[SCEV] Model ptrtoint(SCEVUnknown) cast not as unknown, but as zext/trunc/self of SCEVUnknown

[lebedev.ri]

Summary

While we indeed can't treat them as no-ops, i think we can/should do better than just modelling them as unknown.
inttoptr story is complicated, but for ptrtoint, it seems straight-forward to model it just as a zext-or-trunc of unknown.

This may be important now that we track towards making inttoptr/ptrtoint casts not no-op,
and towards preventing folding them into loads/etc (see D88979/D88789/D88788)

[efriedma]

Using getUnknown on a value that SCEV would normally be able to reason about has weird side-effects: unrelated uses of the value will also pick up the Unknown. Not sure what all the implications of that are off the top of my head, but it's hard to reason about.

Also, treating two distinct inttoptr instructions with the same operand as if they're equivalent is a known source of unsoundness; I don't want to expand that.

Given that, I don't think this is the right way to approach the issue. I prefer the approach from https://bugs.llvm.org/show_bug.cgi?id=46786#c20 . That would allow optimizing the given examples, I think: in contexts where we don't care about the derivation of a pointer, we can look through ptrtoint/inttoptr operations. (I don't think I'll have time to implement that in the near future, though.)

[lebedev.ri]

In D88806#2310959, @efriedma wrote:

Using getUnknown on a value that SCEV would normally be able to reason about has weird side-effects:
unrelated uses of the value will also pick up the Unknown.

Oh, that is a very good point..

Not sure what all the implications of that are off the top of my head, but it's hard to reason about.

Also, treating two distinct inttoptr instructions with the same operand as if they're equivalent is a known source of unsoundness; I don't want to expand that.

Hm, that sounds weird. Any chance for an example?
Then i'm guessing we can't allow this in any form even if unknown-to-be is a load?
(well, or more generally, even if getSCEV(operand) == unknown?)

Given that, I don't think this is the right way to approach the issue.
I prefer the approach from https://bugs.llvm.org/show_bug.cgi?id=46786#c20 .
That would allow optimizing the given examples,
I think: in contexts where we don't care about the derivation of a pointer,
we can look through ptrtoint/inttoptr operations.
(I don't think I'll have time to implement that in the near future, though.)

[efriedma]

See https://bugs.llvm.org/show_bug.cgi?id=34548 for the inttoptr semantic hole.

[lebedev.ri]

In D88806#2312222, @efriedma wrote:

See https://bugs.llvm.org/show_bug.cgi?id=34548 for the inttoptr semantic hole.

In D88806#2311154, @lebedev.ri wrote:

In D88806#2310959, @efriedma wrote:

Also, treating two distinct inttoptr instructions with the same operand as if they're equivalent is a known source of unsoundness; I don't want to expand that.

Hm, that sounds weird. Any chance for an example?
Then i'm guessing we can't allow this in any form even if unknown-to-be is a load?

... and if we can't even model inttoptr(load) as no-op cast(unknown) (can we?),
i'm getting increasingly more worried that we can't fix this in instcombine, either.

[nlopes]

ptrtoint and inttoptr are different beasts.
Supporting ptrtoint is much simpler. It's inttoptr that makes me uncomfortable. I don't known enough about SCEV to know how it handles these unknown nodes.
To me, the patch makes sense for ptrtoint (as you say, it's just a zext/sext of some unknown value; worst case it's poison if we want to be strict about OOB). Though I can't comment on the inttoptr case (some SCEV expert needs to chime in).

[mkazantsev]

It is now always clear how this patch lead to all these changes in different tests. I can't say if all of them are correct. To make it more reviewable and get progress here, I'd ask for the following:

• Whever you see test updates adding things like , align 1, please run it without your patch and commit these changes as NFC. This will reduce the scope of changes greatly.
• A dedicated test file with -analyze -scalar-evolution with single inttoptr, single ptrtoint, their combinations with each other, geps and arithmetics. It should include corner cases (nullptr, negative addresses etc). That would show how this works in isolation;
• Introduce inttoptr and ptrtoint in two different patches. I share @nlopes 's concern about inttoptr and not really sure how it should work;

Also a question: how this is going to interact with non-integral pointer types (https://llvm.org/docs/LangRef.html#nointptrtype)? I never touched it, but seems that we will have such thing at some point.

Also it bugs me that the address space notion gets lost during this transform, not sure if it may have bad implications.

llvm/test/Analysis/ScalarEvolution/no-wrap-add-exprs.ll

173

I don't quite get how we ended up with this. Do we somehow know that i8* is wider than i32? Is it coming from default data layout or?..

llvm/test/Other/constant-fold-gep.ll

184 ↗

(On Diff #296077)

Did the result type change here, or old type of i8* was also i64?

316 ↗

(On Diff #296077)

The old output here looks way more reasonable. Is this really what we want?

[lebedev.ri]

I was just in the process of updating this, hold on..

[lebedev.ri]

Keep only ptrtoint part, and only when we fail to model the operand as a SCEV expression.
Still need to add standalone tests.

[lebedev.ri]

In D88806#2318834, @mkazantsev wrote:

Also a question: how this is going to interact with non-integral pointer types (https://llvm.org/docs/LangRef.html#nointptrtype)? I never touched it, but seems that we will have such thing at some point.

int<->ptr casts are not permitted on non-integral pointers, it's a verifier error, so the best i can tell is: it isn't going to interact.

[lebedev.ri]

Fix polly test, too.

[lebedev.ri]

llvm/test/Analysis/ScalarEvolution/no-wrap-add-exprs.ll

173

We called getTruncateOrZeroExtend(OpSCEV, U->getType()) on %int0 = ptrtoint i8* %ptr to i32, which is:

const SCEV *ScalarEvolution::getTruncateOrZeroExtend(const SCEV *V, Type *Ty,
                                                     unsigned Depth) {
  Type *SrcTy = V->getType();
  assert(SrcTy->isIntOrPtrTy() && Ty->isIntOrPtrTy() &&
         "Cannot truncate or zero extend with non-integer arguments!");
  if (getTypeSizeInBits(SrcTy) == getTypeSizeInBits(Ty))
    return V;  // No conversion
  if (getTypeSizeInBits(SrcTy) > getTypeSizeInBits(Ty))
    return getTruncateExpr(V, Ty, Depth);
  return getZeroExtendExpr(V, Ty, Depth);
}

, where

/// Return the size in bits of the specified type, for which isSCEVable must
/// return true.
uint64_t ScalarEvolution::getTypeSizeInBits(Type *Ty) const {
  assert(isSCEVable(Ty) && "Type is not SCEVable!");
  if (Ty->isPointerTy())
    return getDataLayout().getIndexTypeSizeInBits(Ty);
  return getDataLayout().getTypeSizeInBits(Ty);
}

So yes, default datalayout.
Which may mean, we need to hardcode it here in the test.

