[SCEV] SCEVPtrToIntExpr simplifications

[lebedev.ri]

Summary

If we've got an SCEVPtrToIntExpr(op), where op is not an SCEVUnknown,
we want to sink the SCEVPtrToIntExpr into an operand, so that the operation
is performed on integers, and eventually we end up with just an SCEVPtrToIntExpr(SCEVUnknown).

[lebedev.ri]

Rebased, addded proper test coverage.

[lebedev.ri]

@efriedma does this look about right?

Speaking for myself, this isn't quite what i want to have in the end,
it should be closer to: (just so i don't loose the code)

const SCEV *ScalarEvolution::getPtrToIntExpr(const SCEV *Op, Type *Ty,
                                             unsigned Depth) {
  assert(Ty->isIntegerTy() && "Target type must be an integer type!");
  assert(Depth <= 1 && "getPtrToIntExpr() should self-recurse at most once.");

  // We could be called with an integer-typed operands during SCEV rewrites.
  // Since the operand is an integer already, just perform zext/trunc/self cast.
  if (!Op->getType()->isPointerTy())
    return getTruncateOrZeroExtend(Op, Ty);

  // What would be an ID for such a SCEV cast expression?
  FoldingSetNodeID ID;
  ID.AddInteger(scPtrToInt);
  ID.AddPointer(Op);

  void *IP = nullptr;

  // Is there already an expression for such a cast?
  if (const SCEV *S = UniqueSCEVs.FindNodeOrInsertPos(ID, IP))
    return getTruncateOrZeroExtend(S, Ty);

  // If not, is this expression something we can't reduce any further?
  if (isa<SCEVUnknown>(Op)) {
    // Create an explicit cast node.
    // We can reuse the existing insert position since if we get here,
    // we won't have made any changes which would invalidate it.
    Type *IntPtrTy = getDataLayout().getIntPtrType(Op->getType());
    assert(getDataLayout().getTypeSizeInBits(getEffectiveSCEVType(
               Op->getType())) == getDataLayout().getTypeSizeInBits(IntPtrTy) &&
           "We can only model ptrtoint if SCEV's effective (integer) type is "
           "sufficiently wide to represent all possible pointer values.");
    SCEV *S = new (SCEVAllocator)
        SCEVPtrToIntExpr(ID.Intern(SCEVAllocator), Op, IntPtrTy);
    UniqueSCEVs.InsertNode(S, IP);
    addToLoopUseLists(S);
    return getTruncateOrZeroExtend(S, Ty);
  }

  assert(Depth == 0 &&
         "getPtrToIntExpr() should not self-recurse for non-SCEVUnknown's.");

  // Otherwise, we've got some expression that is more complex than just a
  // single SCEVUnknown. But we don't want to have a SCEVPtrToIntExpr of an
  // arbitrary expression, we want to have SCEVPtrToIntExpr of an SCEVUnknown
  // only, and the expressions must otherwise be integer-typed.
  // So sink the cast down to the SCEVUnknown's.

  /// The SCEVPtrToIntSinkingRewriter takes a scalar evolution expression,
  /// which computes a pointer-typed value, and rewrites the whole expression
  /// tree so that *all* the computations are done on integers, and the only
  /// pointer-typed operands in the expression are SCEVUnknown.
  class SCEVPtrToIntSinkingRewriter
      : public SCEVRewriteVisitor<SCEVPtrToIntSinkingRewriter> {
    using Base = SCEVRewriteVisitor<SCEVPtrToIntSinkingRewriter>;

  public:
    SCEVPtrToIntSinkingRewriter(ScalarEvolution &SE) : SCEVRewriteVisitor(SE) {}

    static const SCEV *rewrite(const SCEV *Scev, ScalarEvolution &SE) {
      SCEVPtrToIntSinkingRewriter Rewriter(SE);
      return Rewriter.visit(Scev);
    }

    const SCEV *visit(const SCEV *S) {
      Type *STy = S->getType();
      // If the expression is not pointer-typed, just keep it as-is.
      if (!STy->isPointerTy())
        return S;
      // Else, recursively sink the cast down into it.
      return Base::visit(S);
    }

    const SCEV *visitUnknown(const SCEVUnknown *Expr) {
      Type *ExprPtrTy = Expr->getType();
      assert(ExprPtrTy->isPointerTy() &&
             "Should only reach pointer-typed SCEVUnknown's.");
      Type *ExprIntPtrTy = SE.getDataLayout().getIntPtrType(ExprPtrTy);
      return SE.getPtrToIntExpr(Expr, ExprIntPtrTy, /*Depth=*/1);
    }
  };

  // And actually perform the cast sinking.
  const SCEV *IntOp = SCEVPtrToIntSinkingRewriter::rewrite(Op, *this);
  assert(IntOp->getType()->isIntegerTy() &&
         "We must have succeeded in sinking the cast, "
         "and ending up with an integer-typed expression!");
  return getTruncateOrZeroExtend(IntOp, Ty);
}

... but that requires SCEVRewriteVisitor changes so it doesn't loose no-wrap flags on add/mul,
(unlike AddRec, where it already preserves them),
but i would imagine the approach to that refactoring to be non-obvious,
so i would prefer not to block this on that, and do that as a follow-up..

[mkazantsev]

llvm/test/Analysis/ScalarEvolution/ptrtoint.ll

375

Regression in range estimates.

[lebedev.ri]

@mkazantsev thank you for taking a look!

llvm/test/Analysis/ScalarEvolution/ptrtoint.ll

375

Originally we had pointer-typed AddRec there: {%arg,+,4}<nuw><%bb6>, which is:

; X32-NEXT:    %i7 = phi i32* [ %arg, %bb3 ], [ %i15, %bb6 ]
; X32-NEXT:    --> {%arg,+,4}<nuw><%bb6> U: full-set S: full-set Exits: ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) LoopDispositions: { %bb6: Computable }

It's constant range is 32-bit fullset, because we don't have any range knowledge for %arg.

Then we had a cast of it to pointer: (zext i32 (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i32) to i64),
and zero-extended it to 64-bit.
So is obvious that for the old expression, constant range [0,4294967296) is correct.

But now we start with zext i32 (ptrtoint i32* %arg to i32) to i64 (which is [0,4294967296))
and only then we have an AddRec, and in 64 bits now.
For the AddRec, the range is [Base + Step*max backedge-taken count, End + Step*max backedge-taken count).
For 32-bit AddRec, that computed to full-set that we then zero-extended,
but here it obviously computes to [0, 4294967296 + 4*1073741823].

So that's it, i believe. ptrtoint is essentially a red herring here,
we should have this problem every time we sink z/s-ext into an AddRec.

[lebedev.ri]

Rebased, NFC.

[lebedev.ri]

llvm/test/Analysis/ScalarEvolution/ptrtoint.ll

375

Edit: what i forgot to add: SCEVPtrToIntCast is intentionally not bitwidth-changing itself,
and sinking it does not affect the computations. The important bit is that getZeroExtendExpr()
decided that it was okay to sink the zero-extension into SCEVAddRecExpr,
and that is not something i changed in this patch.

It doesn't do that indiscriminately:

// If the input value is a chrec scev, and we can prove that the value
// did not overflow the old, smaller, value, we can zero extend all of the
// operands (often constants).  This allows analysis of something like
// this:  for (unsigned char X = 0; X < 100; ++X) { int Y = X; }
if (const SCEVAddRecExpr *AR = dyn_cast<SCEVAddRecExpr>(Op))

Clearly, there was NUW on that SCEVAddRecExpr, so the heuristic passed.

