[SLP] Fix crash in reduction for integer min/max

[yrouban]

Summary

The SCEV change https://reviews.llvm.org/rGb46c085d2b6d15873fb53718f0a70b3848e19e4a seems to reveal a new crash in SLPVectorizer.
SLP crashes expecting a SelectInst as an externally used value but umin call is found.

The patch relaxes the assumption to make the IR flag propagation safe.

[lebedev.ri]

Looks good to me in general.

[fhahn]

llvm/test/Transforms/SLPVectorizer/slp-umax-rdx-crash.ll

3 ↗

(On Diff #333255)

There's no need to require asserts I think, given that you just check the IR. You also don't need 2 > &1 I think

[yrouban]

llvm/test/Transforms/SLPVectorizer/slp-umax-rdx-crash.ll

12–25 ↗

(On Diff #333255)

the check are wrong - fixed

[yrouban]

fixed the test

[spatel]

Code change LGTM.

Please just add this test to the file that we created for the similar problem in D98432. Note that we don't need asserts or redirect of stderr in that test file either.

llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp

static Value *createOp(IRBuilder<> &Builder, RecurKind RdxKind, Value *LHS,
     return Op;
   }
   /// Creates reduction operation with the current opcode with the IR flags
   /// from \p I.
   static Value *createOp(IRBuilder<> &Builder, RecurKind RdxKind, Value *LHS,
                          Value *RHS, const Twine &Name, Instruction *I) {
     Value *Op = createOp(Builder, RdxKind, LHS, RHS, Name);
     if (RecurrenceDescriptor::isIntMinMaxRecurrenceKind(RdxKind)) {
-      if (auto *Sel = dyn_cast<SelectInst>(Op)) {
-        propagateIRFlags(Sel->getCondition(),
-                         cast<SelectInst>(I)->getCondition());
-      }
+      if (auto *Sel = dyn_cast<SelectInst>(Op))
+        if (auto *SelI = dyn_cast<SelectInst>(I))
+          propagateIRFlags(Sel->getCondition(), SelI->getCondition());
     }
     propagateIRFlags(Op, I);
     return Op;
   }
 
   static RecurKind getRdxKind(Instruction *I) {
     assert(I && "Expected instruction for reduction matching");
     TargetTransformInfo::ReductionFlags RdxFlags;

llvm/test/Transforms/SLPVectorizer/slp-umax-rdx-matcher-crash.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
-; RUN: opt -slp-vectorizer -S < %s 2>&1 | FileCheck %s
-; REQUIRES: asserts
+; RUN: opt -slp-vectorizer -S < %s | FileCheck %s
 
 ; Given LLVM IR caused associative reduction matching routine crash in SLP.
 ; The routines begins with select as integer Umax reduction kind
 ; and then follows to llvm.umax intrinsic call which also matched
 ; to UMax and thus same reduction kind is returned.
 ; The routine's later code merely assumes the instruction to be a select.
 
 define dso_local void @test() {

 
 next:
   %t7.0 = phi i8 [ undef, %entry ], [ %i0, %then ]
   ret void
 }
 
 declare i8 @llvm.umax.i8(i8, i8)
 
+declare i32 @llvm.smin.i32(i32, i32)
+declare i32 @llvm.umin.i32(i32, i32)
+
+; Given LLVM IR caused crash in SLP.
+define void @test2() {
+; CHECK-LABEL: @test2(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[TMP0:%.*]] = call <4 x i32> @llvm.smin.v4i32(<4 x i32> undef, <4 x i32> <i32 3, i32 2, i32 1, i32 0>)
+; CHECK-NEXT:    [[TMP1:%.*]] = sub nsw <4 x i32> undef, [[TMP0]]
+; CHECK-NEXT:    [[TMP2:%.*]] = call i32 @llvm.vector.reduce.umin.v4i32(<4 x i32> [[TMP1]])
+; CHECK-NEXT:    [[OP_EXTRA:%.*]] = icmp ult i32 [[TMP2]], 77
+; CHECK-NEXT:    [[OP_EXTRA1:%.*]] = select i1 [[OP_EXTRA]], i32 [[TMP2]], i32 77
+; CHECK-NEXT:    [[E:%.*]] = icmp ugt i32 [[OP_EXTRA1]], 1
+; CHECK-NEXT:    ret void
+;
+entry:
+  %smin0 = call i32 @llvm.smin.i32(i32 undef, i32 0)
+  %smin1 = call i32 @llvm.smin.i32(i32 undef, i32 1)
+  %smin2 = call i32 @llvm.smin.i32(i32 undef, i32 2)
+  %smin3 = call i32 @llvm.smin.i32(i32 undef, i32 3)
+  %a = sub nsw i32 undef, %smin0
+  %b = sub nsw i32 undef, %smin1
+  %c = sub nsw i32 undef, %smin2
+  %d = sub nsw i32 undef, %smin3
+  %umin0 = call i32 @llvm.umin.i32(i32 %d, i32 %c)
+  %umin1 = call i32 @llvm.umin.i32(i32 %umin0, i32 %b)
+  %umin2 = call i32 @llvm.umin.i32(i32 %umin1, i32 %a)
+  %umin3 = call i32 @llvm.umin.i32(i32 %umin2, i32 77)
+  %e = icmp ugt i32 %umin3, 1
+  ret void
+}