[mkazantsev]

Which may mean, we need to hardcode it here in the test.

Might want a test with layout where pointer size equals/less than 32 bits.

[lebedev.ri]

In D88806#2321267, @mkazantsev wrote:

Which may mean, we need to hardcode it here in the test.

Might want a test with layout where pointer size equals/less than 32 bits.

Yep, will do.

[lebedev.ri]

Alright, i think this should be sufficient to show the behavior here.

[lebedev.ri]

Rebased, NFC.

[mkazantsev]

Ok, let's hope it doesn't bring doom upon us. :) LGTM.

[lebedev.ri]

In D88806#2324203, @mkazantsev wrote:

Ok, let's hope it doesn't bring doom upon us. :) LGTM.

@mkazantsev @efriedma @nlopes

Thank you for the review.
I think this patch in it's current form should be reasonably safe, but we'll see.

[hans]

Not sure about doom, but it did trigger an assert in Chromium's builds:

llvm/lib/IR/Constants.cpp:1868: static llvm::Constant* llvm::ConstantExpr::getTrunc(llvm::Constant*, llvm::Type*, bool): Assertion `C->getType()->isIntOrIntVectorTy() && "Trunc operand must be integer"' failed.

See https://bugs.chromium.org/p/chromium/issues/detail?id=1137416#c4 for a reproducer.

I've reverted in 17cec6a11a12f815052d56a17ef738cf246a2d9a

[lebedev.ri]

In D88806#2325340, @hans wrote:

Not sure about doom, but it did trigger an assert in Chromium's builds:

llvm/lib/IR/Constants.cpp:1868: static llvm::Constant* llvm::ConstantExpr::getTrunc(llvm::Constant*, llvm::Type*, bool): Assertion `C->getType()->isIntOrIntVectorTy() && "Trunc operand must be integer"' failed.

See https://bugs.chromium.org/p/chromium/issues/detail?id=1137416#c4 for a reproducer.

I've reverted in 17cec6a11a12f815052d56a17ef738cf246a2d9a

Thank you, i can reproduce.

[uabelho]

Hi,

I got my share of doom too, even after the fix.
So

opt -S -o - bbi-48445.ll -indvars

crashes with

opt: ../lib/IR/Constants.cpp:1896: static llvm::Constant *llvm::ConstantExpr::getZExt(llvm::Constant *, llvm::Type *, bool): Assertion `C->getType()->isIntOrIntVectorTy() && "ZEXt operand must be integral"' failed.

for the following input:

target datalayout = "p:16:16"

@a_i32 = external global [21 x i32], section ".bss,bss", align 1

define void @test_array_ldm_i32() {
entry:
  br label %for.body42

crit_edge:                                        ; preds = %for.body42
  %split = phi i32 [ %add58, %for.body42 ]
  %add132 = add i32 %split, undef
  unreachable

for.body42:                                       ; preds = %for.body42, %entry
  %sub.ptr.sub49 = sub i32 undef, ptrtoint ([21 x i32]* @a_i32 to i32)
  %sub.ptr.div50 = sdiv exact i32 %sub.ptr.sub49, 2
  %conv51 = sext i32 %sub.ptr.div50 to i64
  %cmp53 = icmp eq i64 %conv51, undef
  %cond55 = select i1 %cmp53, i16 0, i16 1
  %conv56 = sext i16 %cond55 to i32
  %add57 = add i32 65536, %conv56
  %add58 = add i32 undef, %add57
  br i1 false, label %for.body42, label %crit_edge
}

[lebedev.ri]

In D88806#2326944, @uabelho wrote:

Hi,

I got my share of doom too, even after the fix.
So

opt -S -o - bbi-48445.ll -indvars

crashes with

opt: ../lib/IR/Constants.cpp:1896: static llvm::Constant *llvm::ConstantExpr::getZExt(llvm::Constant *, llvm::Type *, bool): Assertion `C->getType()->isIntOrIntVectorTy() && "ZEXt operand must be integral"' failed.

for the following input:

target datalayout = "p:16:16"

@a_i32 = external global [21 x i32], section ".bss,bss", align 1

define void @test_array_ldm_i32() {
entry:
  br label %for.body42

crit_edge:                                        ; preds = %for.body42
  %split = phi i32 [ %add58, %for.body42 ]
  %add132 = add i32 %split, undef
  unreachable

for.body42:                                       ; preds = %for.body42, %entry
  %sub.ptr.sub49 = sub i32 undef, ptrtoint ([21 x i32]* @a_i32 to i32)
  %sub.ptr.div50 = sdiv exact i32 %sub.ptr.sub49, 2
  %conv51 = sext i32 %sub.ptr.div50 to i64
  %cmp53 = icmp eq i64 %conv51, undef
  %cond55 = select i1 %cmp53, i16 0, i16 1
  %conv56 = sext i16 %cond55 to i32
  %add57 = add i32 65536, %conv56
  %add58 = add i32 undef, %add57
  br i1 false, label %for.body42, label %crit_edge
}

Perfect, thank you. That's the test case i was missing. Will fix in a moment.

[lebedev.ri]

In D88806#2326961, @lebedev.ri wrote:

In D88806#2326944, @uabelho wrote:

Hi,

I got my share of doom too, even after the fix.
So

opt -S -o - bbi-48445.ll -indvars

crashes with

opt: ../lib/IR/Constants.cpp:1896: static llvm::Constant *llvm::ConstantExpr::getZExt(llvm::Constant *, llvm::Type *, bool): Assertion `C->getType()->isIntOrIntVectorTy() && "ZEXt operand must be integral"' failed.

for the following input:

target datalayout = "p:16:16"

@a_i32 = external global [21 x i32], section ".bss,bss", align 1

define void @test_array_ldm_i32() {
entry:
  br label %for.body42

crit_edge:                                        ; preds = %for.body42
  %split = phi i32 [ %add58, %for.body42 ]
  %add132 = add i32 %split, undef
  unreachable

for.body42:                                       ; preds = %for.body42, %entry
  %sub.ptr.sub49 = sub i32 undef, ptrtoint ([21 x i32]* @a_i32 to i32)
  %sub.ptr.div50 = sdiv exact i32 %sub.ptr.sub49, 2
  %conv51 = sext i32 %sub.ptr.div50 to i64
  %cmp53 = icmp eq i64 %conv51, undef
  %cond55 = select i1 %cmp53, i16 0, i16 1
  %conv56 = sext i16 %cond55 to i32
  %add57 = add i32 65536, %conv56
  %add58 = add i32 undef, %add57
  br i1 false, label %for.body42, label %crit_edge
}

Perfect, thank you. That's the test case i was missing. Will fix in a moment.