But obviously i32 SCEVAddRecExpr w/NUW and i64 SCEVAddRecExpr w/NUW result in
different possible ranges, and we lost the knowledge that NUW was for i32 bitwidth.

[mkazantsev]

llvm/test/Analysis/ScalarEvolution/ptrtoint.ll

375

Thanks for clarifying this. Actually that looks familiar. Just curious, could you please check if the problem goes away with https://reviews.llvm.org/D89381 and flag scalar-evolution-use-expensive-range-sharpening turned on?

[mkazantsev]

llvm/lib/Analysis/ScalarEvolution.cpp

1038

If you check it's either Nary or unknown, checking it NOT be something else in addition is an overkill. :)

1048

nit: could go with SmallVector<const SCEV *, 2> NewOps(NaryExpr->getNumOperands())

1054

Please init with nullptr to make it easier to track further possible mistakes.

1075

Is it commented on purpose?

[lebedev.ri]

@mkazantsev thank you for taking a look!
Addressing review comments.

llvm/lib/Analysis/ScalarEvolution.cpp

1048

That doesn't reserve thought, but creates a vector with that many nullptrs.
And afterwards we'd have to do something like

for(int I = 0; I != NaryExpr->getNumOperands(); ++I) {
  const auto& Op = NaryExpr->getOperand(I);
  NewOps[I] = Op->getType()->isPointerTy()
                           ? getPtrToIntExpr(Op, IntPtrTy, Depth + 1)
                           : Op;
}

which seems strictly worse to me. So i'll keep this as-is.

1075

Mainly because i was unsuccessful with acquiring a test case.
But as i have already noted in https://reviews.llvm.org/D89692#2352566,
this hand-written logic will hopefully go away afterwards.

But for now, let's just err on the safe side, and have dead/untested code.

llvm/test/Analysis/ScalarEvolution/ptrtoint.ll

375

I just tried, and that (the patch + flag) does not help here.

[lebedev.ri]

@mkazantsev let me know if there are more things to do here

[mkazantsev]

I don't see any more problems, thanks!

[lebedev.ri]

In D89692#2363759, @mkazantsev wrote:

I don't see any more problems, thanks!

Thank you for the review!
Proceeding to landing both patches.

[dmgreen]

Hello. This increased codesize by a chunk on one of the testcases we track. Part of csibe/zlib. I've put a reproducer in https://godbolt.org/z/o58s7d. I've not really looked any deeper, other than it's quite a bit longer even without outlining, happens on the few architectures I tried and possibly something is going odd in LSR? It was (comparatively) a fairly big chunk of codesize across zlib, not just this file.

[lebedev.ri]

In D89692#2366320, @dmgreen wrote:

Hello. This increased codesize by a chunk on one of the testcases we track. Part of csibe/zlib. I've put a reproducer in https://godbolt.org/z/o58s7d. I've not really looked any deeper, other than it's quite a bit longer even without outlining, happens on the few architectures I tried and possibly something is going odd in LSR? It was (comparatively) a fairly big chunk of codesize across zlib, not just this file.

Hmm. In that snipped, after middle-end, the IR is identical.
But if i llvm-reduce that snippet based on the criteria that the final assembly differs, i get

reduced.ll2 KBDownload

And if we compare llc -debug -print-before-all logs:

llc.log384 KBDownload

,
indeed, it would seem like that allowed LSR to change pointer-typed PHI into an integer-typed one,
which ends up being bad for the final code size.

llvm/lib/Analysis/ScalarEvolution.cpp

const SCEV *ScalarEvolution::getPtrToIntExpr(const SCEV *Op, Type *Ty,
   assert(Op->getType()->isPointerTy() && "Op must have a pointer type!");
   assert(Ty->isIntegerTy() && "Target type must be an integer type!");
 
   FoldingSetNodeID ID;
   ID.AddInteger(scPtrToInt);
   ID.AddPointer(Op);
   void *IP = nullptr;
   if (const SCEV *S = UniqueSCEVs.FindNodeOrInsertPos(ID, IP))
-    return getTruncateOrZeroExtend(S, Ty);
+    return getTruncateOrZeroExtend(S, Ty, Depth);
 
-  assert(!isa<SCEVConstant>(Op) &&
-         "SCEVConstant is an integer, no constant folding to do.");
+  assert(!isa<SCEVConstant>(Op) && !isa<SCEVCastExpr>(Op) &&
+         (isa<SCEVNAryExpr>(Op) || isa<SCEVUnknown>(Op)) &&
+         "We can't get a constant or a cast here as an input, but only an nary "
+         "expression, or an unknown.");
 
-  // FIXME: simplifications.
+  Type *IntPtrTy = getDataLayout().getIntPtrType(Op->getType());
+
+  // If the input operand is not an unknown (and thus is an nary expression),
+  // sink the cast to operands, so that the expression is performed on integers,
+  // and we eventually end up with just an ptrtoint(unknown).
+  if (const SCEVNAryExpr *NaryExpr = dyn_cast<SCEVNAryExpr>(Op)) {
+    SmallVector<const SCEV *, 2> NewOps;
+    NewOps.reserve(NaryExpr->getNumOperands());
+    for (const SCEV *Op : NaryExpr->operands())
+      NewOps.push_back(Op->getType()->isPointerTy()
+                           ? getPtrToIntExpr(Op, IntPtrTy, Depth + 1)
+                           : Op);
+    const SCEV *NewNaryExpr;
+    switch (NaryExpr->getSCEVType()) {
+    case scAddExpr:
+      NewNaryExpr = getAddExpr(NewOps, NaryExpr->getNoWrapFlags(), Depth + 1);
+      break;
+    case scMulExpr:
+      NewNaryExpr = getMulExpr(NewOps, NaryExpr->getNoWrapFlags(), Depth + 1);
+      break;
+    case scUDivExpr:
+      NewNaryExpr = getUDivExpr(NewOps[0], NewOps[1]);
+      break;
+    case scAddRecExpr:
+      NewNaryExpr =
+          getAddRecExpr(NewOps, cast<SCEVAddRecExpr>(NaryExpr)->getLoop(),
+                        NaryExpr->getNoWrapFlags());
+      break;
+    case scUMaxExpr:
+      NewNaryExpr = getUMaxExpr(NewOps);
+      break;
+    case scSMaxExpr:
+      NewNaryExpr = getSMaxExpr(NewOps);
+      break;
+    case scUMinExpr:
+      NewNaryExpr = getUMinExpr(NewOps);
+      break;
+    case scSMinExpr:
+      NewNaryExpr = getSMinExpr(NewOps);
+      break;
+
+    case scConstant:
+    case scTruncate:
+    case scZeroExtend:
+    case scSignExtend:
+    case scPtrToInt:
+    case scUnknown:
+      llvm_unreachable("We can't get these types here.");
+    }
+    return getTruncateOrZeroExtend(NewNaryExpr, Ty, Depth);
+  }
 
