1 Target Independent Opportunities:
3 //===---------------------------------------------------------------------===//
5 Dead argument elimination should be enhanced to handle cases when an argument is
6 dead to an externally visible function. Though the argument can't be removed
7 from the externally visible function, the caller doesn't need to pass it in.
8 For example in this testcase:
10 void foo(int X) __attribute__((noinline));
11 void foo(int X) { sideeffect(); }
12 void bar(int A) { foo(A+1); }
16 define void @bar(i32 %A) nounwind ssp {
17 %0 = add nsw i32 %A, 1 ; <i32> [#uses=1]
18 tail call void @foo(i32 %0) nounwind noinline ssp
22 The add is dead, we could pass in 'i32 undef' instead. This occurs for C++
23 templates etc, which usually have linkonce_odr/weak_odr linkage, not internal
26 //===---------------------------------------------------------------------===//
28 With the recent changes to make the implicit def/use set explicit in
29 machineinstrs, we should change the target descriptions for 'call' instructions
30 so that the .td files don't list all the call-clobbered registers as implicit
31 defs. Instead, these should be added by the code generator (e.g. on the dag).
33 This has a number of uses:
35 1. PPC32/64 and X86 32/64 can avoid having multiple copies of call instructions
36 for their different impdef sets.
37 2. Targets with multiple calling convs (e.g. x86) which have different clobber
38 sets don't need copies of call instructions.
39 3. 'Interprocedural register allocation' can be done to reduce the clobber sets
42 //===---------------------------------------------------------------------===//
44 We should recognized various "overflow detection" idioms and translate them into
45 llvm.uadd.with.overflow and similar intrinsics. Here is a multiply idiom:
47 unsigned int mul(unsigned int a,unsigned int b) {
48 if ((unsigned long long)a*b>0xffffffff)
53 The legalization code for mul-with-overflow needs to be made more robust before
54 this can be implemented though.
56 //===---------------------------------------------------------------------===//
58 Get the C front-end to expand hypot(x,y) -> llvm.sqrt(x*x+y*y) when errno and
59 precision don't matter (ffastmath). Misc/mandel will like this. :) This isn't
60 safe in general, even on darwin. See the libm implementation of hypot for
61 examples (which special case when x/y are exactly zero to get signed zeros etc
64 //===---------------------------------------------------------------------===//
66 On targets with expensive 64-bit multiply, we could LSR this:
73 for (i = ...; ++i, tmp+=tmp)
76 This would be a win on ppc32, but not x86 or ppc64.
78 //===---------------------------------------------------------------------===//
80 Shrink: (setlt (loadi32 P), 0) -> (setlt (loadi8 Phi), 0)
82 //===---------------------------------------------------------------------===//
84 Reassociate should turn things like:
86 int factorial(int X) {
87 return X*X*X*X*X*X*X*X;
90 into llvm.powi calls, allowing the code generator to produce balanced
93 First, the intrinsic needs to be extended to support integers, and second the
94 code generator needs to be enhanced to lower these to multiplication trees.
96 //===---------------------------------------------------------------------===//
98 Interesting? testcase for add/shift/mul reassoc:
100 int bar(int x, int y) {
101 return x*x*x+y+x*x*x*x*x*y*y*y*y;
103 int foo(int z, int n) {
104 return bar(z, n) + bar(2*z, 2*n);
107 This is blocked on not handling X*X*X -> powi(X, 3) (see note above). The issue
108 is that we end up getting t = 2*X s = t*t and don't turn this into 4*X*X,
109 which is the same number of multiplies and is canonical, because the 2*X has
110 multiple uses. Here's a simple example:
112 define i32 @test15(i32 %X1) {
113 %B = mul i32 %X1, 47 ; X1*47
119 //===---------------------------------------------------------------------===//
121 Reassociate should handle the example in GCC PR16157:
123 extern int a0, a1, a2, a3, a4; extern int b0, b1, b2, b3, b4;
124 void f () { /* this can be optimized to four additions... */
125 b4 = a4 + a3 + a2 + a1 + a0;
126 b3 = a3 + a2 + a1 + a0;
131 This requires reassociating to forms of expressions that are already available,
132 something that reassoc doesn't think about yet.
135 //===---------------------------------------------------------------------===//
137 This function: (derived from GCC PR19988)
138 double foo(double x, double y) {
139 return ((x + 0.1234 * y) * (x + -0.1234 * y));
145 mulsd LCPI1_1(%rip), %xmm1
146 mulsd LCPI1_0(%rip), %xmm2
153 Reassociate should be able to turn it into:
155 double foo(double x, double y) {
156 return ((x + 0.1234 * y) * (x - 0.1234 * y));
159 Which allows the multiply by constant to be CSE'd, producing:
162 mulsd LCPI1_0(%rip), %xmm1
169 This doesn't need -ffast-math support at all. This is particularly bad because
170 the llvm-gcc frontend is canonicalizing the later into the former, but clang
171 doesn't have this problem.
173 //===---------------------------------------------------------------------===//
175 These two functions should generate the same code on big-endian systems:
177 int g(int *j,int *l) { return memcmp(j,l,4); }
178 int h(int *j, int *l) { return *j - *l; }
180 this could be done in SelectionDAGISel.cpp, along with other special cases,
183 //===---------------------------------------------------------------------===//
185 It would be nice to revert this patch:
186 http://lists.cs.uiuc.edu/pipermail/llvm-commits/Week-of-Mon-20060213/031986.html
188 And teach the dag combiner enough to simplify the code expanded before
189 legalize. It seems plausible that this knowledge would let it simplify other
192 //===---------------------------------------------------------------------===//
194 For vector types, TargetData.cpp::getTypeInfo() returns alignment that is equal
195 to the type size. It works but can be overly conservative as the alignment of
196 specific vector types are target dependent.
198 //===---------------------------------------------------------------------===//
200 We should produce an unaligned load from code like this:
202 v4sf example(float *P) {
203 return (v4sf){P[0], P[1], P[2], P[3] };
206 //===---------------------------------------------------------------------===//
208 Add support for conditional increments, and other related patterns. Instead
213 je LBB16_2 #cond_next
224 //===---------------------------------------------------------------------===//
226 Combine: a = sin(x), b = cos(x) into a,b = sincos(x).
228 Expand these to calls of sin/cos and stores:
229 double sincos(double x, double *sin, double *cos);
230 float sincosf(float x, float *sin, float *cos);
231 long double sincosl(long double x, long double *sin, long double *cos);
233 Doing so could allow SROA of the destination pointers. See also:
234 http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17687
236 This is now easily doable with MRVs. We could even make an intrinsic for this
237 if anyone cared enough about sincos.