Fixed in rG7324616660fc0995fa8c166e3c392361222d5dbc, thank you for the reproducer!

[uabelho]

In D88806#2327012, @lebedev.ri wrote:

Perfect, thank you. That's the test case i was missing. Will fix in a moment.

Fixed in rG7324616660fc0995fa8c166e3c392361222d5dbc, thank you for the reproducer!

Thanks!

[simon_tatham]

Hi @lebedev.ri , it looks as if this commit is causing an assertion failure compiling the following example code.

void bar(void), baz(unsigned);

void foo(char *d, char *s, unsigned n) {
  if ((((unsigned)d | (unsigned)s) & 3) == 0) {
    bar();
  } else {
    unsigned tmp = (unsigned)d - (unsigned)s;
    while (n > tmp) {
      baz(tmp);
      n -= tmp;
    }
  }
}

Compiling this with

clang --target=arm-arm-none-eabi -Os -mthumb -march=armv6s-m -S -o - repro.c

causes an assertion failure:

clang: /data/statham/llvm-project/llvm/lib/Analysis/IVDescriptors.cpp:913: llvm::InductionDescriptor::InductionDescriptor(llvm::Value*, llvm::InductionDescriptor::InductionKind, const llvm::SCEV*, llvm::BinaryOperator*, llvm::SmallVectorImpl<llvm::Instruction*>*): Assertion `(IK == IK_FpInduction || Step->getType()->isIntegerTy()) && "StepValue is not an integer"' failed.

Bisection suggests that this commit introduced it, and reverting this commit causes that code to compile succesfully. Any thoughts?

[lebedev.ri]

In D88806#2329676, @simon_tatham wrote:

Hi @lebedev.ri , it looks as if this commit is causing an assertion failure compiling the following example code.

Hi, thank you for the test case!

void bar(void), baz(unsigned);

void foo(char *d, char *s, unsigned n) {
  if ((((unsigned)d | (unsigned)s) & 3) == 0) {
    bar();
  } else {
    unsigned tmp = (unsigned)d - (unsigned)s;
    while (n > tmp) {
      baz(tmp);
      n -= tmp;
    }
  }
}

Compiling this with

clang --target=arm-arm-none-eabi -Os -mthumb -march=armv6s-m -S -o - repro.c

causes an assertion failure:

clang: /data/statham/llvm-project/llvm/lib/Analysis/IVDescriptors.cpp:913: llvm::InductionDescriptor::InductionDescriptor(llvm::Value*, llvm::InductionDescriptor::InductionKind, const llvm::SCEV*, llvm::BinaryOperator*, llvm::SmallVectorImpl<llvm::Instruction*>*): Assertion `(IK == IK_FpInduction || Step->getType()->isIntegerTy()) && "StepValue is not an integer"' failed.

Bisection suggests that this commit introduced it, and reverting this commit causes that code to compile succesfully. Any thoughts?

That is an yet another place that needs updating (because casts are implicit).
The more minimal test case is

; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
; RUN: opt < %s -canon-freeze -S | FileCheck %s

target datalayout = "e-m:e-p:32:32-Fi8-i64:64-v128:64:128-a:0:32-n32-S64"
target triple = "thumbv6m-arm-none-eabi"

declare void @widget()
declare void @wobble(i32)

define void @barney(i8* %arg, i8* %arg18, i32 %arg19) {
bb:
  %tmp = ptrtoint i8* %arg to i32
  %tmp20 = ptrtoint i8* %arg18 to i32
  %tmp21 = or i32 %tmp20, %tmp
  %tmp22 = and i32 %tmp21, 3
  %tmp23 = icmp eq i32 %tmp22, 0
  br i1 %tmp23, label %bb24, label %bb25

bb24:
  tail call void @widget()
  br label %bb34

bb25:
  %tmp26 = sub i32 %tmp, %tmp20
  %tmp27 = icmp ult i32 %tmp26, %arg19
  br i1 %tmp27, label %bb28, label %bb34

bb28:
  br label %bb29

bb29:
  %tmp30 = phi i32 [ %tmp31, %bb29 ], [ %arg19, %bb28 ]
  tail call void @wobble(i32 %tmp26)
  %tmp31 = sub i32 %tmp30, %tmp26
  %tmp32 = icmp ugt i32 %tmp31, %tmp26
  br i1 %tmp32, label %bb29, label %bb33

bb33:
  br label %bb34

bb34:
  ret void
}

Let me look a bit more..

[lebedev.ri]

Okay. While i could continue pushing through with fixes to this approach,
by now it is quite clear that those aren't fixes, but ad-hoc hacks
that just hide the fact that casts are implicit,
which is normally fine, but not here.

So i'll take a step back here, and re-approach this with @efriedma's
original idea from https://bugs.llvm.org/show_bug.cgi?id=46786#c20.

Thanks.

[simon_tatham]

Thanks for the quick response!

llvm/lib/Analysis/ScalarEvolution.cpp

const SCEV *ScalarEvolution::getUMinExpr(const SCEV *LHS,
   return getUMinExpr(Ops);
 }
 
 const SCEV *ScalarEvolution::getUMinExpr(SmallVectorImpl<const SCEV *> &Ops) {
   return getMinMaxExpr(scUMinExpr, Ops);
 }
 
 const SCEV *ScalarEvolution::getSizeOfExpr(Type *IntTy, Type *AllocTy) {
-  // We can bypass creating a target-independent
-  // constant expression and then folding it back into a ConstantInt.
-  // This is just a compile-time optimization.
   if (isa<ScalableVectorType>(AllocTy)) {
     Constant *NullPtr = Constant::getNullValue(AllocTy->getPointerTo());
     Constant *One = ConstantInt::get(IntTy, 1);
     Constant *GEP = ConstantExpr::getGetElementPtr(AllocTy, NullPtr, One);
-    return getSCEV(ConstantExpr::getPtrToInt(GEP, IntTy));
+    return getUnknown(ConstantExpr::getPtrToInt(GEP, IntTy));
   }
+  // We can bypass creating a target-independent
+  // constant expression and then folding it back into a ConstantInt.
+  // This is just a compile-time optimization.
   return getConstant(IntTy, getDataLayout().getTypeAllocSize(AllocTy));
 }
 
 const SCEV *ScalarEvolution::getOffsetOfExpr(Type *IntTy,
                                              StructType *STy,
                                              unsigned FieldNo) {
   // We can bypass creating a target-independent
   // constant expression and then folding it back into a ConstantInt.
case Instruction::SExt:
     return getSignExtendExpr(getSCEV(U->getOperand(0)), U->getType());
 
   case Instruction::BitCast:
     // BitCasts are no-op casts so we just eliminate the cast.
     if (isSCEVable(U->getType()) && isSCEVable(U->getOperand(0)->getType()))
       return getSCEV(U->getOperand(0));
     break;
 