   // The cast wasn't folded; create an explicit cast node. We can reuse
   // the existing insert position since if we get here, we won't have
   // made any changes which would invalidate it.
-  Type *IntPtrTy = getDataLayout().getIntPtrType(Op->getType());
   assert(getDataLayout().getTypeSizeInBits(getEffectiveSCEVType(
              Op->getType())) == getDataLayout().getTypeSizeInBits(IntPtrTy) &&
          "We can only model ptrtoint if SCEV's effective (integer) type is "
          "sufficiently wide to represent all possible pointer values.");
   SCEV *S = new (SCEVAllocator)
       SCEVPtrToIntExpr(ID.Intern(SCEVAllocator), Op, IntPtrTy);
   UniqueSCEVs.InsertNode(S, IP);
   addToLoopUseLists(S);
-  return getTruncateOrZeroExtend(S, Ty);
+  return getTruncateOrZeroExtend(S, Ty, Depth);
 }
 
 const SCEV *ScalarEvolution::getTruncateExpr(const SCEV *Op, Type *Ty,
                                              unsigned Depth) {
   assert(getTypeSizeInBits(Op->getType()) > getTypeSizeInBits(Ty) &&
          "This is not a truncating conversion!");
   assert(isSCEVable(Ty) &&
          "This is not a conversion to a SCEVable type!");

llvm/test/Analysis/ScalarEvolution/ptrtoint.ll

 ; However, GEP is something SCEV knows how to model, so in this case ptrtoint
 ; can't be modelled as a cast, only as an unknown.
 define void @ptrtoint_of_gep(i8* %in, i64* %out0) {
 ; X64-LABEL: 'ptrtoint_of_gep'
 ; X64-NEXT:  Classifying expressions for: @ptrtoint_of_gep
 ; X64-NEXT:    %in_adj = getelementptr inbounds i8, i8* %in, i64 42
 ; X64-NEXT:    --> (42 + %in)<nsw> U: [-9223372036854775766,-9223372036854775808) S: [-9223372036854775766,-9223372036854775808)
 ; X64-NEXT:    %p0 = ptrtoint i8* %in_adj to i64
-; X64-NEXT:    --> (ptrtoint i8* (42 + %in)<nsw> to i64) U: [-9223372036854775766,-9223372036854775808) S: [-9223372036854775766,-9223372036854775808)
+; X64-NEXT:    --> (42 + (ptrtoint i8* %in to i64))<nsw> U: [-9223372036854775766,-9223372036854775808) S: [-9223372036854775766,-9223372036854775808)
 ; X64-NEXT:  Determining loop execution counts for: @ptrtoint_of_gep
 ;
 ; X32-LABEL: 'ptrtoint_of_gep'
 ; X32-NEXT:  Classifying expressions for: @ptrtoint_of_gep
 ; X32-NEXT:    %in_adj = getelementptr inbounds i8, i8* %in, i64 42
 ; X32-NEXT:    --> (42 + %in)<nsw> U: [-2147483606,-2147483648) S: [-2147483606,-2147483648)
 ; X32-NEXT:    %p0 = ptrtoint i8* %in_adj to i64
-; X32-NEXT:    --> (zext i32 (ptrtoint i8* (42 + %in)<nsw> to i32) to i64) U: [0,4294967296) S: [0,4294967296)
+; X32-NEXT:    --> (zext i32 (42 + (ptrtoint i8* %in to i32))<nsw> to i64) U: [0,4294967296) S: [0,4294967296)
 ; X32-NEXT:  Determining loop execution counts for: @ptrtoint_of_gep
 ;
   %in_adj = getelementptr inbounds i8, i8* %in, i64 42
   %p0 = ptrtoint i8* %in_adj to i64
   store i64  %p0, i64*  %out0
   ret void
 }
 

 define void @ptrtoint_of_bitcast_of_gep(i8* %in, i64* %out0) {
 ; X64-LABEL: 'ptrtoint_of_bitcast_of_gep'
 ; X64-NEXT:  Classifying expressions for: @ptrtoint_of_bitcast_of_gep
 ; X64-NEXT:    %in_adj = getelementptr inbounds i8, i8* %in, i64 42
 ; X64-NEXT:    --> (42 + %in)<nsw> U: [-9223372036854775766,-9223372036854775808) S: [-9223372036854775766,-9223372036854775808)
 ; X64-NEXT:    %in_adj_casted = bitcast i8* %in_adj to float*
 ; X64-NEXT:    --> (42 + %in)<nsw> U: [-9223372036854775766,-9223372036854775808) S: [-9223372036854775766,-9223372036854775808)
 ; X64-NEXT:    %p0 = ptrtoint float* %in_adj_casted to i64
-; X64-NEXT:    --> (ptrtoint i8* (42 + %in)<nsw> to i64) U: [-9223372036854775766,-9223372036854775808) S: [-9223372036854775766,-9223372036854775808)
+; X64-NEXT:    --> (42 + (ptrtoint i8* %in to i64))<nsw> U: [-9223372036854775766,-9223372036854775808) S: [-9223372036854775766,-9223372036854775808)
 ; X64-NEXT:  Determining loop execution counts for: @ptrtoint_of_bitcast_of_gep
 ;
 ; X32-LABEL: 'ptrtoint_of_bitcast_of_gep'
 ; X32-NEXT:  Classifying expressions for: @ptrtoint_of_bitcast_of_gep
 ; X32-NEXT:    %in_adj = getelementptr inbounds i8, i8* %in, i64 42
 ; X32-NEXT:    --> (42 + %in)<nsw> U: [-2147483606,-2147483648) S: [-2147483606,-2147483648)
 ; X32-NEXT:    %in_adj_casted = bitcast i8* %in_adj to float*
 ; X32-NEXT:    --> (42 + %in)<nsw> U: [-2147483606,-2147483648) S: [-2147483606,-2147483648)
 ; X32-NEXT:    %p0 = ptrtoint float* %in_adj_casted to i64
-; X32-NEXT:    --> (zext i32 (ptrtoint i8* (42 + %in)<nsw> to i32) to i64) U: [0,4294967296) S: [0,4294967296)
+; X32-NEXT:    --> (zext i32 (42 + (ptrtoint i8* %in to i32))<nsw> to i64) U: [0,4294967296) S: [0,4294967296)
 ; X32-NEXT:  Determining loop execution counts for: @ptrtoint_of_bitcast_of_gep
 ;
   %in_adj = getelementptr inbounds i8, i8* %in, i64 42
   %in_adj_casted = bitcast i8* %in_adj to float*
   %p0 = ptrtoint float* %in_adj_casted to i64
   store i64 %p0, i64* %out0
   ret void
 }
 