239 //===---------------------------------------------------------------------===//
241 quantum_sigma_x in 462.libquantum contains the following loop:
243 for(i=0; i<reg->size; i++)
245 /* Flip the target bit of each basis state */
246 reg->node[i].state ^= ((MAX_UNSIGNED) 1 << target);
249 Where MAX_UNSIGNED/state is a 64-bit int. On a 32-bit platform it would be just
250 so cool to turn it into something like:
252 long long Res = ((MAX_UNSIGNED) 1 << target);
254 for(i=0; i<reg->size; i++)
255 reg->node[i].state ^= Res & 0xFFFFFFFFULL;
257 for(i=0; i<reg->size; i++)
258 reg->node[i].state ^= Res & 0xFFFFFFFF00000000ULL
261 ... which would only do one 32-bit XOR per loop iteration instead of two.
263 It would also be nice to recognize the reg->size doesn't alias reg->node[i], but
266 //===---------------------------------------------------------------------===//
268 This isn't recognized as bswap by instcombine (yes, it really is bswap):
270 unsigned long reverse(unsigned v) {
272 t = v ^ ((v << 16) | (v >> 16));
274 v = (v << 24) | (v >> 8);
278 //===---------------------------------------------------------------------===//
282 These idioms should be recognized as popcount (see PR1488):
284 unsigned countbits_slow(unsigned v) {
286 for (c = 0; v; v >>= 1)
290 unsigned countbits_fast(unsigned v){
293 v &= v - 1; // clear the least significant bit set
297 BITBOARD = unsigned long long
298 int PopCnt(register BITBOARD a) {
306 unsigned int popcount(unsigned int input) {
307 unsigned int count = 0;
308 for (unsigned int i = 0; i < 4 * 8; i++)
309 count += (input >> i) & i;
313 This sort of thing should be added to the loop idiom pass.
315 //===---------------------------------------------------------------------===//
317 These should turn into single 16-bit (unaligned?) loads on little/big endian
320 unsigned short read_16_le(const unsigned char *adr) {
321 return adr[0] | (adr[1] << 8);
323 unsigned short read_16_be(const unsigned char *adr) {
324 return (adr[0] << 8) | adr[1];
327 //===---------------------------------------------------------------------===//
329 -instcombine should handle this transform:
330 icmp pred (sdiv X / C1 ), C2
331 when X, C1, and C2 are unsigned. Similarly for udiv and signed operands.
333 Currently InstCombine avoids this transform but will do it when the signs of
334 the operands and the sign of the divide match. See the FIXME in
335 InstructionCombining.cpp in the visitSetCondInst method after the switch case
336 for Instruction::UDiv (around line 4447) for more details.
338 The SingleSource/Benchmarks/Shootout-C++/hash and hash2 tests have examples of
341 //===---------------------------------------------------------------------===//
345 SingleSource/Benchmarks/Misc/dt.c shows several interesting optimization
346 opportunities in its double_array_divs_variable function: it needs loop
347 interchange, memory promotion (which LICM already does), vectorization and
348 variable trip count loop unrolling (since it has a constant trip count). ICC
349 apparently produces this very nice code with -ffast-math:
351 ..B1.70: # Preds ..B1.70 ..B1.69
352 mulpd %xmm0, %xmm1 #108.2
353 mulpd %xmm0, %xmm1 #108.2
354 mulpd %xmm0, %xmm1 #108.2
355 mulpd %xmm0, %xmm1 #108.2
357 cmpl $131072, %edx #108.2
358 jb ..B1.70 # Prob 99% #108.2
360 It would be better to count down to zero, but this is a lot better than what we
363 //===---------------------------------------------------------------------===//
367 typedef unsigned U32;
368 typedef unsigned long long U64;
369 int test (U32 *inst, U64 *regs) {
372 int r1 = (temp >> 20) & 0xf;
373 int b2 = (temp >> 16) & 0xf;
374 effective_addr2 = temp & 0xfff;
375 if (b2) effective_addr2 += regs[b2];
376 b2 = (temp >> 12) & 0xf;
377 if (b2) effective_addr2 += regs[b2];
378 effective_addr2 &= regs[4];
379 if ((effective_addr2 & 3) == 0)
384 Note that only the low 2 bits of effective_addr2 are used. On 32-bit systems,
385 we don't eliminate the computation of the top half of effective_addr2 because
386 we don't have whole-function selection dags. On x86, this means we use one
387 extra register for the function when effective_addr2 is declared as U64 than
388 when it is declared U32.
390 PHI Slicing could be extended to do this.
392 //===---------------------------------------------------------------------===//
394 LSR should know what GPR types a target has from TargetData. This code:
396 volatile short X, Y; // globals
400 for (i = 0; i < N; i++) { X = i; Y = i*4; }
403 produces two near identical IV's (after promotion) on PPC/ARM:
413 add r2, r2, #1 <- [0,+,1]
414 sub r0, r0, #1 <- [0,-,1]
418 LSR should reuse the "+" IV for the exit test.
420 //===---------------------------------------------------------------------===//
422 Tail call elim should be more aggressive, checking to see if the call is
423 followed by an uncond branch to an exit block.
425 ; This testcase is due to tail-duplication not wanting to copy the return
426 ; instruction into the terminating blocks because there was other code
427 ; optimized out of the function after the taildup happened.
428 ; RUN: llvm-as < %s | opt -tailcallelim | llvm-dis | not grep call
430 define i32 @t4(i32 %a) {
432 %tmp.1 = and i32 %a, 1 ; <i32> [#uses=1]
433 %tmp.2 = icmp ne i32 %tmp.1, 0 ; <i1> [#uses=1]
434 br i1 %tmp.2, label %then.0, label %else.0
436 then.0: ; preds = %entry
437 %tmp.5 = add i32 %a, -1 ; <i32> [#uses=1]
438 %tmp.3 = call i32 @t4( i32 %tmp.5 ) ; <i32> [#uses=1]
441 else.0: ; preds = %entry
442 %tmp.7 = icmp ne i32 %a, 0 ; <i1> [#uses=1]
443 br i1 %tmp.7, label %then.1, label %return
445 then.1: ; preds = %else.0
446 %tmp.11 = add i32 %a, -2 ; <i32> [#uses=1]
447 %tmp.9 = call i32 @t4( i32 %tmp.11 ) ; <i32> [#uses=1]
450 return: ; preds = %then.1, %else.0, %then.0
451 %result.0 = phi i32 [ 0, %else.0 ], [ %tmp.3, %then.0 ],
456 //===---------------------------------------------------------------------===//
458 Tail recursion elimination should handle:
463 return 2 * pow2m1 (n - 1) + 1;
466 Also, multiplies can be turned into SHL's, so they should be handled as if
467 they were associative. "return foo() << 1" can be tail recursion eliminated.