+  case Instruction::PtrToInt: {
+    // It's tempting to handle inttoptr and ptrtoint as no-ops,
+    // however this can lead to pointer expressions which cannot safely be
+    // expanded to GEPs because ScalarEvolution doesn't respect
+    // the GEP aliasing rules when simplifying integer expressions.
+    //
+    // However, given
+    //   %x = ???
+    //   %y = ptrtoint %x
+    //   %z = ptrtoint %x
+    // it is safe to say that %y and %z are the same thing.
+    //
+    // So instead of modelling the cast itself as unknown,
+    // since the casts are transparent within SCEV,
+    // we can at least model the casts original value as unknow instead.
+
+    // BUT, there's caveat. If we simply model %x as unknown, unrelated uses
+    // of %x will also see it as unknown, which is obviously bad.
+    // So we can only do this iff %x would be modelled as unknown anyways.
+    auto *OpSCEV = getSCEV(U->getOperand(0));
+    if (isa<SCEVUnknown>(OpSCEV))
+      return getTruncateOrZeroExtend(OpSCEV, U->getType());
+    // If we can model the operand, however, we must fallback to modelling
+    // the whole cast as unknown instead.
+    LLVM_FALLTHROUGH;
+  }
+  case Instruction::IntToPtr:
+    // We can't do this for inttoptr at all, however.
+    return getUnknown(V);
+
   case Instruction::SDiv:
     // If both operands are non-negative, this is just an udiv.
     if (isKnownNonNegative(getSCEV(U->getOperand(0))) &&
         isKnownNonNegative(getSCEV(U->getOperand(1))))
       return getUDivExpr(getSCEV(U->getOperand(0)), getSCEV(U->getOperand(1)));
     break;
 
   case Instruction::SRem:
     // If both operands are non-negative, this is just an urem.
     if (isKnownNonNegative(getSCEV(U->getOperand(0))) &&
         isKnownNonNegative(getSCEV(U->getOperand(1))))
       return getURemExpr(getSCEV(U->getOperand(0)), getSCEV(U->getOperand(1)));
     break;
 
-  // It's tempting to handle inttoptr and ptrtoint as no-ops, however this can
-  // lead to pointer expressions which cannot safely be expanded to GEPs,
-  // because ScalarEvolution doesn't respect the GEP aliasing rules when
-  // simplifying integer expressions.
-
   case Instruction::GetElementPtr:
     return createNodeForGEP(cast<GEPOperator>(U));
 
   case Instruction::PHI:
     return createNodeForPHI(cast<PHINode>(U));
 
   case Instruction::Select:
     // U can also be a select constant expr, which let fall through.  Since

llvm/lib/Transforms/Utils/SimplifyIndVar.cpp

case Instruction::Mul:
     break;
   }
 
   const SCEV *(ScalarEvolution::*Extension)(const SCEV *, Type *, unsigned) =
       Signed ? &ScalarEvolution::getSignExtendExpr
              : &ScalarEvolution::getZeroExtendExpr;
 
   // Check ext(LHS op RHS) == ext(LHS) op ext(RHS)
-  auto *NarrowTy = cast<IntegerType>(LHS->getType());
+  auto *NarrowTy = cast<IntegerType>(SE->getEffectiveSCEVType(LHS->getType()));
   auto *WideTy =
     IntegerType::get(NarrowTy->getContext(), NarrowTy->getBitWidth() * 2);
 
   const SCEV *A =
       (SE->*Extension)((SE->*Operation)(LHS, RHS, SCEV::FlagAnyWrap, 0),
                        WideTy, 0);
   const SCEV *B =
       (SE->*Operation)((SE->*Extension)(LHS, WideTy, 0),

llvm/test/Analysis/ScalarEvolution/add-expr-pointer-operand-sorting.ll

 ; CHECK-NEXT:    --> {%base,+,1}<nsw><%for.cond> U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %for.cond: Computable }
 ; CHECK-NEXT:    %idxprom = sext i32 %f.0 to i64
 ; CHECK-NEXT:    --> {(sext i32 %base to i64),+,1}<nsw><%for.cond> U: [-2147483648,-9223372036854775808) S: [-2147483648,-9223372036854775808) Exits: <<Unknown>> LoopDispositions: { %for.cond: Computable }
 ; CHECK-NEXT:    %arrayidx = getelementptr inbounds [1 x [1 x i8]], [1 x [1 x i8]]* %e, i64 0, i64 %idxprom
 ; CHECK-NEXT:    --> {((sext i32 %base to i64) + %e)<nsw>,+,1}<nsw><%for.cond> U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %for.cond: Computable }
 ; CHECK-NEXT:    %1 = load i32*, i32** @c, align 8
 ; CHECK-NEXT:    --> %1 U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %for.cond: Variant }
 ; CHECK-NEXT:    %sub.ptr.lhs.cast = ptrtoint i32* %1 to i64
-; CHECK-NEXT:    --> %sub.ptr.lhs.cast U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %for.cond: Variant }
+; CHECK-NEXT:    --> %1 U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %for.cond: Variant }
 ; CHECK-NEXT:    %sub.ptr.sub = sub i64 %sub.ptr.lhs.cast, ptrtoint ([1 x i32]* @b to i64)
-; CHECK-NEXT:    --> ((-1 * ptrtoint ([1 x i32]* @b to i64)) + %sub.ptr.lhs.cast) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %for.cond: Variant }
+; CHECK-NEXT:    --> ((-1 * @b) + %1) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %for.cond: Variant }
 ; CHECK-NEXT:    %sub.ptr.div = sdiv exact i64 %sub.ptr.sub, 4
 ; CHECK-NEXT:    --> %sub.ptr.div U: full-set S: [-2305843009213693952,2305843009213693952) Exits: <<Unknown>> LoopDispositions: { %for.cond: Variant }
 ; CHECK-NEXT:    %arrayidx1 = getelementptr inbounds [1 x i8], [1 x i8]* %arrayidx, i64 0, i64 %sub.ptr.div
 ; CHECK-NEXT:    --> ({((sext i32 %base to i64) + %e)<nsw>,+,1}<nsw><%for.cond> + %sub.ptr.div)<nsw> U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %for.cond: Variant }
 ; CHECK-NEXT:    %2 = load i8, i8* %arrayidx1, align 1
 ; CHECK-NEXT:    --> %2 U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %for.cond: Variant }
 ; CHECK-NEXT:    %conv = sext i8 %2 to i32
 ; CHECK-NEXT:    --> (sext i8 %2 to i32) U: [-128,128) S: [-128,128) Exits: <<Unknown>> LoopDispositions: { %for.cond: Variant }

llvm/test/Analysis/ScalarEvolution/no-wrap-add-exprs.ll

 ; CHECK:  %s3.zext = zext i8 %s3 to i16
 ; CHECK-NEXT:  -->  (1 + (zext i8 (4 + (32 * %x) + (36 * %y)) to i16))<nuw><nsw> U: [1,254) S: [1,257)
 
