Bug type: miscompilation
Component: ScalarEvolution
SimplifyIndVar
Bug location: llvm/lib/Transforms/Utils/ScalarEvolutionExpander.cpp: SCEVExpander::hoistIVInc
llvm/lib/Transforms/Utils/SimplifyIndVar.cpp: WidenIV::createWideIV
WidenIV::widenIVUse
Issue title: Wrong code at -Os on x86-64_gnu-linux (recent regression)
Labels: miscompilation
llvm:SCEV
Reported by: shao-hua-li

Clang at -Os produced the wrong code.

Bisected to dce77a357948709e335910ddc07f9c3f2eb2ac4b, which was committed by @fhahn 

Compiler explorer: https://godbolt.org/z/fTrenPK4h

```console
% cat reduced.c
int printf(const char *, ...);
int a, b, c, d, e;
int f[9];
int g(int i) {
  c = 1 << i;
  if (b & c)
    return 4;
  return 0;
}
int j(int i) {
  int h = g(i);
  return h;
}
int k() {
  d = 6;
  for (; d; d--) {
    e = 0;
    for (; e <= 6; e++) {
      f[j(d - 1)] = f[d];
      for (; e + d;)
        return 0;
    }
  }
  return 0;
}
int main() {
  k();
  printf("%d\n", a);
}
%
% clang -O3 reduced.c && ./a.out
0
% clang -Os reduced.c && ./a.out

%
```

Comments: author: fhahn
body: The issue is that IndVars doesn't drop poison-generating flags when hoisting the IV to introduce a new use of the widened IV. working on a fix
author: fhahn
body: Should be fixed, thanks again as always @shao-hua-li 
author: shao-hua-li
body: You're welcome @fhahn 

Fix patch:
commit 4db93e5d56440be44d8ad2036e2579208c82ad37
Author: Florian Hahn <flo@fhahn.com>
Date:   Tue Feb 20 14:03:25 2024 +0000

    [IndVars] Recompute flags if needed in widenIVUse of IV increment. (#82352)
    
    widenIVUse may hoist a wide induction increment and introduce new uses,
    but does not recompute the wrap flags. In some cases this can make the
    new uses of the wide IV inc more poisonous.
    
    Update the code to recompute flags if needed when hoisting an IV. If
    both the narrow and wide IV increment's flags match and we can re-use
    the flags from the increments, there's no need to recompute the flags,
    as the replacement won't make the new uses of the wide IV's increment
    more poisonous.
    
    Note that this also updates a stale comment which claimed that the widen
    increment is only used if it dominates the new use.
    
    The helper should also be used to guard the code added in da437330be,
    which I am planning on doing separately once the helper lands.
    
    Fixes https://github.com/llvm/llvm-project/issues/82243.

diff --git a/llvm/include/llvm/Transforms/Utils/ScalarEvolutionExpander.h b/llvm/include/llvm/Transforms/Utils/ScalarEvolutionExpander.h
index 035705b7f4b7..fa10443f14bb 100644
--- a/llvm/include/llvm/Transforms/Utils/ScalarEvolutionExpander.h
+++ b/llvm/include/llvm/Transforms/Utils/ScalarEvolutionExpander.h
@@ -258,6 +258,14 @@ public:
   bool hoistIVInc(Instruction *IncV, Instruction *InsertPos,
                   bool RecomputePoisonFlags = false);
 
+  /// Return true if both increments directly increment the corresponding IV PHI
+  /// nodes and have the same opcode. It is not safe to re-use the flags from
+  /// the original increment, if it is more complex and SCEV expansion may have
+  /// yielded a more simplified wider increment.
+  static bool canReuseFlagsFromOriginalIVInc(PHINode *OrigPhi, PHINode *WidePhi,
+                                             Instruction *OrigInc,
+                                             Instruction *WideInc);
+
   /// replace congruent phis with their most canonical representative. Return
   /// the number of phis eliminated.
   unsigned replaceCongruentIVs(Loop *L, const DominatorTree *DT,
diff --git a/llvm/lib/Transforms/Utils/ScalarEvolutionExpander.cpp b/llvm/lib/Transforms/Utils/ScalarEvolutionExpander.cpp
index 3a28909473d9..fbe1dba5b8d4 100644
--- a/llvm/lib/Transforms/Utils/ScalarEvolutionExpander.cpp
+++ b/llvm/lib/Transforms/Utils/ScalarEvolutionExpander.cpp
@@ -771,6 +771,15 @@ bool SCEVExpander::hoistIVInc(Instruction *IncV, Instruction *InsertPos,
   return true;
 }
 
+bool SCEVExpander::canReuseFlagsFromOriginalIVInc(PHINode *OrigPhi,
+                                                  PHINode *WidePhi,
+                                                  Instruction *OrigInc,
+                                                  Instruction *WideInc) {
+  return match(OrigInc, m_c_BinOp(m_Specific(OrigPhi), m_Value())) &&
+         match(WideInc, m_c_BinOp(m_Specific(WidePhi), m_Value())) &&
+         OrigInc->getOpcode() == WideInc->getOpcode();
+}
+
 /// Determine if this cyclic phi is in a form that would have been generated by
 /// LSR. We don't care if the phi was actually expanded in this pass, as long
 /// as it is in a low-cost form, for example, no implied multiplication. This
diff --git a/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp b/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp
index 5aa6df49e7f6..66bba1ca2f1d 100644
--- a/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp
+++ b/llvm/lib/Transforms/Utils/SimplifyIndVar.cpp
@@ -1131,7 +1131,8 @@ protected:
   const SCEV *getSCEVByOpCode(const SCEV *LHS, const SCEV *RHS,
                               unsigned OpCode) const;
 