469 //===---------------------------------------------------------------------===//
471 Argument promotion should promote arguments for recursive functions, like
474 ; RUN: llvm-as < %s | opt -argpromotion | llvm-dis | grep x.val
476 define internal i32 @foo(i32* %x) {
478 %tmp = load i32* %x ; <i32> [#uses=0]
479 %tmp.foo = call i32 @foo( i32* %x ) ; <i32> [#uses=1]
483 define i32 @bar(i32* %x) {
485 %tmp3 = call i32 @foo( i32* %x ) ; <i32> [#uses=1]
489 //===---------------------------------------------------------------------===//
491 We should investigate an instruction sinking pass. Consider this silly
507 je LBB1_2 # cond_true
515 The PIC base computation (call+popl) is only used on one path through the
516 code, but is currently always computed in the entry block. It would be
517 better to sink the picbase computation down into the block for the
518 assertion, as it is the only one that uses it. This happens for a lot of
519 code with early outs.
521 Another example is loads of arguments, which are usually emitted into the
522 entry block on targets like x86. If not used in all paths through a
523 function, they should be sunk into the ones that do.
525 In this case, whole-function-isel would also handle this.
527 //===---------------------------------------------------------------------===//
529 Investigate lowering of sparse switch statements into perfect hash tables:
530 http://burtleburtle.net/bob/hash/perfect.html
532 //===---------------------------------------------------------------------===//
534 We should turn things like "load+fabs+store" and "load+fneg+store" into the
535 corresponding integer operations. On a yonah, this loop:
540 for (b = 0; b < 10000000; b++)
541 for (i = 0; i < 256; i++)
545 is twice as slow as this loop:
550 for (b = 0; b < 10000000; b++)
551 for (i = 0; i < 256; i++)
552 a[i] ^= (1ULL << 63);
555 and I suspect other processors are similar. On X86 in particular this is a
556 big win because doing this with integers allows the use of read/modify/write
559 //===---------------------------------------------------------------------===//
561 DAG Combiner should try to combine small loads into larger loads when
562 profitable. For example, we compile this C++ example:
564 struct THotKey { short Key; bool Control; bool Shift; bool Alt; };
565 extern THotKey m_HotKey;
566 THotKey GetHotKey () { return m_HotKey; }
568 into (-m64 -O3 -fno-exceptions -static -fomit-frame-pointer):
570 __Z9GetHotKeyv: ## @_Z9GetHotKeyv
571 movq _m_HotKey@GOTPCREL(%rip), %rax
584 //===---------------------------------------------------------------------===//
586 We should add an FRINT node to the DAG to model targets that have legal
587 implementations of ceil/floor/rint.
589 //===---------------------------------------------------------------------===//
594 long long input[8] = {1,0,1,0,1,0,1,0};
598 Clang compiles this into:
600 call void @llvm.memset.p0i8.i64(i8* %tmp, i8 0, i64 64, i32 16, i1 false)
601 %0 = getelementptr [8 x i64]* %input, i64 0, i64 0
602 store i64 1, i64* %0, align 16
603 %1 = getelementptr [8 x i64]* %input, i64 0, i64 2
604 store i64 1, i64* %1, align 16
605 %2 = getelementptr [8 x i64]* %input, i64 0, i64 4
606 store i64 1, i64* %2, align 16
607 %3 = getelementptr [8 x i64]* %input, i64 0, i64 6
608 store i64 1, i64* %3, align 16
610 Which gets codegen'd into:
613 movaps %xmm0, -16(%rbp)
614 movaps %xmm0, -32(%rbp)
615 movaps %xmm0, -48(%rbp)
616 movaps %xmm0, -64(%rbp)
622 It would be better to have 4 movq's of 0 instead of the movaps's.
624 //===---------------------------------------------------------------------===//
626 http://llvm.org/PR717:
628 The following code should compile into "ret int undef". Instead, LLVM
629 produces "ret int 0":
638 //===---------------------------------------------------------------------===//
640 The loop unroller should partially unroll loops (instead of peeling them)
641 when code growth isn't too bad and when an unroll count allows simplification
642 of some code within the loop. One trivial example is:
648 for ( nLoop = 0; nLoop < 1000; nLoop++ ) {
657 Unrolling by 2 would eliminate the '&1' in both copies, leading to a net
658 reduction in code size. The resultant code would then also be suitable for
659 exit value computation.
661 //===---------------------------------------------------------------------===//
663 We miss a bunch of rotate opportunities on various targets, including ppc, x86,
664 etc. On X86, we miss a bunch of 'rotate by variable' cases because the rotate
665 matching code in dag combine doesn't look through truncates aggressively
666 enough. Here are some testcases reduces from GCC PR17886:
668 unsigned long long f5(unsigned long long x, unsigned long long y) {
669 return (x << 8) | ((y >> 48) & 0xffull);
671 unsigned long long f6(unsigned long long x, unsigned long long y, int z) {
674 return (x << 8) | ((y >> 48) & 0xffull);
676 return (x << 16) | ((y >> 40) & 0xffffull);
678 return (x << 24) | ((y >> 32) & 0xffffffull);
680 return (x << 32) | ((y >> 24) & 0xffffffffull);
682 return (x << 40) | ((y >> 16) & 0xffffffffffull);
686 //===---------------------------------------------------------------------===//
688 This (and similar related idioms):
690 unsigned int foo(unsigned char i) {
691 return i | (i<<8) | (i<<16) | (i<<24);
696 define i32 @foo(i8 zeroext %i) nounwind readnone ssp noredzone {
698 %conv = zext i8 %i to i32
699 %shl = shl i32 %conv, 8
700 %shl5 = shl i32 %conv, 16
701 %shl9 = shl i32 %conv, 24
702 %or = or i32 %shl9, %conv
703 %or6 = or i32 %or, %shl5
704 %or10 = or i32 %or6, %shl
708 it would be better as:
710 unsigned int bar(unsigned char i) {
711 unsigned int j=i | (i << 8);
717 define i32 @bar(i8 zeroext %i) nounwind readnone ssp noredzone {
719 %conv = zext i8 %i to i32
720 %shl = shl i32 %conv, 8
721 %or = or i32 %shl, %conv
722 %shl5 = shl i32 %or, 16
723 %or6 = or i32 %shl5, %or
727 or even i*0x01010101, depending on the speed of the multiplier. The best way to
728 handle this is to canonicalize it to a multiply in IR and have codegen handle
729 lowering multiplies to shifts on cpus where shifts are faster.