   %ptr = bitcast [16 x i8]* @z_addr to i8*
   %int0 = ptrtoint i8* %ptr to i32
   %int5 = add i32 %int0, 5
   %int.zext = zext i32 %int5 to i64
 ; CHECK:  %int.zext = zext i32 %int5 to i64
-; CHECK-NEXT:  -->  (1 + (zext i32 (4 + %int0) to i64))<nuw><nsw> U: [1,4294967294) S: [1,4294967297)
+; CHECK-NEXT:  -->  (1 + (zext i32 (4 + (trunc [16 x i8]* @z_addr to i32)) to i64))<nuw><nsw> U: [1,4294967294) S: [1,4294967297)
 
   %ptr_noalign = bitcast [16 x i8]* @z_addr_noalign to i8*
   %int0_na = ptrtoint i8* %ptr_noalign to i32
   %int5_na = add i32 %int0_na, 5
   %int.zext_na = zext i32 %int5_na to i64
 ; CHECK:  %int.zext_na = zext i32 %int5_na to i64
-; CHECK-NEXT:  -->  (zext i32 (5 + %int0_na) to i64) U: [0,4294967296) S: [0,4294967296)
+; CHECK-NEXT:  -->  (zext i32 (5 + (trunc [16 x i8]* @z_addr_noalign to i32)) to i64) U: [0,4294967296) S: [0,4294967296)
 
   %tmp = load i32, i32* %tmp_addr
   %mul = and i32 %tmp, -4
   %add4 = add i32 %mul, 4
   %add4.zext = zext i32 %add4 to i64
   %sunkaddr3 = mul i64 %add4.zext, 4
   %sunkaddr4 = getelementptr inbounds i8, i8* bitcast ({ %union, [2000 x i8] }* @tmp_addr to i8*), i64 %sunkaddr3
   %sunkaddr5 = getelementptr inbounds i8, i8* %sunkaddr4, i64 4096

llvm/test/Analysis/ScalarEvolution/ptrtoint.ll

 
 declare void @useptr(i8*)
 
 ; Simple ptrtoint of an argument, with casts to potentially different bit widths.
 define void @ptrtoint(i8* %in, i64* %out0, i32* %out1, i16* %out2, i128* %out3) {
 ; X64-LABEL: 'ptrtoint'
 ; X64-NEXT:  Classifying expressions for: @ptrtoint
 ; X64-NEXT:    %p0 = ptrtoint i8* %in to i64
-; X64-NEXT:    --> %p0 U: full-set S: full-set
+; X64-NEXT:    --> %in U: full-set S: full-set
 ; X64-NEXT:    %p1 = ptrtoint i8* %in to i32
-; X64-NEXT:    --> %p1 U: full-set S: full-set
+; X64-NEXT:    --> (trunc i8* %in to i32) U: full-set S: full-set
 ; X64-NEXT:    %p2 = ptrtoint i8* %in to i16
-; X64-NEXT:    --> %p2 U: full-set S: full-set
+; X64-NEXT:    --> (trunc i8* %in to i16) U: full-set S: full-set
 ; X64-NEXT:    %p3 = ptrtoint i8* %in to i128
-; X64-NEXT:    --> %p3 U: [0,18446744073709551616) S: [-18446744073709551616,18446744073709551616)
+; X64-NEXT:    --> (zext i8* %in to i128) U: [0,18446744073709551616) S: [0,18446744073709551616)
 ; X64-NEXT:  Determining loop execution counts for: @ptrtoint
 ;
 ; X32-LABEL: 'ptrtoint'
 ; X32-NEXT:  Classifying expressions for: @ptrtoint
 ; X32-NEXT:    %p0 = ptrtoint i8* %in to i64
-; X32-NEXT:    --> %p0 U: [0,4294967296) S: [-4294967296,4294967296)
+; X32-NEXT:    --> (zext i8* %in to i64) U: [0,4294967296) S: [0,4294967296)
 ; X32-NEXT:    %p1 = ptrtoint i8* %in to i32
-; X32-NEXT:    --> %p1 U: full-set S: full-set
+; X32-NEXT:    --> %in U: full-set S: full-set
 ; X32-NEXT:    %p2 = ptrtoint i8* %in to i16
-; X32-NEXT:    --> %p2 U: full-set S: full-set
+; X32-NEXT:    --> (trunc i8* %in to i16) U: full-set S: full-set
 ; X32-NEXT:    %p3 = ptrtoint i8* %in to i128
-; X32-NEXT:    --> %p3 U: [0,4294967296) S: [-4294967296,4294967296)
+; X32-NEXT:    --> (zext i8* %in to i128) U: [0,4294967296) S: [0,4294967296)
 ; X32-NEXT:  Determining loop execution counts for: @ptrtoint
 ;
   %p0 = ptrtoint i8* %in to i64
   %p1 = ptrtoint i8* %in to i32
   %p2 = ptrtoint i8* %in to i16
   %p3 = ptrtoint i8* %in to i128
   store i64  %p0, i64*  %out0
   store i32  %p1, i32*  %out1
   store i16  %p2, i16*  %out2
   store i128 %p3, i128* %out3
   ret void
 }
 