 ; void pr46786_c26_char(char* start, char *end, char *other) {
 ;   for (char* cur = start; cur != end; ++cur)
 ;     other[cur - start] += *cur;
 ; }
 define void @pr46786_c26_char(i8* %arg, i8* %arg1, i8* %arg2) {
 ; X64-LABEL: 'pr46786_c26_char'
 ; X64-NEXT:  Classifying expressions for: @pr46786_c26_char
 ; X64-NEXT:    %i4 = ptrtoint i8* %arg to i64
 ; X64-NEXT:    --> (ptrtoint i8* %arg to i64) U: full-set S: full-set
 ; X64-NEXT:    %i7 = phi i8* [ %arg, %bb3 ], [ %i14, %bb6 ]
 ; X64-NEXT:    --> {%arg,+,1}<nuw><%bb6> U: full-set S: full-set Exits: (-1 + %arg1) LoopDispositions: { %bb6: Computable }
 ; X64-NEXT:    %i8 = load i8, i8* %i7, align 1
 ; X64-NEXT:    --> %i8 U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %bb6: Variant }
 ; X64-NEXT:    %i9 = ptrtoint i8* %i7 to i64
-; X64-NEXT:    --> (ptrtoint i8* {%arg,+,1}<nuw><%bb6> to i64) U: full-set S: full-set Exits: (ptrtoint i8* (-1 + %arg1) to i64) LoopDispositions: { %bb6: Computable }
+; X64-NEXT:    --> {(ptrtoint i8* %arg to i64),+,1}<nuw><%bb6> U: full-set S: full-set Exits: (-1 + (-1 * %arg) + (ptrtoint i8* %arg to i64) + %arg1) LoopDispositions: { %bb6: Computable }
 ; X64-NEXT:    %i10 = sub i64 %i9, %i4
-; X64-NEXT:    --> ((-1 * (ptrtoint i8* %arg to i64)) + (ptrtoint i8* {%arg,+,1}<nuw><%bb6> to i64)) U: full-set S: full-set Exits: ((-1 * (ptrtoint i8* %arg to i64)) + (ptrtoint i8* (-1 + %arg1) to i64)) LoopDispositions: { %bb6: Computable }
+; X64-NEXT:    --> {0,+,1}<nw><%bb6> U: [0,-1) S: [0,-1) Exits: (-1 + (-1 * %arg) + %arg1) LoopDispositions: { %bb6: Computable }
 ; X64-NEXT:    %i11 = getelementptr inbounds i8, i8* %arg2, i64 %i10
-; X64-NEXT:    --> ((-1 * (ptrtoint i8* %arg to i64)) + (ptrtoint i8* {%arg,+,1}<nuw><%bb6> to i64) + %arg2) U: full-set S: full-set Exits: ((-1 * (ptrtoint i8* %arg to i64)) + (ptrtoint i8* (-1 + %arg1) to i64) + %arg2) LoopDispositions: { %bb6: Computable }
+; X64-NEXT:    --> {%arg2,+,1}<nw><%bb6> U: full-set S: full-set Exits: (-1 + (-1 * %arg) + %arg1 + %arg2) LoopDispositions: { %bb6: Computable }
 ; X64-NEXT:    %i12 = load i8, i8* %i11, align 1
 ; X64-NEXT:    --> %i12 U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %bb6: Variant }
 ; X64-NEXT:    %i13 = add i8 %i12, %i8
 ; X64-NEXT:    --> (%i12 + %i8) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %bb6: Variant }
 ; X64-NEXT:    %i14 = getelementptr inbounds i8, i8* %i7, i64 1
 ; X64-NEXT:    --> {(1 + %arg)<nsw>,+,1}<nuw><%bb6> U: full-set S: full-set Exits: %arg1 LoopDispositions: { %bb6: Computable }
 ; X64-NEXT:  Determining loop execution counts for: @pr46786_c26_char
 ; X64-NEXT:  Loop %bb6: backedge-taken count is (-1 + (-1 * %arg) + %arg1)
 ; X64-NEXT:  Loop %bb6: max backedge-taken count is -2
 ; X64-NEXT:  Loop %bb6: Predicated backedge-taken count is (-1 + (-1 * %arg) + %arg1)
 ; X64-NEXT:   Predicates:
 ; X64:       Loop %bb6: Trip multiple is 1
 ;
 ; X32-LABEL: 'pr46786_c26_char'
 ; X32-NEXT:  Classifying expressions for: @pr46786_c26_char
 ; X32-NEXT:    %i4 = ptrtoint i8* %arg to i64
 ; X32-NEXT:    --> (zext i32 (ptrtoint i8* %arg to i32) to i64) U: [0,4294967296) S: [0,4294967296)
 ; X32-NEXT:    %i7 = phi i8* [ %arg, %bb3 ], [ %i14, %bb6 ]
 ; X32-NEXT:    --> {%arg,+,1}<nuw><%bb6> U: full-set S: full-set Exits: (-1 + %arg1) LoopDispositions: { %bb6: Computable }
 ; X32-NEXT:    %i8 = load i8, i8* %i7, align 1
 ; X32-NEXT:    --> %i8 U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %bb6: Variant }
 ; X32-NEXT:    %i9 = ptrtoint i8* %i7 to i64
-; X32-NEXT:    --> (zext i32 (ptrtoint i8* {%arg,+,1}<nuw><%bb6> to i32) to i64) U: [0,4294967296) S: [0,4294967296) Exits: (zext i32 (ptrtoint i8* (-1 + %arg1) to i32) to i64) LoopDispositions: { %bb6: Computable }
+; X32-NEXT:    --> {(zext i32 (ptrtoint i8* %arg to i32) to i64),+,1}<nuw><%bb6> U: [0,8589934590) S: [0,8589934590) Exits: ((zext i8* (-1 + (-1 * %arg) + %arg1) to i64) + (zext i32 (ptrtoint i8* %arg to i32) to i64)) LoopDispositions: { %bb6: Computable }
 ; X32-NEXT:    %i10 = sub i64 %i9, %i4
-; X32-NEXT:    --> ((zext i32 (ptrtoint i8* {%arg,+,1}<nuw><%bb6> to i32) to i64) + (-1 * (zext i32 (ptrtoint i8* %arg to i32) to i64))<nsw>) U: [-4294967295,4294967296) S: [-4294967295,4294967296) Exits: ((zext i32 (ptrtoint i8* (-1 + %arg1) to i32) to i64) + (-1 * (zext i32 (ptrtoint i8* %arg to i32) to i64))<nsw>) LoopDispositions: { %bb6: Computable }
+; X32-NEXT:    --> {0,+,1}<nw><%bb6> U: [0,4294967295) S: [0,4294967295) Exits: (zext i8* (-1 + (-1 * %arg) + %arg1) to i64) LoopDispositions: { %bb6: Computable }
 ; X32-NEXT:    %i11 = getelementptr inbounds i8, i8* %arg2, i64 %i10
-; X32-NEXT:    --> ((-1 * (ptrtoint i8* %arg to i32)) + (ptrtoint i8* {%arg,+,1}<nuw><%bb6> to i32) + %arg2) U: full-set S: full-set Exits: ((-1 * (ptrtoint i8* %arg to i32)) + (ptrtoint i8* (-1 + %arg1) to i32) + %arg2) LoopDispositions: { %bb6: Computable }
+; X32-NEXT:    --> {%arg2,+,1}<%bb6> U: full-set S: full-set Exits: (-1 + (-1 * %arg) + %arg1 + %arg2) LoopDispositions: { %bb6: Computable }
 ; X32-NEXT:    %i12 = load i8, i8* %i11, align 1
 ; X32-NEXT:    --> %i12 U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %bb6: Variant }
 ; X32-NEXT:    %i13 = add i8 %i12, %i8
 ; X32-NEXT:    --> (%i12 + %i8) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %bb6: Variant }
 ; X32-NEXT:    %i14 = getelementptr inbounds i8, i8* %i7, i64 1
 ; X32-NEXT:    --> {(1 + %arg)<nsw>,+,1}<nuw><%bb6> U: full-set S: full-set Exits: %arg1 LoopDispositions: { %bb6: Computable }
 ; X32-NEXT:  Determining loop execution counts for: @pr46786_c26_char
 ; X32-NEXT:  Loop %bb6: backedge-taken count is (-1 + (-1 * %arg) + %arg1)

