[SLP] Fix crash in reduction for integer min/max

[yrouban]

Summary

The SCEV change https://reviews.llvm.org/rGb46c085d2b6d15873fb53718f0a70b3848e19e4a seems to reveal a new crash in SLPVectorizer.
SLP crashes expecting a SelectInst as an externally used value but umin call is found.

The patch relaxes the assumption to make the IR flag propagation safe.

[lebedev.ri]

Looks good to me in general.

[fhahn]

llvm/test/Transforms/SLPVectorizer/slp-umax-rdx-crash.ll

3

There's no need to require asserts I think, given that you just check the IR. You also don't need 2 > &1 I think

[yrouban]

llvm/test/Transforms/SLPVectorizer/slp-umax-rdx-crash.ll

12–25

the check are wrong - fixed

[yrouban]

fixed the test

[spatel]

Code change LGTM.

Please just add this test to the file that we created for the similar problem in D98432. Note that we don't need asserts or redirect of stderr in that test file either.

llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp

static Value *createOp(IRBuilder<> &Builder, RecurKind RdxKind, Value *LHS,
     return Op;
   }
   /// Creates reduction operation with the current opcode with the IR flags
   /// from \p I.
   static Value *createOp(IRBuilder<> &Builder, RecurKind RdxKind, Value *LHS,
                          Value *RHS, const Twine &Name, Instruction *I) {
     Value *Op = createOp(Builder, RdxKind, LHS, RHS, Name);
     if (RecurrenceDescriptor::isIntMinMaxRecurrenceKind(RdxKind)) {
-      if (auto *Sel = dyn_cast<SelectInst>(Op)) {
-        propagateIRFlags(Sel->getCondition(),
-                         cast<SelectInst>(I)->getCondition());
-      }
+      if (auto *Sel = dyn_cast<SelectInst>(Op))
+        if (auto *SelI = dyn_cast<SelectInst>(I))
+          propagateIRFlags(Sel->getCondition(), SelI->getCondition());
     }
     propagateIRFlags(Op, I);
     return Op;
   }
 
   static RecurKind getRdxKind(Instruction *I) {
     assert(I && "Expected instruction for reduction matching");
     TargetTransformInfo::ReductionFlags RdxFlags;

llvm/test/Transforms/SLPVectorizer/slp-umax-rdx-crash.ll

+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
+; RUN: opt -slp-vectorizer -S < %s 2>&1| FileCheck %s
+; REQUIRES: asserts
+
+declare i32 @llvm.smin.i32(i32, i32)
+declare i32 @llvm.umin.i32(i32, i32)
+
+; Given LLVM IR caused crash in SLP.
+define void @test() {
+; CHECK-LABEL: @test(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    [[SMIN0:%.*]] = call i32 @llvm.smin.i32(i32 undef, i32 0)
+; CHECK-NEXT:    [[SMIN1:%.*]] = call i32 @llvm.smin.i32(i32 undef, i32 1)
+; CHECK-NEXT:    [[SMIN2:%.*]] = call i32 @llvm.smin.i32(i32 undef, i32 2)
+; CHECK-NEXT:    [[SMIN3:%.*]] = call i32 @llvm.smin.i32(i32 undef, i32 3)
+; CHECK-NEXT:    [[A:%.*]] = sub nsw i32 undef, [[SMIN0]]
+; CHECK-NEXT:    [[B:%.*]] = sub nsw i32 undef, [[SMIN1]]
+; CHECK-NEXT:    [[C:%.*]] = sub nsw i32 undef, [[SMIN2]]
+; CHECK-NEXT:    [[D:%.*]] = sub nsw i32 undef, [[SMIN3]]
+; CHECK-NEXT:    [[UMIN0:%.*]] = call i32 @llvm.umin.i32(i32 [[D]], i32 [[C]])
+; CHECK-NEXT:    [[UMIN1:%.*]] = call i32 @llvm.umin.i32(i32 [[UMIN0]], i32 [[B]])
+; CHECK-NEXT:    [[UMIN2:%.*]] = call i32 @llvm.umin.i32(i32 [[UMIN1]], i32 [[A]])
+; CHECK-NEXT:    [[UMIN3:%.*]] = call i32 @llvm.umin.i32(i32 [[UMIN2]], i32 77)
+; CHECK-NEXT:    [[E:%.*]] = icmp ugt i32 [[UMIN3]], 1
+; CHECK-NEXT:    ret void
+;
+entry:
+  %smin0 = call i32 @llvm.smin.i32(i32 undef, i32 0)
+  %smin1 = call i32 @llvm.smin.i32(i32 undef, i32 1)
+  %smin2 = call i32 @llvm.smin.i32(i32 undef, i32 2)
+  %smin3 = call i32 @llvm.smin.i32(i32 undef, i32 3)
+  %a = sub nsw i32 undef, %smin0
+  %b = sub nsw i32 undef, %smin1
+  %c = sub nsw i32 undef, %smin2
+  %d = sub nsw i32 undef, %smin3
+  %umin0 = call i32 @llvm.umin.i32(i32 %d, i32 %c)
+  %umin1 = call i32 @llvm.umin.i32(i32 %umin0, i32 %b)
+  %umin2 = call i32 @llvm.umin.i32(i32 %umin1, i32 %a)
+  %umin3 = call i32 @llvm.umin.i32(i32 %umin2, i32 77)
+  %e = icmp ugt i32 %umin3, 1
+  ret void
+}
+