 ; Same, but from non-zero/non-default address space.
 define void @ptrtoint_as1(i8 addrspace(1)* %in, i64* %out0, i32* %out1, i16* %out2, i128* %out3) {
 ; X64-LABEL: 'ptrtoint_as1'
 ; X64-NEXT:  Classifying expressions for: @ptrtoint_as1
 ; X64-NEXT:    %p0 = ptrtoint i8 addrspace(1)* %in to i64
-; X64-NEXT:    --> %p0 U: full-set S: full-set
+; X64-NEXT:    --> %in U: full-set S: full-set
 ; X64-NEXT:    %p1 = ptrtoint i8 addrspace(1)* %in to i32
-; X64-NEXT:    --> %p1 U: full-set S: full-set
+; X64-NEXT:    --> (trunc i8 addrspace(1)* %in to i32) U: full-set S: full-set
 ; X64-NEXT:    %p2 = ptrtoint i8 addrspace(1)* %in to i16
-; X64-NEXT:    --> %p2 U: full-set S: full-set
+; X64-NEXT:    --> (trunc i8 addrspace(1)* %in to i16) U: full-set S: full-set
 ; X64-NEXT:    %p3 = ptrtoint i8 addrspace(1)* %in to i128
-; X64-NEXT:    --> %p3 U: [0,18446744073709551616) S: [-18446744073709551616,18446744073709551616)
+; X64-NEXT:    --> (zext i8 addrspace(1)* %in to i128) U: [0,18446744073709551616) S: [0,18446744073709551616)
 ; X64-NEXT:  Determining loop execution counts for: @ptrtoint_as1
 ;
 ; X32-LABEL: 'ptrtoint_as1'
 ; X32-NEXT:  Classifying expressions for: @ptrtoint_as1
 ; X32-NEXT:    %p0 = ptrtoint i8 addrspace(1)* %in to i64
-; X32-NEXT:    --> %p0 U: [0,4294967296) S: [-4294967296,4294967296)
+; X32-NEXT:    --> (zext i8 addrspace(1)* %in to i64) U: [0,4294967296) S: [0,4294967296)
 ; X32-NEXT:    %p1 = ptrtoint i8 addrspace(1)* %in to i32
-; X32-NEXT:    --> %p1 U: full-set S: full-set
+; X32-NEXT:    --> %in U: full-set S: full-set
 ; X32-NEXT:    %p2 = ptrtoint i8 addrspace(1)* %in to i16
-; X32-NEXT:    --> %p2 U: full-set S: full-set
+; X32-NEXT:    --> (trunc i8 addrspace(1)* %in to i16) U: full-set S: full-set
 ; X32-NEXT:    %p3 = ptrtoint i8 addrspace(1)* %in to i128
-; X32-NEXT:    --> %p3 U: [0,4294967296) S: [-4294967296,4294967296)
+; X32-NEXT:    --> (zext i8 addrspace(1)* %in to i128) U: [0,4294967296) S: [0,4294967296)
 ; X32-NEXT:  Determining loop execution counts for: @ptrtoint_as1
 ;
   %p0 = ptrtoint i8 addrspace(1)* %in to i64
   %p1 = ptrtoint i8 addrspace(1)* %in to i32
   %p2 = ptrtoint i8 addrspace(1)* %in to i16
   %p3 = ptrtoint i8 addrspace(1)* %in to i128
   store i64  %p0, i64*  %out0
   store i32  %p1, i32*  %out1
   store i16  %p2, i16*  %out2
   store i128 %p3, i128* %out3
   ret void
 }
 
 ; Likewise, ptrtoint of a bitcast is fine, we simply skip it.
 define void @ptrtoint_of_bitcast(i8* %in, i64* %out0) {
 ; X64-LABEL: 'ptrtoint_of_bitcast'
 ; X64-NEXT:  Classifying expressions for: @ptrtoint_of_bitcast
 ; X64-NEXT:    %in_casted = bitcast i8* %in to float*
 ; X64-NEXT:    --> %in U: full-set S: full-set
 ; X64-NEXT:    %p0 = ptrtoint float* %in_casted to i64
-; X64-NEXT:    --> %p0 U: full-set S: full-set
+; X64-NEXT:    --> %in U: full-set S: full-set
 ; X64-NEXT:  Determining loop execution counts for: @ptrtoint_of_bitcast
 ;
 ; X32-LABEL: 'ptrtoint_of_bitcast'
 ; X32-NEXT:  Classifying expressions for: @ptrtoint_of_bitcast
 ; X32-NEXT:    %in_casted = bitcast i8* %in to float*
 ; X32-NEXT:    --> %in U: full-set S: full-set
 ; X32-NEXT:    %p0 = ptrtoint float* %in_casted to i64
-; X32-NEXT:    --> %p0 U: [0,4294967296) S: [-4294967296,4294967296)
+; X32-NEXT:    --> (zext i8* %in to i64) U: [0,4294967296) S: [0,4294967296)
 ; X32-NEXT:  Determining loop execution counts for: @ptrtoint_of_bitcast
 ;
   %in_casted = bitcast i8* %in to float*
   %p0 = ptrtoint float* %in_casted to i64
   store i64 %p0, i64* %out0
   ret void
 }
 
 ; addrspacecast is fine too, but We don't model addrspacecast, so we stop there.
 define void @ptrtoint_of_addrspacecast(i8* %in, i64* %out0) {
 ; X64-LABEL: 'ptrtoint_of_addrspacecast'
 ; X64-NEXT:  Classifying expressions for: @ptrtoint_of_addrspacecast
 ; X64-NEXT:    %in_casted = addrspacecast i8* %in to i8 addrspace(1)*
 ; X64-NEXT:    --> %in_casted U: full-set S: full-set
 ; X64-NEXT:    %p0 = ptrtoint i8 addrspace(1)* %in_casted to i64
-; X64-NEXT:    --> %p0 U: full-set S: full-set
+; X64-NEXT:    --> %in_casted U: full-set S: full-set
 ; X64-NEXT:  Determining loop execution counts for: @ptrtoint_of_addrspacecast
 ;
 ; X32-LABEL: 'ptrtoint_of_addrspacecast'
 ; X32-NEXT:  Classifying expressions for: @ptrtoint_of_addrspacecast
 ; X32-NEXT:    %in_casted = addrspacecast i8* %in to i8 addrspace(1)*
 ; X32-NEXT:    --> %in_casted U: full-set S: full-set
 ; X32-NEXT:    %p0 = ptrtoint i8 addrspace(1)* %in_casted to i64
-; X32-NEXT:    --> %p0 U: [0,4294967296) S: [-4294967296,4294967296)
+; X32-NEXT:    --> (zext i8 addrspace(1)* %in_casted to i64) U: [0,4294967296) S: [0,4294967296)
 ; X32-NEXT:  Determining loop execution counts for: @ptrtoint_of_addrspacecast
 ;
   %in_casted = addrspacecast i8* %in to i8 addrspace(1)*
   %p0 = ptrtoint i8 addrspace(1)* %in_casted to i64
   store i64 %p0, i64* %out0
   ret void
 }
 