731 //===---------------------------------------------------------------------===//
733 We do a number of simplifications in simplify libcalls to strength reduce
734 standard library functions, but we don't currently merge them together. For
735 example, it is useful to merge memcpy(a,b,strlen(b)) -> strcpy. This can only
736 be done safely if "b" isn't modified between the strlen and memcpy of course.
738 //===---------------------------------------------------------------------===//
740 We compile this program: (from GCC PR11680)
741 http://gcc.gnu.org/bugzilla/attachment.cgi?id=4487
743 Into code that runs the same speed in fast/slow modes, but both modes run 2x
744 slower than when compile with GCC (either 4.0 or 4.2):
746 $ llvm-g++ perf.cpp -O3 -fno-exceptions
748 1.821u 0.003s 0:01.82 100.0% 0+0k 0+0io 0pf+0w
750 $ g++ perf.cpp -O3 -fno-exceptions
752 0.821u 0.001s 0:00.82 100.0% 0+0k 0+0io 0pf+0w
754 It looks like we are making the same inlining decisions, so this may be raw
755 codegen badness or something else (haven't investigated).
757 //===---------------------------------------------------------------------===//
759 We miss some instcombines for stuff like this:
761 void foo (unsigned int a) {
762 /* This one is equivalent to a >= (3 << 2). */
767 A few other related ones are in GCC PR14753.
769 //===---------------------------------------------------------------------===//
771 Divisibility by constant can be simplified (according to GCC PR12849) from
772 being a mulhi to being a mul lo (cheaper). Testcase:
774 void bar(unsigned n) {
779 This is equivalent to the following, where 2863311531 is the multiplicative
780 inverse of 3, and 1431655766 is ((2^32)-1)/3+1:
781 void bar(unsigned n) {
782 if (n * 2863311531U < 1431655766U)
786 The same transformation can work with an even modulo with the addition of a
787 rotate: rotate the result of the multiply to the right by the number of bits
788 which need to be zero for the condition to be true, and shrink the compare RHS
789 by the same amount. Unless the target supports rotates, though, that
790 transformation probably isn't worthwhile.
792 The transformation can also easily be made to work with non-zero equality
793 comparisons: just transform, for example, "n % 3 == 1" to "(n-1) % 3 == 0".
795 //===---------------------------------------------------------------------===//
797 Better mod/ref analysis for scanf would allow us to eliminate the vtable and a
798 bunch of other stuff from this example (see PR1604):
808 std::scanf("%d", &t.val);
809 std::printf("%d\n", t.val);
812 //===---------------------------------------------------------------------===//
814 These functions perform the same computation, but produce different assembly.
816 define i8 @select(i8 %x) readnone nounwind {
817 %A = icmp ult i8 %x, 250
818 %B = select i1 %A, i8 0, i8 1
822 define i8 @addshr(i8 %x) readnone nounwind {
823 %A = zext i8 %x to i9
824 %B = add i9 %A, 6 ;; 256 - 250 == 6
826 %D = trunc i9 %C to i8
830 //===---------------------------------------------------------------------===//
834 f (unsigned long a, unsigned long b, unsigned long c)
836 return ((a & (c - 1)) != 0) || ((b & (c - 1)) != 0);
839 f (unsigned long a, unsigned long b, unsigned long c)
841 return ((a & (c - 1)) != 0) | ((b & (c - 1)) != 0);
843 Both should combine to ((a|b) & (c-1)) != 0. Currently not optimized with
844 "clang -emit-llvm-bc | opt -std-compile-opts".
846 //===---------------------------------------------------------------------===//
849 #define PMD_MASK (~((1UL << 23) - 1))
850 void clear_pmd_range(unsigned long start, unsigned long end)
852 if (!(start & ~PMD_MASK) && !(end & ~PMD_MASK))
855 The expression should optimize to something like
856 "!((start|end)&~PMD_MASK). Currently not optimized with "clang
857 -emit-llvm-bc | opt -std-compile-opts".
859 //===---------------------------------------------------------------------===//
861 unsigned int f(unsigned int i, unsigned int n) {++i; if (i == n) ++i; return
863 unsigned int f2(unsigned int i, unsigned int n) {++i; i += i == n; return i;}
864 These should combine to the same thing. Currently, the first function
865 produces better code on X86.
867 //===---------------------------------------------------------------------===//
870 #define abs(x) x>0?x:-x
873 return (abs(x)) >= 0;
875 This should optimize to x == INT_MIN. (With -fwrapv.) Currently not
876 optimized with "clang -emit-llvm-bc | opt -std-compile-opts".
878 //===---------------------------------------------------------------------===//
882 rotate_cst (unsigned int a)
884 a = (a << 10) | (a >> 22);
889 minus_cst (unsigned int a)
898 mask_gt (unsigned int a)
900 /* This is equivalent to a > 15. */
905 rshift_gt (unsigned int a)
907 /* This is equivalent to a > 23. */
911 All should simplify to a single comparison. All of these are
912 currently not optimized with "clang -emit-llvm-bc | opt
915 //===---------------------------------------------------------------------===//
918 int c(int* x) {return (char*)x+2 == (char*)x;}
919 Should combine to 0. Currently not optimized with "clang
920 -emit-llvm-bc | opt -std-compile-opts" (although llc can optimize it).
922 //===---------------------------------------------------------------------===//
924 int a(unsigned b) {return ((b << 31) | (b << 30)) >> 31;}
925 Should be combined to "((b >> 1) | b) & 1". Currently not optimized
926 with "clang -emit-llvm-bc | opt -std-compile-opts".
928 //===---------------------------------------------------------------------===//
930 unsigned a(unsigned x, unsigned y) { return x | (y & 1) | (y & 2);}
931 Should combine to "x | (y & 3)". Currently not optimized with "clang
932 -emit-llvm-bc | opt -std-compile-opts".
