR_END:%.*]]
 ; CHECK:       backedge:
 ; CHECK-NEXT:    call void @foo()
 ; CHECK-NEXT:    [[EXITCOND:%.*]] = icmp eq i64 [[INDVARS_IV_NEXT]], [[TMP1]]
 ; CHECK-NEXT:    br i1 [[EXITCOND]], label [[FOR_END]], label [[LOOP]]
 ; CHECK:       for.end:
 ; CHECK-NEXT:    ret void

llvm/test/Transforms/IndVarSimplify/lftr-reuse.ll

 ; simplified, and as a result the inner loop's exit test will be rewritten.
 define void @expandOuterRecurrence(i32 %arg) nounwind {
 ; CHECK-LABEL: @expandOuterRecurrence(
 ; CHECK-NEXT:  entry:
 ; CHECK-NEXT:    [[SUB1:%.*]] = sub nsw i32 [[ARG:%.*]], 1
 ; CHECK-NEXT:    [[CMP1:%.*]] = icmp slt i32 0, [[SUB1]]
 ; CHECK-NEXT:    br i1 [[CMP1]], label [[OUTER_PREHEADER:%.*]], label [[EXIT:%.*]]
 ; CHECK:       outer.preheader:
-; CHECK-NEXT:    [[TMP0:%.*]] = add i32 [[ARG]], -1
+; CHECK-NEXT:    [[TMP0:%.*]] = add nsw i32 [[ARG]], -1
 ; CHECK-NEXT:    br label [[OUTER:%.*]]
 ; CHECK:       outer:
 ; CHECK-NEXT:    [[INDVARS_IV:%.*]] = phi i32 [ [[TMP0]], [[OUTER_PREHEADER]] ], [ [[INDVARS_IV_NEXT:%.*]], [[OUTER_INC:%.*]] ]
 ; CHECK-NEXT:    [[I:%.*]] = phi i32 [ [[I_INC:%.*]], [[OUTER_INC]] ], [ 0, [[OUTER_PREHEADER]] ]
 ; CHECK-NEXT:    [[SUB2:%.*]] = sub nsw i32 [[ARG]], [[I]]
 ; CHECK-NEXT:    [[SUB3:%.*]] = sub nsw i32 [[SUB2]], 1
 ; CHECK-NEXT:    [[CMP2:%.*]] = icmp slt i32 0, [[SUB3]]
 ; CHECK-NEXT:    br i1 [[CMP2]], label [[INNER_PH:%.*]], label [[OUTER_INC]]

llvm/test/Transforms/LoopUnroll/runtime-small-upperbound.ll

-; RUN: opt -S -loop-unroll -unroll-runtime %s -o - | FileCheck %s
-; RUN: opt -S -loop-unroll -unroll-runtime -unroll-max-upperbound=6 %s -o - | FileCheck %s --check-prefix=UPPER
+; RUN: opt -S -loop-unroll -unroll-runtime -unroll-max-upperbound=2 %s -o - | FileCheck %s --check-prefix=HOGE3-UNROLLED --check-prefix=HOGE5-UNROLLED
+; RUN: opt -S -loop-unroll -unroll-runtime -unroll-max-upperbound=5 %s -o - | FileCheck %s --check-prefix=HOGE3-NOUNROLL --check-prefix=HOGE5-UNROLLED
+; RUN: opt -S -loop-unroll -unroll-runtime -unroll-max-upperbound=6 %s -o - | FileCheck %s --check-prefix=HOGE3-NOUNROLL --check-prefix=HOGE5-NOUNROLL
 
 target datalayout = "e-m:e-p:32:32-i64:64-v128:64:128-a:0:32-n32-S64"
 
 @global = dso_local local_unnamed_addr global i32 0, align 4
 @global.1 = dso_local local_unnamed_addr global i8* null, align 4
 