 ; inttoptr is fine too, but we don't (and can't) model inttoptr, so we stop there.
 define void @ptrtoint_of_inttoptr(i64 %in, i64* %out0) {
 ; X64-LABEL: 'ptrtoint_of_inttoptr'
 ; X64-NEXT:  Classifying expressions for: @ptrtoint_of_inttoptr
 ; X64-NEXT:    %in_casted = inttoptr i64 %in to i8*
 ; X64-NEXT:    --> %in_casted U: full-set S: full-set
 ; X64-NEXT:    %p0 = ptrtoint i8* %in_casted to i64
-; X64-NEXT:    --> %p0 U: full-set S: full-set
+; X64-NEXT:    --> %in_casted U: full-set S: full-set
 ; X64-NEXT:  Determining loop execution counts for: @ptrtoint_of_inttoptr
 ;
 ; X32-LABEL: 'ptrtoint_of_inttoptr'
 ; X32-NEXT:  Classifying expressions for: @ptrtoint_of_inttoptr
 ; X32-NEXT:    %in_casted = inttoptr i64 %in to i8*
 ; X32-NEXT:    --> %in_casted U: full-set S: full-set
 ; X32-NEXT:    %p0 = ptrtoint i8* %in_casted to i64
-; X32-NEXT:    --> %p0 U: [0,4294967296) S: [-4294967296,4294967296)
+; X32-NEXT:    --> (zext i8* %in_casted to i64) U: [0,4294967296) S: [0,4294967296)
 ; X32-NEXT:  Determining loop execution counts for: @ptrtoint_of_inttoptr
 ;
   %in_casted = inttoptr i64 %in to i8*
   %p0 = ptrtoint i8* %in_casted to i64
   store i64 %p0, i64* %out0
   ret void
 }
 

 ;
   %p0 = ptrtoint i8* null to i64
   store i64 %p0, i64* %out0
   ret void
 }
 
 ; A constant inttoptr argument of an ptrtoint is still bad.
 define void @ptrtoint_of_constantexpr_inttoptr(i64* %out0) {
-; ALL-LABEL: 'ptrtoint_of_constantexpr_inttoptr'
-; ALL-NEXT:  Classifying expressions for: @ptrtoint_of_constantexpr_inttoptr
-; ALL-NEXT:    %p0 = ptrtoint i8* inttoptr (i64 42 to i8*) to i64
-; ALL-NEXT:    --> %p0 U: [42,43) S: [-64,64)
-; ALL-NEXT:  Determining loop execution counts for: @ptrtoint_of_constantexpr_inttoptr
+; X64-LABEL: 'ptrtoint_of_constantexpr_inttoptr'
+; X64-NEXT:  Classifying expressions for: @ptrtoint_of_constantexpr_inttoptr
+; X64-NEXT:    %p0 = ptrtoint i8* inttoptr (i64 42 to i8*) to i64
+; X64-NEXT:    --> inttoptr (i64 42 to i8*) U: [42,43) S: [-64,64)
+; X64-NEXT:  Determining loop execution counts for: @ptrtoint_of_constantexpr_inttoptr
+;
+; X32-LABEL: 'ptrtoint_of_constantexpr_inttoptr'
+; X32-NEXT:  Classifying expressions for: @ptrtoint_of_constantexpr_inttoptr
+; X32-NEXT:    %p0 = ptrtoint i8* inttoptr (i64 42 to i8*) to i64
+; X32-NEXT:    --> (zext i8* inttoptr (i64 42 to i8*) to i64) U: [42,43) S: [0,4294967296)
+; X32-NEXT:  Determining loop execution counts for: @ptrtoint_of_constantexpr_inttoptr
 ;
   %p0 = ptrtoint i8* inttoptr (i64 42 to i8*) to i64
   store i64 %p0, i64* %out0
   ret void
 }
 
 ; However, while bitcast would be fine, GEP we can model, so we are back
 ; to modelling the whole cast as unknown..

llvm/test/CodeGen/ARM/lsr-undef-in-binop.ll

 
 ; <label>:111:                                    ; preds = %109, %94
   %112 = phi i32 [ %98, %94 ], [ %110, %109 ]
   %113 = load i8*, i8** %6, align 4
   %114 = icmp eq i8* %113, %11
   br i1 %114, label %124, label %115
 
 ; CHECK-LABEL: .preheader:
-; CHECK-NEXT: sub i32 [[OLD_CAST]], [[NEW_CAST]]
+; CHECK-NEXT: [[NEG_NEW:%[0-9]+]] = sub i32 0, [[NEW_CAST]]
+; CHECK-NEXT: getelementptr i8, i8* %97, i32 [[NEG_NEW]]
+
 ; <label>:115:                                    ; preds = %111, %115
   %116 = phi i8* [ %118, %115 ], [ %97, %111 ]
   %117 = phi i8* [ %119, %115 ], [ %11, %111 ]
   %118 = getelementptr inbounds i8, i8* %116, i32 -1
   %119 = getelementptr inbounds i8, i8* %117, i32 -1
   %120 = load i8, i8* %119, align 1
   store i8 %120, i8* %118, align 1
   %121 = icmp eq i8* %119, %113

llvm/test/CodeGen/X86/ragreedy-hoist-spill.ll

 ; CHECK-NEXT:    movl $83969, %eax ## imm = 0x14801
 ; CHECK-NEXT:    btl %r12d, %eax
 ; CHECK-NEXT:    jae LBB0_50
 ; CHECK-NEXT:  ## %bb.24:
 ; CHECK-NEXT:    xorl %ebx, %ebx
 ; CHECK-NEXT:  LBB0_48: ## %if.then1477
 ; CHECK-NEXT:    movl $1, %edx
 ; CHECK-NEXT:    callq _write
-; CHECK-NEXT:    subq %rbx, %r14
 ; CHECK-NEXT:    movq _syHistory@{{.*}}(%rip), %rax
-; CHECK-NEXT:    leaq 8189(%r14,%rax), %rax
+; CHECK-NEXT:    subq %rbx, %rax
+; CHECK-NEXT:    leaq 8189(%rax,%r14), %rax
 ; CHECK-NEXT:    .p2align 4, 0x90
 ; CHECK-NEXT:  LBB0_49: ## %for.body1723
 ; CHECK-NEXT:    ## =>This Inner Loop Header: Depth=1
 ; CHECK-NEXT:    decq %rax
 ; CHECK-NEXT:    jmp LBB0_49
 ; CHECK-NEXT:  LBB0_47: ## %if.then1477.loopexit
 ; CHECK-NEXT:    movq %r14, %rbx
 ; CHECK-NEXT:    jmp LBB0_48