-  Instruction *widenIVUse(NarrowIVDefUse DU, SCEVExpander &Rewriter);
+  Instruction *widenIVUse(NarrowIVDefUse DU, SCEVExpander &Rewriter,
+                          PHINode *OrigPhi, PHINode *WidePhi);
 
   bool widenLoopCompare(NarrowIVDefUse DU);
   bool widenWithVariantUse(NarrowIVDefUse DU);
@@ -1731,7 +1732,9 @@ bool WidenIV::widenWithVariantUse(WidenIV::NarrowIVDefUse DU) {
 
 /// Determine whether an individual user of the narrow IV can be widened. If so,
 /// return the wide clone of the user.
-Instruction *WidenIV::widenIVUse(WidenIV::NarrowIVDefUse DU, SCEVExpander &Rewriter) {
+Instruction *WidenIV::widenIVUse(WidenIV::NarrowIVDefUse DU,
+                                 SCEVExpander &Rewriter, PHINode *OrigPhi,
+                                 PHINode *WidePhi) {
   assert(ExtendKindMap.count(DU.NarrowDef) &&
          "Should already know the kind of extension used to widen NarrowDef");
 
@@ -1825,11 +1828,18 @@ Instruction *WidenIV::widenIVUse(WidenIV::NarrowIVDefUse DU, SCEVExpander &Rewri
     if (!WideAddRec.first)
       return nullptr;
 
-    // Reuse the IV increment that SCEVExpander created as long as it dominates
-    // NarrowUse.
+    // Reuse the IV increment that SCEVExpander created. Recompute flags, unless
+    // the flags for both increments agree and it is safe to use the ones from
+    // the original inc. In that case, the new use of the wide increment won't
+    // be more poisonous.
+    bool NeedToRecomputeFlags =
+        !SCEVExpander::canReuseFlagsFromOriginalIVInc(OrigPhi, WidePhi,
+                                                      DU.NarrowUse, WideInc) ||
+        DU.NarrowUse->hasNoUnsignedWrap() != WideInc->hasNoUnsignedWrap() ||
+        DU.NarrowUse->hasNoSignedWrap() != WideInc->hasNoSignedWrap();
     Instruction *WideUse = nullptr;
     if (WideAddRec.first == WideIncExpr &&
-        Rewriter.hoistIVInc(WideInc, DU.NarrowUse))
+        Rewriter.hoistIVInc(WideInc, DU.NarrowUse, NeedToRecomputeFlags))
       WideUse = WideInc;
     else {
       WideUse = cloneIVUser(DU, WideAddRec.first);
@@ -1996,11 +2006,9 @@ PHINode *WidenIV::createWideIV(SCEVExpander &Rewriter) {
       // the same opcode. It is not safe to re-use the flags from the original
       // increment, if it is more complex and SCEV expansion may have yielded a
       // more simplified wider increment.
-      bool MatchingOps =
-          match(OrigInc, m_c_BinOp(m_Specific(OrigPhi), m_Value())) &&
-          match(WideInc, m_c_BinOp(m_Specific(WidePhi), m_Value())) &&
-          OrigInc->getOpcode() == WideInc->getOpcode();
-      if (MatchingOps && isa<OverflowingBinaryOperator>(OrigInc) &&
+      if (SCEVExpander::canReuseFlagsFromOriginalIVInc(OrigPhi, WidePhi,
+                                                       OrigInc, WideInc) &&
+          isa<OverflowingBinaryOperator>(OrigInc) &&
           isa<OverflowingBinaryOperator>(WideInc)) {
         WideInc->setHasNoUnsignedWrap(WideInc->hasNoUnsignedWrap() ||
                                       OrigInc->hasNoUnsignedWrap());
@@ -2024,7 +2032,7 @@ PHINode *WidenIV::createWideIV(SCEVExpander &Rewriter) {
 
     // Process a def-use edge. This may replace the use, so don't hold a
     // use_iterator across it.
-    Instruction *WideUse = widenIVUse(DU, Rewriter);
+    Instruction *WideUse = widenIVUse(DU, Rewriter, OrigPhi, WidePhi);
 
     // Follow all def-use edges from the previous narrow use.
     if (WideUse)


Regression tests:
file: llvm/test/Transforms/IndVarSimplify/hoist-wide-inc-for-narrow-use-recompute-flags.ll
commands: opt -p indvars -S %s
tests: test_name: test_pr82243
test_body: target datalayout = "e-m:o-i64:64-i128:128-n32:64-S128"

define void @test_pr82243(ptr %f) {
entry:
  br label %outer.header

outer.header:                                     ; preds = %outer.latch, %entry
  %iv = phi i32 [ 1, %entry ], [ %iv.next, %outer.latch ]
  %iv.sext = sext i32 %iv to i64
  %gep.iv.ext = getelementptr i32, ptr %f, i64 %iv.sext
  store i32 1, ptr %gep.iv.ext, align 4
  %sub = add i32 %iv, -1
  %shl = shl i32 123, %sub
  %gep.shl = getelementptr i32, ptr %f, i32 %shl
  br label %inner.header

inner.header:                                     ; preds = %inner.latch, %outer.header
  store i32 0, ptr %gep.shl, align 4
  br i1 false, label %inner.latch, label %exit

inner.latch:                                      ; preds = %inner.header
  br i1 false, label %inner.header, label %outer.latch

outer.latch:                                      ; preds = %inner.latch
  %iv.next = add i32 %iv, -1
  br label %outer.header

exit:                                             ; preds = %inner.header
  ret void
}