934 //===---------------------------------------------------------------------===//
936 int a(int a, int b, int c) {return (~a & c) | ((c|a) & b);}
937 Should fold to "(~a & c) | (a & b)". Currently not optimized with
938 "clang -emit-llvm-bc | opt -std-compile-opts".
940 //===---------------------------------------------------------------------===//
942 int a(int a,int b) {return (~(a|b))|a;}
943 Should fold to "a|~b". Currently not optimized with "clang
944 -emit-llvm-bc | opt -std-compile-opts".
946 //===---------------------------------------------------------------------===//
948 int a(int a, int b) {return (a&&b) || (a&&!b);}
949 Should fold to "a". Currently not optimized with "clang -emit-llvm-bc
950 | opt -std-compile-opts".
952 //===---------------------------------------------------------------------===//
954 int a(int a, int b, int c) {return (a&&b) || (!a&&c);}
955 Should fold to "a ? b : c", or at least something sane. Currently not
956 optimized with "clang -emit-llvm-bc | opt -std-compile-opts".
958 //===---------------------------------------------------------------------===//
960 int a(int a, int b, int c) {return (a&&b) || (a&&c) || (a&&b&&c);}
961 Should fold to a && (b || c). Currently not optimized with "clang
962 -emit-llvm-bc | opt -std-compile-opts".
964 //===---------------------------------------------------------------------===//
966 int a(int x) {return x | ((x & 8) ^ 8);}
967 Should combine to x | 8. Currently not optimized with "clang
968 -emit-llvm-bc | opt -std-compile-opts".
970 //===---------------------------------------------------------------------===//
972 int a(int x) {return x ^ ((x & 8) ^ 8);}
973 Should also combine to x | 8. Currently not optimized with "clang
974 -emit-llvm-bc | opt -std-compile-opts".
976 //===---------------------------------------------------------------------===//
978 int a(int x) {return ((x | -9) ^ 8) & x;}
979 Should combine to x & -9. Currently not optimized with "clang
980 -emit-llvm-bc | opt -std-compile-opts".
982 //===---------------------------------------------------------------------===//
984 unsigned a(unsigned a) {return a * 0x11111111 >> 28 & 1;}
985 Should combine to "a * 0x88888888 >> 31". Currently not optimized
986 with "clang -emit-llvm-bc | opt -std-compile-opts".
988 //===---------------------------------------------------------------------===//
990 unsigned a(char* x) {if ((*x & 32) == 0) return b();}
991 There's an unnecessary zext in the generated code with "clang
992 -emit-llvm-bc | opt -std-compile-opts".
994 //===---------------------------------------------------------------------===//
996 unsigned a(unsigned long long x) {return 40 * (x >> 1);}
997 Should combine to "20 * (((unsigned)x) & -2)". Currently not
998 optimized with "clang -emit-llvm-bc | opt -std-compile-opts".
1000 //===---------------------------------------------------------------------===//
1002 This was noticed in the entryblock for grokdeclarator in 403.gcc:
1004 %tmp = icmp eq i32 %decl_context, 4
1005 %decl_context_addr.0 = select i1 %tmp, i32 3, i32 %decl_context
1006 %tmp1 = icmp eq i32 %decl_context_addr.0, 1
1007 %decl_context_addr.1 = select i1 %tmp1, i32 0, i32 %decl_context_addr.0
1009 tmp1 should be simplified to something like:
1010 (!tmp || decl_context == 1)
1012 This allows recursive simplifications, tmp1 is used all over the place in
1013 the function, e.g. by:
1015 %tmp23 = icmp eq i32 %decl_context_addr.1, 0 ; <i1> [#uses=1]
1016 %tmp24 = xor i1 %tmp1, true ; <i1> [#uses=1]
1017 %or.cond8 = and i1 %tmp23, %tmp24 ; <i1> [#uses=1]
1021 //===---------------------------------------------------------------------===//
1025 Store sinking: This code:
1027 void f (int n, int *cond, int *res) {
1030 for (i = 0; i < n; i++)
1032 *res ^= 234; /* (*) */
1035 On this function GVN hoists the fully redundant value of *res, but nothing
1036 moves the store out. This gives us this code:
1038 bb: ; preds = %bb2, %entry
1039 %.rle = phi i32 [ 0, %entry ], [ %.rle6, %bb2 ]
1040 %i.05 = phi i32 [ 0, %entry ], [ %indvar.next, %bb2 ]
1041 %1 = load i32* %cond, align 4
1042 %2 = icmp eq i32 %1, 0
1043 br i1 %2, label %bb2, label %bb1
1046 %3 = xor i32 %.rle, 234
1047 store i32 %3, i32* %res, align 4
1050 bb2: ; preds = %bb, %bb1
1051 %.rle6 = phi i32 [ %3, %bb1 ], [ %.rle, %bb ]
1052 %indvar.next = add i32 %i.05, 1
1053 %exitcond = icmp eq i32 %indvar.next, %n
1054 br i1 %exitcond, label %return, label %bb
1056 DSE should sink partially dead stores to get the store out of the loop.
1058 Here's another partial dead case:
1059 http://gcc.gnu.org/bugzilla/show_bug.cgi?id=12395
1061 //===---------------------------------------------------------------------===//
1063 Scalar PRE hoists the mul in the common block up to the else:
1065 int test (int a, int b, int c, int g) {
1075 It would be better to do the mul once to reduce codesize above the if.
1076 This is GCC PR38204.
1079 //===---------------------------------------------------------------------===//
1080 This simple function from 179.art:
1083 struct { double y; int reset; } *Y;
1088 for (i=0;i<numf2s;i++)
1089 if (Y[i].y > Y[winner].y)
1093 Compiles into (with clang TBAA):
1095 for.body: ; preds = %for.inc, %bb.nph
1096 %indvar = phi i64 [ 0, %bb.nph ], [ %indvar.next, %for.inc ]
1097 %i.01718 = phi i32 [ 0, %bb.nph ], [ %i.01719, %for.inc ]
1098 %tmp4 = getelementptr inbounds %struct.anon* %tmp3, i64 %indvar, i32 0
1099 %tmp5 = load double* %tmp4, align 8, !tbaa !4
1100 %idxprom7 = sext i32 %i.01718 to i64
1101 %tmp10 = getelementptr inbounds %struct.anon* %tmp3, i64 %idxprom7, i32 0
1102 %tmp11 = load double* %tmp10, align 8, !tbaa !4
1103 %cmp12 = fcmp ogt double %tmp5, %tmp11
1104 br i1 %cmp12, label %if.then, label %for.inc
1106 if.then: ; preds = %for.body
1107 %i.017 = trunc i64 %indvar to i32
1110 for.inc: ; preds = %for.body, %if.then
1111 %i.01719 = phi i32 [ %i.01718, %for.body ], [ %i.017, %if.then ]
1112 %indvar.next = add i64 %indvar, 1
1113 %exitcond = icmp eq i64 %indvar.next, %tmp22
1114 br i1 %exitcond, label %for.cond.for.end_crit_edge, label %for.body
1117 It is good that we hoisted the reloads of numf2's, and Y out of the loop and
1118 sunk the store to winner out.