 ; X64-NEXT:  Classifying expressions for: @pr46786_c26_int
 ; X64-NEXT:    %i4 = ptrtoint i32* %arg to i64
 ; X64-NEXT:    --> (ptrtoint i32* %arg to i64) U: full-set S: full-set
 ; X64-NEXT:    %i7 = phi i32* [ %arg, %bb3 ], [ %i15, %bb6 ]
 ; X64-NEXT:    --> {%arg,+,4}<nuw><%bb6> U: full-set S: full-set Exits: ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) LoopDispositions: { %bb6: Computable }
 ; X64-NEXT:    %i8 = load i32, i32* %i7, align 4
 ; X64-NEXT:    --> %i8 U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %bb6: Variant }
 ; X64-NEXT:    %i9 = ptrtoint i32* %i7 to i64
-; X64-NEXT:    --> (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i64) U: full-set S: full-set Exits: (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i64) LoopDispositions: { %bb6: Computable }
+; X64-NEXT:    --> {(ptrtoint i32* %arg to i64),+,4}<nuw><%bb6> U: full-set S: full-set Exits: ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + (ptrtoint i32* %arg to i64)) LoopDispositions: { %bb6: Computable }
 ; X64-NEXT:    %i10 = sub i64 %i9, %i4
-; X64-NEXT:    --> ((-1 * (ptrtoint i32* %arg to i64)) + (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i64)) U: full-set S: full-set Exits: ((-1 * (ptrtoint i32* %arg to i64)) + (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i64)) LoopDispositions: { %bb6: Computable }
+; X64-NEXT:    --> {0,+,4}<nw><%bb6> U: [0,-3) S: [-9223372036854775808,9223372036854775805) Exits: (4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> LoopDispositions: { %bb6: Computable }
 ; X64-NEXT:    %i11 = ashr exact i64 %i10, 2
-; X64-NEXT:    --> (((((-1 * (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i64)) + (ptrtoint i32* %arg to i64)) smax ((-1 * (ptrtoint i32* %arg to i64)) + (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i64))) /u 4) * (1 smin (-1 smax ((-1 * (ptrtoint i32* %arg to i64)) + (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i64)))))<nsw> U: [-4611686018427387903,4611686018427387904) S: [-4611686018427387903,4611686018427387904) Exits: (((((-1 * (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i64)) + (ptrtoint i32* %arg to i64)) smax ((-1 * (ptrtoint i32* %arg to i64)) + (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i64))) /u 4) * (1 smin (-1 smax ((-1 * (ptrtoint i32* %arg to i64)) + (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i64)))))<nsw> LoopDispositions: { %bb6: Computable }
+; X64-NEXT:    --> ((({0,+,4}<nw><%bb6> smax {0,+,-4}<nw><%bb6>) /u 4) * (1 smin (-1 smax {0,+,4}<nw><%bb6>)))<nsw> U: [-4611686018427387903,4611686018427387904) S: [-4611686018427387903,4611686018427387904) Exits: ((((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> smax (-4 * ((-4 + (-1 * %arg) + %arg1) /u 4))) /u 4) * (1 smin (-1 smax (4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw>)))<nsw> LoopDispositions: { %bb6: Computable }
 ; X64-NEXT:    %i12 = getelementptr inbounds i32, i32* %arg2, i64 %i11
-; X64-NEXT:    --> ((4 * ((((-1 * (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i64)) + (ptrtoint i32* %arg to i64)) smax ((-1 * (ptrtoint i32* %arg to i64)) + (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i64))) /u 4) * (1 smin (-1 smax ((-1 * (ptrtoint i32* %arg to i64)) + (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i64))))) + %arg2)<nsw> U: full-set S: full-set Exits: ((4 * ((((-1 * (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i64)) + (ptrtoint i32* %arg to i64)) smax ((-1 * (ptrtoint i32* %arg to i64)) + (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i64))) /u 4) * (1 smin (-1 smax ((-1 * (ptrtoint i32* %arg to i64)) + (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i64))))) + %arg2)<nsw> LoopDispositions: { %bb6: Computable }
+; X64-NEXT:    --> ((4 * (({0,+,4}<nw><%bb6> smax {0,+,-4}<nw><%bb6>) /u 4) * (1 smin (-1 smax {0,+,4}<nw><%bb6>))) + %arg2)<nsw> U: full-set S: full-set Exits: ((4 * (((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> smax (-4 * ((-4 + (-1 * %arg) + %arg1) /u 4))) /u 4) * (1 smin (-1 smax (4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw>))) + %arg2)<nsw> LoopDispositions: { %bb6: Computable }
 ; X64-NEXT:    %i13 = load i32, i32* %i12, align 4
 ; X64-NEXT:    --> %i13 U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %bb6: Variant }
 ; X64-NEXT:    %i14 = add nsw i32 %i13, %i8
 ; X64-NEXT:    --> (%i13 + %i8) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %bb6: Variant }
 ; X64-NEXT:    %i15 = getelementptr inbounds i32, i32* %i7, i64 1
 ; X64-NEXT:    --> {(4 + %arg)<nsw>,+,4}<nuw><%bb6> U: full-set S: full-set Exits: (4 + (4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) LoopDispositions: { %bb6: Computable }
 ; X64-NEXT:  Determining loop execution counts for: @pr46786_c26_int
 ; X64-NEXT:  Loop %bb6: backedge-taken count is ((-4 + (-1 * %arg) + %arg1) /u 4)
 ; X64-NEXT:  Loop %bb6: max backedge-taken count is 4611686018427387903
 ; X64-NEXT:  Loop %bb6: Predicated backedge-taken count is ((-4 + (-1 * %arg) + %arg1) /u 4)
 ; X64-NEXT:   Predicates:
 ; X64:       Loop %bb6: Trip multiple is 1
 ;
 ; X32-LABEL: 'pr46786_c26_int'
 ; X32-NEXT:  Classifying expressions for: @pr46786_c26_int
 ; X32-NEXT:    %i4 = ptrtoint i32* %arg to i64
 ; X32-NEXT:    --> (zext i32 (ptrtoint i32* %arg to i32) to i64) U: [0,4294967296) S: [0,4294967296)
 ; X32-NEXT:    %i7 = phi i32* [ %arg, %bb3 ], [ %i15, %bb6 ]
 ; X32-NEXT:    --> {%arg,+,4}<nuw><%bb6> U: full-set S: full-set Exits: ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) LoopDispositions: { %bb6: Computable }
 ; X32-NEXT:    %i8 = load i32, i32* %i7, align 4
 ; X32-NEXT:    --> %i8 U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %bb6: Variant }
 ; X32-NEXT:    %i9 = ptrtoint i32* %i7 to i64
-; X32-NEXT:    --> (zext i32 (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i32) to i64) U: [0,4294967296) S: [0,4294967296) Exits: (zext i32 (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i32) to i64) LoopDispositions: { %bb6: Computable }
+; X32-NEXT:    --> {(zext i32 (ptrtoint i32* %arg to i32) to i64),+,4}<nuw><%bb6> U: [0,8589934588) S: [0,8589934588) Exits: ((zext i32 (ptrtoint i32* %arg to i32) to i64) + (4 * ((zext i32* (-4 + (-1 * %arg) + %arg1) to i64) /u 4))<nuw><nsw>) LoopDispositions: { %bb6: Computable }
 ; X32-NEXT:    %i10 = sub i64 %i9, %i4
-; X32-NEXT:    --> ((zext i32 (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* %arg to i32) to i64))<nsw>) U: [-4294967295,4294967296) S: [-4294967295,4294967296) Exits: ((zext i32 (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* %arg to i32) to i64))<nsw>) LoopDispositions: { %bb6: Computable }
+; X32-NEXT:    --> {0,+,4}<nw><%bb6> U: [0,4294967293) S: [0,4294967293) Exits: (4 * ((zext i32* (-4 + (-1 * %arg) + %arg1) to i64) /u 4))<nuw><nsw> LoopDispositions: { %bb6: Computable }
 ; X32-NEXT:    %i11 = ashr exact i64 %i10, 2
-; X32-NEXT:    --> (((((zext i32 (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* %arg to i32) to i64))<nsw>) smax ((zext i32 (ptrtoint i32* %arg to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i32) to i64))<nsw>)) /u 4) * (1 smin (-1 smax ((zext i32 (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* %arg to i32) to i64))<nsw>))))<nsw> U: [-4611686018427387903,4611686018427387904) S: [-4611686018427387903,4611686018427387904) Exits: (((((zext i32 (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* %arg to i32) to i64))<nsw>) smax ((zext i32 (ptrtoint i32* %arg to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i32) to i64))<nsw>)) /u 4) * (1 smin (-1 smax ((zext i32 (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* %arg to i32) to i64))<nsw>))))<nsw> LoopDispositions: { %bb6: Computable }
+; X32-NEXT:    --> ({0,+,1}<nw><%bb6> * (1 smin {0,+,4}<nuw><nsw><%bb6>))<nuw><nsw> U: [0,1073741824) S: [0,1073741824) Exits: (((zext i32* (-4 + (-1 * %arg) + %arg1) to i64) /u 4) * (1 smin (4 * ((zext i32* (-4 + (-1 * %arg) + %arg1) to i64) /u 4))<nuw><nsw>))<nuw><nsw> LoopDispositions: { %bb6: Computable }
 ; X32-NEXT:    %i12 = getelementptr inbounds i32, i32* %arg2, i64 %i11
-; X32-NEXT:    --> ((4 * (trunc i64 (((((zext i32 (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* %arg to i32) to i64))<nsw>) smax ((zext i32 (ptrtoint i32* %arg to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i32) to i64))<nsw>)) /u 4) * (1 smin (-1 smax ((zext i32 (ptrtoint i32* {%arg,+,4}<nuw><%bb6> to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* %arg to i32) to i64))<nsw>))))<nsw> to i32))<nsw> + %arg2)<nsw> U: full-set S: full-set Exits: ((4 * (trunc i64 (((((zext i32 (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* %arg to i32) to i64))<nsw>) smax ((zext i32 (ptrtoint i32* %arg to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i32) to i64))<nsw>)) /u 4) * (1 smin (-1 smax ((zext i32 (ptrtoint i32* ((4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) to i32) to i64) + (-1 * (zext i32 (ptrtoint i32* %arg to i32) to i64))<nsw>))))<nsw> to i32))<nsw> + %arg2)<nsw> LoopDispositions: { %bb6: Computable }
+; X32-NEXT:    --> (((trunc i64 (1 smin {0,+,4}<nuw><nsw><%bb6>) to i32) * {0,+,4}<%bb6>) + %arg2)<nsw> U: full-set S: full-set Exits: ((4 * (trunc i64 (1 smin (4 * ((zext i32* (-4 + (-1 * %arg) + %arg1) to i64) /u 4))<nuw><nsw>) to i32) * ((-4 + (-1 * %arg) + %arg1) /u 4)) + %arg2)<nsw> LoopDispositions: { %bb6: Computable }
 ; X32-NEXT:    %i13 = load i32, i32* %i12, align 4
 ; X32-NEXT:    --> %i13 U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %bb6: Variant }
 ; X32-NEXT:    %i14 = add nsw i32 %i13, %i8
 ; X32-NEXT:    --> (%i13 + %i8) U: full-set S: full-set Exits: <<Unknown>> LoopDispositions: { %bb6: Variant }
 ; X32-NEXT:    %i15 = getelementptr inbounds i32, i32* %i7, i64 1
 ; X32-NEXT:    --> {(4 + %arg)<nsw>,+,4}<nuw><%bb6> U: full-set S: full-set Exits: (4 + (4 * ((-4 + (-1 * %arg) + %arg1) /u 4))<nuw> + %arg) LoopDispositions: { %bb6: Computable }
 ; X32-NEXT:  Determining loop execution counts for: @pr46786_c26_int
 ; X32-NEXT:  Loop %bb6: backedge-taken count is ((-4 + (-1 * %arg) + %arg1) /u 4)

