From: Philip Reames <listmail@philipreames.com>
Date: Tue, 23 Nov 2021 17:57:30 +0000 (-0800)
Subject: [indvars] Fix lftr crash when preheader is terminated by switch
X-Git-Tag: upstream/15.0.7~24977
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=03d8bc184a3129f0e519bf08ef45f0349cfa1f90;p=platform%2Fupstream%2Fllvm.git

[indvars] Fix lftr crash when preheader is terminated by switch

This was found by oss-fuzz.  The switch will get canonicalized to a branch, but if it hasn't been when we run LFTR, we crashed on an unneeded assert.
---

diff --git a/llvm/lib/Transforms/Scalar/IndVarSimplify.cpp b/llvm/lib/Transforms/Scalar/IndVarSimplify.cpp
index ae2fe276..7001d33 100644
--- a/llvm/lib/Transforms/Scalar/IndVarSimplify.cpp
+++ b/llvm/lib/Transforms/Scalar/IndVarSimplify.cpp
@@ -1951,7 +1951,6 @@ bool IndVarSimplify::run(Loop *L) {
   // using it.
   if (!DisableLFTR) {
     BasicBlock *PreHeader = L->getLoopPreheader();
-    BranchInst *PreHeaderBR = cast<BranchInst>(PreHeader->getTerminator());
 
     SmallVector<BasicBlock*, 16> ExitingBlocks;
     L->getExitingBlocks(ExitingBlocks);
@@ -1987,7 +1986,7 @@ bool IndVarSimplify::run(Loop *L) {
       // Avoid high cost expansions.  Note: This heuristic is questionable in
       // that our definition of "high cost" is not exactly principled.
       if (Rewriter.isHighCostExpansion(ExitCount, L, SCEVCheapExpansionBudget,
-                                       TTI, PreHeaderBR))
+                                       TTI, PreHeader->getTerminator()))
         continue;
 
       // Check preconditions for proper SCEVExpander operation. SCEV does not
diff --git a/llvm/test/Transforms/IndVarSimplify/lftr.ll b/llvm/test/Transforms/IndVarSimplify/lftr.ll
index b854068..1a77505 100644
--- a/llvm/test/Transforms/IndVarSimplify/lftr.ll
+++ b/llvm/test/Transforms/IndVarSimplify/lftr.ll
@@ -706,3 +706,21 @@ if.end:
 
 declare i32 @llvm.loop.decrement.reg.i32(i32, i32)
 
+; This used to crash, we're basically just checking that it doesn't.
+define void @switch_preheader() {
+; CHECK-LABEL: @switch_preheader(
+; CHECK-NEXT:    switch i32 -1, label [[X:%.*]] [
+; CHECK-NEXT:    ]
+; CHECK:       x:
+; CHECK-NEXT:    br i1 false, label [[X]], label [[BB:%.*]]
+; CHECK:       BB:
+; CHECK-NEXT:    ret void
+;
+  switch i32 -1, label %x []
+
+x:                                                ; preds = %x, %0
+  br i1 false, label %x, label %BB
+
+BB:                                               ; preds = %x
+  ret void
+}