1120 However, this is awful on several levels: the conditional truncate in the loop
1121 (-indvars at fault? why can't we completely promote the IV to i64?).
1123 Beyond that, we have a partially redundant load in the loop: if "winner" (aka
1124 %i.01718) isn't updated, we reload Y[winner].y the next time through the loop.
1125 Similarly, the addressing that feeds it (including the sext) is redundant. In
1126 the end we get this generated assembly:
1128 LBB0_2: ## %for.body
1129 ## =>This Inner Loop Header: Depth=1
1133 ucomisd (%rcx,%r8), %xmm0
1142 All things considered this isn't too bad, but we shouldn't need the movslq or
1143 the shlq instruction, or the load folded into ucomisd every time through the
1146 On an x86-specific topic, if the loop can't be restructure, the movl should be a
1149 //===---------------------------------------------------------------------===//
1153 GCC PR37810 is an interesting case where we should sink load/store reload
1154 into the if block and outside the loop, so we don't reload/store it on the
1175 We now hoist the reload after the call (Transforms/GVN/lpre-call-wrap.ll), but
1176 we don't sink the store. We need partially dead store sinking.
1178 //===---------------------------------------------------------------------===//
1180 [LOAD PRE CRIT EDGE SPLITTING]
1182 GCC PR37166: Sinking of loads prevents SROA'ing the "g" struct on the stack
1183 leading to excess stack traffic. This could be handled by GVN with some crazy
1184 symbolic phi translation. The code we get looks like (g is on the stack):
1188 %9 = getelementptr %struct.f* %g, i32 0, i32 0
1189 store i32 %8, i32* %9, align bel %bb3
1191 bb3: ; preds = %bb1, %bb2, %bb
1192 %c_addr.0 = phi %struct.f* [ %g, %bb2 ], [ %c, %bb ], [ %c, %bb1 ]
1193 %b_addr.0 = phi %struct.f* [ %b, %bb2 ], [ %g, %bb ], [ %b, %bb1 ]
1194 %10 = getelementptr %struct.f* %c_addr.0, i32 0, i32 0
1195 %11 = load i32* %10, align 4
1197 %11 is partially redundant, an in BB2 it should have the value %8.
1199 GCC PR33344 and PR35287 are similar cases.
1202 //===---------------------------------------------------------------------===//
1206 There are many load PRE testcases in testsuite/gcc.dg/tree-ssa/loadpre* in the
1207 GCC testsuite, ones we don't get yet are (checked through loadpre25):
1209 [CRIT EDGE BREAKING]
1210 loadpre3.c predcom-4.c
1212 [PRE OF READONLY CALL]
1215 [TURN SELECT INTO BRANCH]
1216 loadpre14.c loadpre15.c
1218 actually a conditional increment: loadpre18.c loadpre19.c
1220 //===---------------------------------------------------------------------===//
1222 [LOAD PRE / STORE SINKING / SPEC HACK]
1224 This is a chunk of code from 456.hmmer:
1226 int f(int M, int *mc, int *mpp, int *tpmm, int *ip, int *tpim, int *dpp,
1227 int *tpdm, int xmb, int *bp, int *ms) {
1229 for (k = 1; k <= M; k++) {
1230 mc[k] = mpp[k-1] + tpmm[k-1];
1231 if ((sc = ip[k-1] + tpim[k-1]) > mc[k]) mc[k] = sc;
1232 if ((sc = dpp[k-1] + tpdm[k-1]) > mc[k]) mc[k] = sc;
1233 if ((sc = xmb + bp[k]) > mc[k]) mc[k] = sc;
1238 It is very profitable for this benchmark to turn the conditional stores to mc[k]
1239 into a conditional move (select instr in IR) and allow the final store to do the
1240 store. See GCC PR27313 for more details. Note that this is valid to xform even
1241 with the new C++ memory model, since mc[k] is previously loaded and later
1244 //===---------------------------------------------------------------------===//
1247 There are many PRE testcases in testsuite/gcc.dg/tree-ssa/ssa-pre-*.c in the
1250 //===---------------------------------------------------------------------===//
1252 There are some interesting cases in testsuite/gcc.dg/tree-ssa/pred-comm* in the
1253 GCC testsuite. For example, we get the first example in predcom-1.c, but
1254 miss the second one:
1259 __attribute__ ((noinline))
1260 void count_averages(int n) {
1262 for (i = 1; i < n; i++)
1263 avg[i] = (((unsigned long) fib[i - 1] + fib[i] + fib[i + 1]) / 3) & 0xffff;
1266 which compiles into two loads instead of one in the loop.
1268 predcom-2.c is the same as predcom-1.c
1270 predcom-3.c is very similar but needs loads feeding each other instead of
1274 //===---------------------------------------------------------------------===//
1278 Type based alias analysis:
1279 http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14705
1281 We should do better analysis of posix_memalign. At the least it should
1282 no-capture its pointer argument, at best, we should know that the out-value
1283 result doesn't point to anything (like malloc). One example of this is in
1284 SingleSource/Benchmarks/Misc/dt.c
1286 //===---------------------------------------------------------------------===//
1288 A/B get pinned to the stack because we turn an if/then into a select instead
1289 of PRE'ing the load/store. This may be fixable in instcombine:
1290 http://gcc.gnu.org/bugzilla/show_bug.cgi?id=37892
1292 struct X { int i; };
1306 //===---------------------------------------------------------------------===//
1308 Interesting missed case because of control flow flattening (should be 2 loads):
1309 http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26629
1310 With: llvm-gcc t2.c -S -o - -O0 -emit-llvm | llvm-as |
1311 opt -mem2reg -gvn -instcombine | llvm-dis
1312 we miss it because we need 1) CRIT EDGE 2) MULTIPLE DIFFERENT
1313 VALS PRODUCED BY ONE BLOCK OVER DIFFERENT PATHS
1315 //===---------------------------------------------------------------------===//
1317 http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19633
1318 We could eliminate the branch condition here, loading from null is undefined:
1320 struct S { int w, x, y, z; };
1321 struct T { int r; struct S s; };
1322 void bar (struct S, int);
1323 void foo (int a, struct T b)
1331 //===---------------------------------------------------------------------===//
1333 simplifylibcalls should do several optimizations for strspn/strcspn:
1335 strcspn(x, "a") -> inlined loop for up to 3 letters (similarly for strspn):
1337 size_t __strcspn_c3 (__const char *__s, int __reject1, int __reject2,
1339 register size_t __result = 0;
1340 while (__s[__result] != '\0' && __s[__result] != __reject1 &&
1341 __s[__result] != __reject2 && __s[__result] != __reject3)
1346 This should turn into a switch on the character. See PR3253 for some notes on
1349 456.hmmer apparently uses strcspn and strspn a lot. 471.omnetpp uses strspn.