-; Check that loop in hoge_3, with a runtime upperbound of 3, is not unrolled.
-; CHECK-LABEL: hoge_3
-; CHECK: loop:
-; CHECK: store
-; CHECK-NOT: store
-; CHECK: br i1 %{{.*}}, label %loop
-; UPPER-LABEL: hoge_3
-; UPPER: loop:
-; UPPER: store
-; UPPER-NOT: store
-; UPPER: br i1 %{{.*}}, label %loop
+; Check that loop in hoge_3, with a runtime upperbound of 3, is not unrolled with -unroll-max-upperbound=5 or 6, but is unrolled with -unroll-max-upperbound=2.
+; HOGE3-UNROLLED-LABEL: hoge_3
+; HOGE3-UNROLLED: loop:
+; HOGE3-UNROLLED:   store
+; HOGE3-UNROLLED:   store
+; HOGE3-UNROLLED:   store
+; HOGE3-UNROLLED:   br i1 %{{.*}}, label %loop
+; HOGE3-NOUNROLL-LABEL: hoge_3
+; HOGE3-NOUNROLL: loop:
+; HOGE3-NOUNROLL:   store
+; HOGE3-NOUNROLL-NOT:   store
+; HOGE3-NOUNROLL:   br i1 %{{.*}}, label %loop
 define dso_local void @hoge_3(i8 %arg) {
 entry:
   %x = load i32, i32* @global, align 4
   %y = load i8*, i8** @global.1, align 4
   %0 = icmp ult i32 %x, 17
   br i1 %0, label %loop, label %exit
 
 loop:
   %iv = phi i32 [ %x, %entry ], [ %iv.next, %loop ]
   %ptr = phi i8* [ %y, %entry ], [ %ptr.next, %loop ]
   %iv.next = add nuw i32 %iv, 8
   %ptr.next = getelementptr inbounds i8, i8* %ptr, i32 1
   store i8 %arg, i8* %ptr.next, align 1
   %1 = icmp ult i32 %iv.next, 17
   br i1 %1, label %loop, label %exit
 
 exit:
   ret void
 }
 
-; Check that loop in hoge_5, with a runtime upperbound of 5, is unrolled when -unroll-max-upperbound=4
-; CHECK-LABEL: hoge_5
-; CHECK: loop:
-; CHECK: store
-; CHECK-NOT: store
-; CHECK: br i1 %{{.*}}, label %loop
-; UPPER-LABEL: hoge_5
-; UPPER: loop:
-; UPPER: store
-; UPPER: store
-; UPPER: store
-; UPPER: br i1 %{{.*}}, label %loop
+; Check that loop in hoge_5, with a runtime upperbound of 5, is unrolled when
+; -unroll-max-upperbound=5, but not unrolled with -unroll-max-upperbound=6
+; HOGE5-UNROLLED-LABEL: hoge_5
+; HOGE5-UNROLLED: loop:
+; HOGE5-UNROLLED:   store
+; HOGE5-UNROLLED:   store
+; HOGE5-UNROLLED:   store
+; HOGE5-UNROLLED:   store
+; HOGE5-UNROLLED:   store
+; HOGE5-UNROLLED:   br i1 %{{.*}}, label %loop
+; HOGE5-NOUNROLL-LABEL: hoge_5
+; HOGE5-NOUNROLL: loop:
+; HOGE5-NOUNROLL:   store
+; HOGE5-NOUNROLL-NOT:   store
+; HOGE5-NOUNROLL:   br i1 %{{.*}}, label %loop
 define dso_local void @hoge_5(i8 %arg) {
 entry:
   %x = load i32, i32* @global, align 4
   %y = load i8*, i8** @global.1, align 4
   %0 = icmp ult i32 %x, 17
   br i1 %0, label %loop, label %exit
 
 loop:

llvm/test/Transforms/LoopVectorize/X86/small-size.ll

 ; CHECK:       ..preheader_crit_edge:
 ; CHECK-NEXT:    [[PHITMP:%.*]] = sext i32 [[N]] to i64
 ; CHECK-NEXT:    br label [[DOTPREHEADER]]
 ; CHECK:       .preheader:
 ; CHECK-NEXT:    [[I_0_LCSSA:%.*]] = phi i64 [ [[PHITMP]], [[DOT_PREHEADER_CRIT_EDGE]] ], [ 0, [[TMP0:%.*]] ]
 ; CHECK-NEXT:    [[TMP17:%.*]] = icmp eq i32 [[N]], 0
 ; CHECK-NEXT:    br i1 [[TMP17]], label [[DOT_CRIT_EDGE:%.*]], label [[DOTLR_PH_PREHEADER:%.*]]
 ; CHECK:       .lr.ph.preheader:
-; CHECK-NEXT:    [[TMP18:%.*]] = add i32 [[N]], -1
+; CHECK-NEXT:    [[TMP18:%.*]] = add nsw i32 [[N]], -1
 ; CHECK-NEXT:    [[TMP19:%.*]] = zext i32 [[TMP18]] to i64
 ; CHECK-NEXT:    br i1 false, label [[SCALAR_PH8:%.*]], label [[VECTOR_PH10:%.*]]
 ; CHECK:       vector.ph10:
 ; CHECK-NEXT:    [[N_RND_UP11:%.*]] = add nuw nsw i64 [[TMP19]], 4
 ; CHECK-NEXT:    [[N_VEC13:%.*]] = and i64 [[N_RND_UP11]], 8589934588
 ; CHECK-NEXT:    [[BROADCAST_SPLATINSERT20:%.*]] = insertelement <4 x i64> undef, i64 [[TMP19]], i32 0
 ; CHECK-NEXT:    [[BROADCAST_SPLAT21:%.*]] = shufflevector <4 x i64> [[BROADCAST_SPLATINSERT20]], <4 x i64> undef, <4 x i32> zeroinitializer
 ; CHECK-NEXT:    br label [[VECTOR_BODY9:%.*]]