llvm/test/Transforms/LoopStrengthReduce/X86/expander-crashes.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
 ; RUN: opt -loop-reduce %s -S | FileCheck %s
 
 target datalayout = "e-m:o-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
 target triple = "x86_64-apple-macosx10.15.0"
 
 ; Tests for crashes during SCEV expansion.
 
 %struct.hoge = type { i32, i32, i32, i32 }
 
 define i64 @blam(%struct.hoge* %start, %struct.hoge* %end, %struct.hoge* %ptr.2) {
 ; CHECK-LABEL: @blam(
 ; CHECK-NEXT:  entry:
-; CHECK-NEXT:    [[END16:%.*]] = bitcast %struct.hoge* [[END:%.*]] to i8*
-; CHECK-NEXT:    [[START17:%.*]] = ptrtoint %struct.hoge* [[START:%.*]] to i64
-; CHECK-NEXT:    [[SCEVGEP12:%.*]] = getelementptr [[STRUCT_HOGE:%.*]], %struct.hoge* [[START]], i64 0, i32 3
-; CHECK-NEXT:    [[SCEVGEP1213:%.*]] = bitcast i32* [[SCEVGEP12]] to %struct.hoge*
-; CHECK-NEXT:    [[TMP0:%.*]] = sub i64 0, [[START17]]
-; CHECK-NEXT:    [[UGLYGEP18:%.*]] = getelementptr i8, i8* [[END16]], i64 [[TMP0]]
-; CHECK-NEXT:    [[UGLYGEP1819:%.*]] = bitcast i8* [[UGLYGEP18]] to %struct.hoge*
+; CHECK-NEXT:    [[START9:%.*]] = ptrtoint %struct.hoge* [[START:%.*]] to i64
+; CHECK-NEXT:    [[START6:%.*]] = bitcast %struct.hoge* [[START]] to i8*
+; CHECK-NEXT:    [[END8:%.*]] = bitcast %struct.hoge* [[END:%.*]] to i8*
+; CHECK-NEXT:    [[TMP0:%.*]] = ptrtoint %struct.hoge* [[START]] to i64
+; CHECK-NEXT:    [[TMP1:%.*]] = sub i64 0, [[START9]]
+; CHECK-NEXT:    [[UGLYGEP10:%.*]] = getelementptr i8, i8* [[END8]], i64 [[TMP1]]
 ; CHECK-NEXT:    br label [[LOOP_1_HEADER:%.*]]
 ; CHECK:       loop.1.header:
-; CHECK-NEXT:    [[LSR_IV20:%.*]] = phi %struct.hoge* [ [[SCEVGEP21:%.*]], [[LOOP_1_HEADER]] ], [ [[UGLYGEP1819]], [[ENTRY:%.*]] ]
-; CHECK-NEXT:    [[LSR_IV14:%.*]] = phi %struct.hoge* [ [[SCEVGEP15:%.*]], [[LOOP_1_HEADER]] ], [ [[SCEVGEP1213]], [[ENTRY]] ]
-; CHECK-NEXT:    [[SCEVGEP15]] = getelementptr [[STRUCT_HOGE]], %struct.hoge* [[LSR_IV14]], i64 1
-; CHECK-NEXT:    [[SCEVGEP21]] = getelementptr [[STRUCT_HOGE]], %struct.hoge* [[LSR_IV20]], i64 -1
-; CHECK-NEXT:    [[EC:%.*]] = icmp eq %struct.hoge* [[SCEVGEP21]], null
+; CHECK-NEXT:    [[LSR_IV4:%.*]] = phi i64 [ [[LSR_IV_NEXT5:%.*]], [[LOOP_1_HEADER]] ], [ 0, [[ENTRY:%.*]] ]
+; CHECK-NEXT:    [[LSR_IV_NEXT5]] = add i64 [[LSR_IV4]], -16
+; CHECK-NEXT:    [[SCEVGEP11:%.*]] = getelementptr i8, i8* [[UGLYGEP10]], i64 [[LSR_IV_NEXT5]]
+; CHECK-NEXT:    [[SCEVGEP1112:%.*]] = bitcast i8* [[SCEVGEP11]] to %struct.hoge*
+; CHECK-NEXT:    [[EC:%.*]] = icmp eq %struct.hoge* [[SCEVGEP1112]], null
 ; CHECK-NEXT:    br i1 [[EC]], label [[LOOP_2_PH:%.*]], label [[LOOP_1_HEADER]]
 ; CHECK:       loop.2.ph:
+; CHECK-NEXT:    [[TMP2:%.*]] = sub i64 [[TMP0]], [[LSR_IV_NEXT5]]
+; CHECK-NEXT:    [[TMP3:%.*]] = mul i64 [[LSR_IV_NEXT5]], -1
+; CHECK-NEXT:    [[UGLYGEP:%.*]] = getelementptr i8, i8* [[START6]], i64 [[TMP3]]
+; CHECK-NEXT:    [[UGLYGEP7:%.*]] = bitcast i8* [[UGLYGEP]] to %struct.hoge*
 ; CHECK-NEXT:    br label [[LOOP_2_HEADER:%.*]]
 ; CHECK:       loop.2.header:
-; CHECK-NEXT:    [[LSR_IV3:%.*]] = phi %struct.hoge* [ [[SCEVGEP4:%.*]], [[LOOP_2_LATCH:%.*]] ], [ [[SCEVGEP15]], [[LOOP_2_PH]] ]
-; CHECK-NEXT:    [[LSR_IV310:%.*]] = bitcast %struct.hoge* [[LSR_IV3]] to i32*
-; CHECK-NEXT:    [[LSR_IV37:%.*]] = bitcast %struct.hoge* [[LSR_IV3]] to i8*
-; CHECK-NEXT:    [[UGLYGEP8:%.*]] = getelementptr i8, i8* [[LSR_IV37]], i64 -12
-; CHECK-NEXT:    [[UGLYGEP89:%.*]] = bitcast i8* [[UGLYGEP8]] to %struct.hoge*
-; CHECK-NEXT:    [[LSR_IV35:%.*]] = bitcast %struct.hoge* [[LSR_IV3]] to i8*
-; CHECK-NEXT:    [[TMP8:%.*]] = ptrtoint i32* [[LSR_IV310]] to i64
-; CHECK-NEXT:    call void @use.i64(i64 [[TMP8]])
-; CHECK-NEXT:    [[SCEVGEP11:%.*]] = getelementptr i32, i32* [[LSR_IV310]], i64 -1
-; CHECK-NEXT:    store i32 10, i32* [[SCEVGEP11]], align 8
-; CHECK-NEXT:    [[EC_2:%.*]] = icmp ugt %struct.hoge* [[UGLYGEP89]], [[PTR_2:%.*]]
+; CHECK-NEXT:    [[LSR_IV1:%.*]] = phi i64 [ [[LSR_IV_NEXT2:%.*]], [[LOOP_2_LATCH:%.*]] ], [ [[TMP2]], [[LOOP_2_PH]] ]
+; CHECK-NEXT:    [[IV2:%.*]] = phi %struct.hoge* [ [[IV2_NEXT:%.*]], [[LOOP_2_LATCH]] ], [ [[UGLYGEP7]], [[LOOP_2_PH]] ]
+; CHECK-NEXT:    [[IV23:%.*]] = bitcast %struct.hoge* [[IV2]] to i32*
+; CHECK-NEXT:    [[TMP4:%.*]] = add i64 [[LSR_IV1]], 12
+; CHECK-NEXT:    call void @use.i64(i64 [[TMP4]])
+; CHECK-NEXT:    [[SCEVGEP:%.*]] = getelementptr i32, i32* [[IV23]], i64 2
+; CHECK-NEXT:    store i32 10, i32* [[SCEVGEP]], align 8
+; CHECK-NEXT:    [[EC_2:%.*]] = icmp ugt %struct.hoge* [[IV2]], [[PTR_2:%.*]]
 ; CHECK-NEXT:    br i1 [[EC_2]], label [[LOOP_2_EXIT:%.*]], label [[LOOP_2_LATCH]]
 ; CHECK:       loop.2.latch:
-; CHECK-NEXT:    [[SCEVGEP4]] = getelementptr [[STRUCT_HOGE]], %struct.hoge* [[LSR_IV3]], i64 1
+; CHECK-NEXT:    [[IV2_NEXT]] = getelementptr inbounds [[STRUCT_HOGE:%.*]], %struct.hoge* [[IV2]], i64 1
+; CHECK-NEXT:    [[LSR_IV_NEXT2]] = add i64 [[LSR_IV1]], 16
 ; CHECK-NEXT:    br label [[LOOP_2_HEADER]]
 ; CHECK:       loop.2.exit:
-; CHECK-NEXT:    [[UGLYGEP:%.*]] = getelementptr i8, i8* [[LSR_IV35]], i64 -12
-; CHECK-NEXT:    [[UGLYGEP6:%.*]] = bitcast i8* [[UGLYGEP]] to %struct.hoge*
-; CHECK-NEXT:    [[IV2_CAST:%.*]] = ptrtoint %struct.hoge* [[UGLYGEP6]] to i64
-; CHECK-NEXT:    ret i64 [[IV2_CAST]]
+; CHECK-NEXT:    ret i64 [[LSR_IV1]]
 ;
 entry:
   br label %loop.1.header
 
 loop.1.header:
   %iv = phi %struct.hoge* [ %iv.next, %loop.1.header ], [ %start, %entry ]
   %iv.next = getelementptr inbounds %struct.hoge, %struct.hoge* %iv, i64 1
   %ec = icmp eq %struct.hoge* %iv.next, %end