llvm/test/Transforms/IndVarSimplify/2011-11-01-lftrptr.ll

 ; PTR64:       exit.loopexit:
 ; PTR64-NEXT:    [[SNEXT_LCSSA:%.*]] = phi i8 [ [[SNEXT]], [[LOOP]] ]
 ; PTR64-NEXT:    br label [[EXIT]]
 ; PTR64:       exit:
 ; PTR64-NEXT:    [[RET:%.*]] = phi i8 [ 0, [[LOOPGUARD]] ], [ [[SNEXT_LCSSA]], [[EXIT_LOOPEXIT]] ]
 ; PTR64-NEXT:    ret i8 [[RET]]
 ;
 ; PTR32-LABEL: @testnullptrint(
+; PTR32-NEXT:    [[BUF1:%.*]] = ptrtoint i8* [[BUF:%.*]] to i32
 ; PTR32-NEXT:    br label [[LOOPGUARD:%.*]]
 ; PTR32:       loopguard:
-; PTR32-NEXT:    [[BI:%.*]] = ptrtoint i8* [[BUF:%.*]] to i32
+; PTR32-NEXT:    [[BI:%.*]] = ptrtoint i8* [[BUF]] to i32
 ; PTR32-NEXT:    [[EI:%.*]] = ptrtoint i8* [[END:%.*]] to i32
 ; PTR32-NEXT:    [[CNT:%.*]] = sub i32 [[EI]], [[BI]]
-; PTR32-NEXT:    [[CNT1:%.*]] = inttoptr i32 [[CNT]] to i8*
 ; PTR32-NEXT:    [[GUARD:%.*]] = icmp ult i32 0, [[CNT]]
 ; PTR32-NEXT:    br i1 [[GUARD]], label [[PREHEADER:%.*]], label [[EXIT:%.*]]
 ; PTR32:       preheader:
+; PTR32-NEXT:    [[TMP1:%.*]] = sub i32 0, [[BUF1]]
+; PTR32-NEXT:    [[SCEVGEP:%.*]] = getelementptr i8, i8* [[END]], i32 [[TMP1]]
 ; PTR32-NEXT:    br label [[LOOP:%.*]]
 ; PTR32:       loop:
 ; PTR32-NEXT:    [[P_01_US_US:%.*]] = phi i8* [ null, [[PREHEADER]] ], [ [[GEP:%.*]], [[LOOP]] ]
 ; PTR32-NEXT:    [[GEP]] = getelementptr inbounds i8, i8* [[P_01_US_US]], i64 1
-; PTR32-NEXT:    [[SNEXT:%.*]] = load i8, i8* [[GEP]]
-; PTR32-NEXT:    [[EXITCOND:%.*]] = icmp ne i8* [[GEP]], [[CNT1]]
+; PTR32-NEXT:    [[SNEXT:%.*]] = load i8, i8* [[GEP]], align 1
+; PTR32-NEXT:    [[EXITCOND:%.*]] = icmp ne i8* [[GEP]], [[SCEVGEP]]
 ; PTR32-NEXT:    br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT_LOOPEXIT:%.*]]
 ; PTR32:       exit.loopexit:
 ; PTR32-NEXT:    [[SNEXT_LCSSA:%.*]] = phi i8 [ [[SNEXT]], [[LOOP]] ]
 ; PTR32-NEXT:    br label [[EXIT]]
 ; PTR32:       exit:
 ; PTR32-NEXT:    [[RET:%.*]] = phi i8 [ 0, [[LOOPGUARD]] ], [ [[SNEXT_LCSSA]], [[EXIT_LOOPEXIT]] ]
 ; PTR32-NEXT:    ret i8 [[RET]]
 ;

 ; PTR32-NEXT:    [[GUARD:%.*]] = icmp ult i32 [[BI]], [[CNT]]
 ; PTR32-NEXT:    br i1 [[GUARD]], label [[PREHEADER:%.*]], label [[EXIT:%.*]]
 ; PTR32:       preheader:
 ; PTR32-NEXT:    br label [[LOOP:%.*]]
 ; PTR32:       loop:
 ; PTR32-NEXT:    [[P_01_US_US:%.*]] = phi i8* [ [[BUF]], [[PREHEADER]] ], [ [[GEP:%.*]], [[LOOP]] ]
 ; PTR32-NEXT:    [[IV:%.*]] = phi i32 [ [[BI]], [[PREHEADER]] ], [ [[IVNEXT:%.*]], [[LOOP]] ]
 ; PTR32-NEXT:    [[GEP]] = getelementptr inbounds i8, i8* [[P_01_US_US]], i64 1
-; PTR32-NEXT:    [[SNEXT:%.*]] = load i8, i8* [[GEP]]
+; PTR32-NEXT:    [[SNEXT:%.*]] = load i8, i8* [[GEP]], align 1
 ; PTR32-NEXT:    [[IVNEXT]] = add nuw i32 [[IV]], 1
-; PTR32-NEXT:    [[EXITCOND:%.*]] = icmp ne i32 [[IVNEXT]], [[CNT]]
-; PTR32-NEXT:    br i1 [[EXITCOND]], label [[LOOP]], label [[EXIT_LOOPEXIT:%.*]]
+; PTR32-NEXT:    [[CMP:%.*]] = icmp ult i32 [[IVNEXT]], [[CNT]]
+; PTR32-NEXT:    br i1 [[CMP]], label [[LOOP]], label [[EXIT_LOOPEXIT:%.*]]
 ; PTR32:       exit.loopexit:
 ; PTR32-NEXT:    [[SNEXT_LCSSA:%.*]] = phi i8 [ [[SNEXT]], [[LOOP]] ]
 ; PTR32-NEXT:    br label [[EXIT]]
 ; PTR32:       exit:
 ; PTR32-NEXT:    [[RET:%.*]] = phi i8 [ 0, [[LOOPGUARD]] ], [ [[SNEXT_LCSSA]], [[EXIT_LOOPEXIT]] ]
 ; PTR32-NEXT:    ret i8 [[RET]]
 ;
   br label %loopguard

polly/test/Isl/CodeGen/scev_looking_through_bitcasts.ll

 
 bitmap_element_allocate.exit:
   %tobool43 = icmp eq %structty* %b, null
   ret void
 }
 
 
 ; CHECK:       polly.stmt.cond.end73.i:
-; CHECK-NEXT:   %0 = bitcast %structty** %b.s2a to i8**
-; CHECK-NEXT:   store i8* undef, i8** %0
+; CHECK-NEXT:   store %structty* undef, %structty** %b.s2a
 ; CHECK-NEXT:   br label %polly.exiting