 
 ; Loop has no primary induction as its integer IV has step -1 starting at
 ; unknown N, but can still be vectorized.
 define void @example3(i32 %n, i32* noalias nocapture %p, i32* noalias nocapture %q) optsize {
 ; CHECK-LABEL: @example3(
 ; CHECK-NEXT:    [[TMP1:%.*]] = icmp eq i32 [[N:%.*]], 0
 ; CHECK-NEXT:    br i1 [[TMP1]], label [[DOT_CRIT_EDGE:%.*]], label [[DOTLR_PH_PREHEADER:%.*]]
 ; CHECK:       .lr.ph.preheader:
-; CHECK-NEXT:    [[TMP2:%.*]] = add i32 [[N]], -1
+; CHECK-NEXT:    [[TMP2:%.*]] = add nsw i32 [[N]], -1
 ; CHECK-NEXT:    [[TMP3:%.*]] = zext i32 [[TMP2]] to i64
 ; CHECK-NEXT:    br i1 false, label [[SCALAR_PH:%.*]], label [[VECTOR_PH:%.*]]
 ; CHECK:       vector.ph:
 ; CHECK-NEXT:    [[N_RND_UP:%.*]] = add nuw nsw i64 [[TMP3]], 4
 ; CHECK-NEXT:    [[N_VEC:%.*]] = and i64 [[N_RND_UP]], 8589934588
 ; CHECK-NEXT:    [[BROADCAST_SPLATINSERT:%.*]] = insertelement <4 x i64> undef, i64 [[TMP3]], i32 0
 ; CHECK-NEXT:    [[BROADCAST_SPLAT:%.*]] = shufflevector <4 x i64> [[BROADCAST_SPLATINSERT]], <4 x i64> undef, <4 x i32> zeroinitializer
 ; CHECK-NEXT:    br label [[VECTOR_BODY:%.*]]

llvm/test/Transforms/LoopVectorize/consecutive-ptr-uniforms.ll

entry:
   br label %for.body
 
 for.body:
   %i = phi i64 [ %i.next, %for.body ], [ %n, %entry ]
   %tmp0 = phi i32 [ %tmp3, %for.body ], [ 0, %entry ]
   %tmp1 = getelementptr inbounds i32, i32* %a, i64 %i
   %tmp2 = load i32, i32* %tmp1, align 8
   %tmp3 = add i32 %tmp0, %tmp2
-  %i.next = add nuw nsw i64 %i, -1
+  %i.next = add nsw i64 %i, -1
   %cond = icmp sgt i64 %i.next, 0
   br i1 %cond, label %for.body, label %for.end
 
 for.end:
   %tmp4 = phi i32 [ %tmp3, %for.body ]
   ret i32 %tmp4
 }
 
for.body:
   %i = phi i64 [ %i.next, %for.body ], [ %n, %entry ]
   %tmp0 = phi i32 [ %tmp6, %for.body ], [ 0, %entry ]
   %tmp1 = getelementptr inbounds %pair, %pair* %p, i64 %i, i32 0
   %tmp2 = getelementptr inbounds %pair, %pair* %p, i64 %i, i32 1
   %tmp3 = load i32, i32* %tmp1, align 8
   %tmp4 = load i32, i32* %tmp2, align 8
   %tmp5 = add i32 %tmp3, %tmp4
   %tmp6 = add i32 %tmp0, %tmp5
-  %i.next = add nuw nsw i64 %i, -1
+  %i.next = add nsw i64 %i, -1
   %cond = icmp sgt i64 %i.next, 0
   br i1 %cond, label %for.body, label %for.end
 
 for.end:
   %tmp14 = phi i32 [ %tmp6, %for.body ]
   ret i32 %tmp14
 }