polly/test/ScopInfo/int2ptr_ptr2int.ll

 ; CHECK:        ReadAccess := [Reduction Type: NONE] [Scalar: 0]
 ; CHECK-NEXT:       [val, ptr] -> { Stmt_for_body[i0] -> MemRef_A[9 + val] };
 ; CHECK-NEXT:   ReadAccess := [Reduction Type: +] [Scalar: 0]
 ; CHECK-NEXT:       [val, ptr] -> { Stmt_for_body[i0] -> MemRef_A[9 + ptr] };
 ; CHECK-NEXT:   MustWriteAccess :=  [Reduction Type: +] [Scalar: 0]
 ; CHECK-NEXT:       [val, ptr] -> { Stmt_for_body[i0] -> MemRef_A[9 + ptr] };
 ;
 ; IR:      polly.stmt.for.body:
-; IR-NEXT:   %p_tmp1 = inttoptr i64 %0 to i64*
+; IR-NEXT:   %p_tmp1 = inttoptr i64 %14 to i64*
 ; IR-NEXT:   %p_add.ptr2 = getelementptr inbounds i64, i64* %p_tmp1, i64 1
 ; IR-NEXT:   %p_tmp2 = ptrtoint i64* %p_add.ptr2 to i64
 ; IR-NEXT:   %p_arrayidx = getelementptr inbounds i64, i64* %A, i64 %p_tmp2
 ; IR-NEXT:   %tmp3_p_scalar_ = load i64, i64* %p_arrayidx, align 8, !alias.scope !0, !noalias !2
-; IR-NEXT:   %tmp4_p_scalar_ = load i64, i64* %scevgep1, align 8, !alias.scope !0, !noalias !2
+; IR-NEXT:   %tmp4_p_scalar_ = load i64, i64* %scevgep, align 8, !alias.scope !0, !noalias !2
 ; IR-NEXT:   %p_add4 = add nsw i64 %tmp4_p_scalar_, %tmp3_p_scalar_
-; IR-NEXT:   store i64 %p_add4, i64* %scevgep1, align 8, !alias.scope !0, !noalias !2
+; IR-NEXT:   store i64 %p_add4, i64* %scevgep, align 8, !alias.scope !0, !noalias !2
 ; IR-NEXT:   %polly.indvar_next = add nsw i64 %polly.indvar, 1
 ; IR-NEXT:   %polly.loop_cond = icmp sle i64 %polly.indvar_next, 99
 ; IR-NEXT:   br i1 %polly.loop_cond, label %polly.loop_header, label %polly.loop_exit
 ;
 ; IR:      polly.loop_preheader:
-; IR-NEXT:   %0 = add i64 %val, 1
-; IR-NEXT:   %scevgep = getelementptr i64, i64* %ptr, i32 1
-; IR-NEXT:   %1 = ptrtoint i64* %scevgep to i32
-; IR-NEXT:   %2 = add i32 %1, 1
-; IR-NEXT:   %scevgep1 = getelementptr i64, i64* %A, i32 %2
+; IR-NEXT:   %14 = add i64 %val, 1
+; IR-NEXT:   %15 = ptrtoint i64* %ptr to i32
+; IR-NEXT:   %16 = add i32 %15, 9
+; IR-NEXT:   %scevgep = getelementptr i64, i64* %A, i32 %16
 ; IR-NEXT:   br label %polly.loop_header
+
 ;
 target datalayout = "e-p:32:32:32-m:e-i64:64-f80:128-n8:16:32:64-S128"
 
 define void @f(i64* %A, i64* %ptr, i64 %val) {
 entry:
   br label %for.cond
 
 for.cond:                                         ; preds = %for.inc, %entry

polly/test/ScopInfo/int2ptr_ptr2int_2.ll

 ; RUN: opt %loadPolly -analyze -polly-scops \
 ; RUN: -polly-invariant-load-hoisting=true < %s | FileCheck %s
 ; RUN: opt %loadPolly -S -polly-codegen \
 ; RUN: -polly-invariant-load-hoisting=true < %s | FileCheck %s --check-prefix=IR
 ;
 ;    void f(long *A, long *B, long *ptr, long val) {
 ;      for (long i = 0; i < 100; i++) {
 ;        long ptrV = ((long)(ptr + 1)) + 1;
 ;        long valP = (long)(((long *)(val + 1)) + 1);
 ;        A[ptrV] += B[valP];
 ;      }
 ;    }
 ;
 ; CHECK:        ReadAccess := [Reduction Type: NONE] [Scalar: 0]
 ; CHECK-NEXT:       [val, ptr] -> { Stmt_for_body[i0] -> MemRef_B[9 + val] };
-; CHECK-NEXT:   Execution Context: [val, ptr] -> {  : val <= 32766 }
+; CHECK-NEXT:   Execution Context: [val, ptr] -> {  : -4097 <= val <= 4086 }
 ;
 ; CHECK:   ReadAccess :=  [Reduction Type: +] [Scalar: 0]
 ; CHECK-NEXT:       [val, ptr] -> { Stmt_for_body[i0] -> MemRef_A[9 + ptr] };
 ; CHECK-NEXT:   MustWriteAccess :=  [Reduction Type: +] [Scalar: 0]
 ; CHECK-NEXT:       [val, ptr] -> { Stmt_for_body[i0] -> MemRef_A[9 + ptr] };
 ;
 ; IR:      polly.stmt.for.body:
-; IR-NEXT:   %tmp4_p_scalar_ = load i64, i64* %scevgep13, align 8, !alias.scope !3, !noalias !4
+; IR-NEXT:   %tmp4_p_scalar_ = load i64, i64* %scevgep, align 8, !alias.scope !3, !noalias !4
 ; IR-NEXT:   %p_add4 = add nsw i64 %tmp4_p_scalar_, %polly.preload.tmp3.merge
-; IR-NEXT:   store i64 %p_add4, i64* %scevgep13, align 8, !alias.scope !3, !noalias !4
+; IR-NEXT:   store i64 %p_add4, i64* %scevgep, align 8, !alias.scope !3, !noalias !4
 ; IR-NEXT:   %polly.indvar_next = add nsw i64 %polly.indvar, 1
 ; IR-NEXT:   %polly.loop_cond = icmp sle i64 %polly.indvar_next, 99
 ; IR-NEXT:   br i1 %polly.loop_cond, label %polly.loop_header, label %polly.loop_exit
-;
+
 ; IR:      polly.loop_preheader:
-; IR-NEXT:   %35 = add i16 %val, 1
-; IR-NEXT:   %scevgep = getelementptr i64, i64* %ptr, i16 1
-; IR-NEXT:   %36 = ptrtoint i64* %scevgep to i16
-; IR-NEXT:   %37 = add i16 %36, 1
-; IR-NEXT:   %scevgep13 = getelementptr i64, i64* %A, i16 %37
+; IR-NEXT:   %41 = add i16 %val, 1
+; IR-NEXT:   %42 = ptrtoint i64* %ptr to i16
+; IR-NEXT:   %43 = add i16 %42, 9
+; IR-NEXT:   %scevgep = getelementptr i64, i64* %A, i16 %43
 ; IR-NEXT:   br label %polly.loop_header
 ;
 target datalayout = "e-p:16:16:16-m:e-i64:64-f80:128-n8:16:16:64-S128"
 
 define void @f(i64* %A, i64* %B, i64* %ptr, i16 %val) {
 entry:
   br label %for.cond