1351 //===---------------------------------------------------------------------===//
1353 "gas" uses this idiom:
1354 else if (strchr ("+-/*%|&^:[]()~", *intel_parser.op_string))
1356 else if (strchr ("<>", *intel_parser.op_string)
1358 Those should be turned into a switch.
1360 //===---------------------------------------------------------------------===//
1362 252.eon contains this interesting code:
1364 %3072 = getelementptr [100 x i8]* %tempString, i32 0, i32 0
1365 %3073 = call i8* @strcpy(i8* %3072, i8* %3071) nounwind
1366 %strlen = call i32 @strlen(i8* %3072) ; uses = 1
1367 %endptr = getelementptr [100 x i8]* %tempString, i32 0, i32 %strlen
1368 call void @llvm.memcpy.i32(i8* %endptr,
1369 i8* getelementptr ([5 x i8]* @"\01LC42", i32 0, i32 0), i32 5, i32 1)
1370 %3074 = call i32 @strlen(i8* %endptr) nounwind readonly
1372 This is interesting for a couple reasons. First, in this:
1374 The memcpy+strlen strlen can be replaced with:
1376 %3074 = call i32 @strlen([5 x i8]* @"\01LC42") nounwind readonly
1378 Because the destination was just copied into the specified memory buffer. This,
1379 in turn, can be constant folded to "4".
1381 In other code, it contains:
1383 %endptr6978 = bitcast i8* %endptr69 to i32*
1384 store i32 7107374, i32* %endptr6978, align 1
1385 %3167 = call i32 @strlen(i8* %endptr69) nounwind readonly
1387 Which could also be constant folded. Whatever is producing this should probably
1388 be fixed to leave this as a memcpy from a string.
1390 Further, eon also has an interesting partially redundant strlen call:
1392 bb8: ; preds = %_ZN18eonImageCalculatorC1Ev.exit
1393 %682 = getelementptr i8** %argv, i32 6 ; <i8**> [#uses=2]
1394 %683 = load i8** %682, align 4 ; <i8*> [#uses=4]
1395 %684 = load i8* %683, align 1 ; <i8> [#uses=1]
1396 %685 = icmp eq i8 %684, 0 ; <i1> [#uses=1]
1397 br i1 %685, label %bb10, label %bb9
1400 %686 = call i32 @strlen(i8* %683) nounwind readonly
1401 %687 = icmp ugt i32 %686, 254 ; <i1> [#uses=1]
1402 br i1 %687, label %bb10, label %bb11
1404 bb10: ; preds = %bb9, %bb8
1405 %688 = call i32 @strlen(i8* %683) nounwind readonly
1407 This could be eliminated by doing the strlen once in bb8, saving code size and
1408 improving perf on the bb8->9->10 path.
1410 //===---------------------------------------------------------------------===//
1412 I see an interesting fully redundant call to strlen left in 186.crafty:InputMove
1414 %movetext11 = getelementptr [128 x i8]* %movetext, i32 0, i32 0
1417 bb62: ; preds = %bb55, %bb53
1418 %promote.0 = phi i32 [ %169, %bb55 ], [ 0, %bb53 ]
1419 %171 = call i32 @strlen(i8* %movetext11) nounwind readonly align 1
1420 %172 = add i32 %171, -1 ; <i32> [#uses=1]
1421 %173 = getelementptr [128 x i8]* %movetext, i32 0, i32 %172
1424 br i1 %or.cond, label %bb65, label %bb72
1426 bb65: ; preds = %bb62
1427 store i8 0, i8* %173, align 1
1430 bb72: ; preds = %bb65, %bb62
1431 %trank.1 = phi i32 [ %176, %bb65 ], [ -1, %bb62 ]
1432 %177 = call i32 @strlen(i8* %movetext11) nounwind readonly align 1
1434 Note that on the bb62->bb72 path, that the %177 strlen call is partially
1435 redundant with the %171 call. At worst, we could shove the %177 strlen call
1436 up into the bb65 block moving it out of the bb62->bb72 path. However, note
1437 that bb65 stores to the string, zeroing out the last byte. This means that on
1438 that path the value of %177 is actually just %171-1. A sub is cheaper than a
1441 This pattern repeats several times, basically doing:
1446 where it is "obvious" that B = A-1.
1448 //===---------------------------------------------------------------------===//
1450 186.crafty has this interesting pattern with the "out.4543" variable:
1452 call void @llvm.memcpy.i32(
1453 i8* getelementptr ([10 x i8]* @out.4543, i32 0, i32 0),
1454 i8* getelementptr ([7 x i8]* @"\01LC28700", i32 0, i32 0), i32 7, i32 1)
1455 %101 = call@printf(i8* ... @out.4543, i32 0, i32 0)) nounwind
1457 It is basically doing:
1459 memcpy(globalarray, "string");
1460 printf(..., globalarray);
1462 Anyway, by knowing that printf just reads the memory and forward substituting
1463 the string directly into the printf, this eliminates reads from globalarray.
1464 Since this pattern occurs frequently in crafty (due to the "DisplayTime" and
1465 other similar functions) there are many stores to "out". Once all the printfs
1466 stop using "out", all that is left is the memcpy's into it. This should allow
1467 globalopt to remove the "stored only" global.
1469 //===---------------------------------------------------------------------===//
1473 define inreg i32 @foo(i8* inreg %p) nounwind {
1475 %tmp1 = ashr i8 %tmp0, 5
1476 %tmp2 = sext i8 %tmp1 to i32
1480 could be dagcombine'd to a sign-extending load with a shift.
1481 For example, on x86 this currently gets this:
1487 while it could get this:
1492 //===---------------------------------------------------------------------===//
1496 int test(int x) { return 1-x == x; } // --> return false
1497 int test2(int x) { return 2-x == x; } // --> return x == 1 ?
1499 Always foldable for odd constants, what is the rule for even?
1501 //===---------------------------------------------------------------------===//
1503 PR 3381: GEP to field of size 0 inside a struct could be turned into GEP
1504 for next field in struct (which is at same address).
1506 For example: store of float into { {{}}, float } could be turned into a store to
1509 //===---------------------------------------------------------------------===//
1511 The arg promotion pass should make use of nocapture to make its alias analysis
1512 stuff much more precise.
1514 //===---------------------------------------------------------------------===//
1516 The following functions should be optimized to use a select instead of a
1517 branch (from gcc PR40072):
1519 char char_int(int m) {if(m>7) return 0; return m;}
1520 int int_char(char m) {if(m>7) return 0; return m;}
1522 //===---------------------------------------------------------------------===//
1524 int func(int a, int b) { if (a & 0x80) b |= 0x80; else b &= ~0x80; return b; }
1528 define i32 @func(i32 %a, i32 %b) nounwind readnone ssp {
1530 %0 = and i32 %a, 128 ; <i32> [#uses=1]
1531 %1 = icmp eq i32 %0, 0 ; <i1> [#uses=1]
1532 %2 = or i32 %b, 128 ; <i32> [#uses=1]
1533 %3 = and i32 %b, -129 ; <i32> [#uses=1]
1534 %b_addr.0 = select i1 %1, i32 %3, i32 %2 ; <i32> [#uses=1]
1538 However, it's functionally equivalent to:
1540 b = (b & ~0x80) | (a & 0x80);
1542 Which generates this:
1544 define i32 @func(i32 %a, i32 %b) nounwind readnone ssp {
1546 %0 = and i32 %b, -129 ; <i32> [#uses=1]
1547 %1 = and i32 %a, 128 ; <i32> [#uses=1]
1548 %2 = or i32 %0, %1 ; <i32> [#uses=1]
1552 This can be generalized for other forms:
1554 b = (b & ~0x80) | (a & 0x40) << 1;
1556 //===---------------------------------------------------------------------===//
1558 These two functions produce different code. They shouldn't:
1562 uint8_t p1(uint8_t b, uint8_t a) {
1563 b = (b & ~0xc0) | (a & 0xc0);
1567 uint8_t p2(uint8_t b, uint8_t a) {
1568 b = (b & ~0x40) | (a & 0x40);
1569 b = (b & ~0x80) | (a & 0x80);
1573 define zeroext i8 @p1(i8 zeroext %b, i8 zeroext %a) nounwind readnone ssp {
1575 %0 = and i8 %b, 63 ; <i8> [#uses=1]
1576 %1 = and i8 %a, -64 ; <i8> [#uses=1]
1577 %2 = or i8 %1, %0 ; <i8> [#uses=1]
1581 define zeroext i8 @p2(i8 zeroext %b, i8 zeroext %a) nounwind readnone ssp {
1583 %0 = and i8 %b, 63 ; <i8> [#uses=1]
1584 %.masked = and i8 %a, 64 ; <i8> [#uses=1]
1585 %1 = and i8 %a, -128 ; <i8> [#uses=1]
1586 %2 = or i8 %1, %0 ; <i8> [#uses=1]
1587 %3 = or i8 %2, %.masked ; <i8> [#uses=1]
1591 //===---------------------------------------------------------------------===//
1593 IPSCCP does not currently propagate argument dependent constants through
1594 functions where it does not not all of the callers. This includes functions
1595 with normal external linkage as well as templates, C99 inline functions etc.
1596 Specifically, it does nothing to:
1598 define i32 @test(i32 %x, i32 %y, i32 %z) nounwind {
1600 %0 = add nsw i32 %y, %z
1603 %3 = add nsw i32 %1, %2
1607 define i32 @test2() nounwind {
1609 %0 = call i32 @test(i32 1, i32 2, i32 4) nounwind
1613 It would be interesting extend IPSCCP to be able to handle simple cases like
1614 this, where all of the arguments to a call are constant. Because IPSCCP runs
1615 before inlining, trivial templates and inline functions are not yet inlined.
1616 The results for a function + set of constant arguments should be memoized in a
1619 //===---------------------------------------------------------------------===//
1621 The libcall constant folding stuff should be moved out of SimplifyLibcalls into
1622 libanalysis' constantfolding logic. This would allow IPSCCP to be able to
1623 handle simple things like this:
1625 static int foo(const char *X) { return strlen(X); }
1626 int bar() { return foo("abcd"); }
1628 //===---------------------------------------------------------------------===//
1630 InstCombine should use SimplifyDemandedBits to remove the or instruction:
1632 define i1 @test(i8 %x, i8 %y) {
1634 %B = icmp ugt i8 %A, 3
1638 Currently instcombine calls SimplifyDemandedBits with either all bits or just
1639 the sign bit, if the comparison is obviously a sign test. In this case, we only
1640 need all but the bottom two bits from %A, and if we gave that mask to SDB it
1641 would delete the or instruction for us.
1643 //===---------------------------------------------------------------------===//
1645 functionattrs doesn't know much about memcpy/memset. This function should be
1646 marked readnone rather than readonly, since it only twiddles local memory, but
1647 functionattrs doesn't handle memset/memcpy/memmove aggressively:
1649 struct X { int *p; int *q; };
1656 p = __builtin_memcpy (&x, &y, sizeof (int *));
1660 This can be seen at:
1661 $ clang t.c -S -o - -mkernel -O0 -emit-llvm | opt -functionattrs -S
1664 //===---------------------------------------------------------------------===//
1666 Missed instcombine transformation:
1667 define i1 @a(i32 %x) nounwind readnone {
1669 %cmp = icmp eq i32 %x, 30
1670 %sub = add i32 %x, -30
1671 %cmp2 = icmp ugt i32 %sub, 9
1672 %or = or i1 %cmp, %cmp2
1675 This should be optimized to a single compare. Testcase derived from gcc.
1677 //===---------------------------------------------------------------------===//
1679 Missed instcombine or reassociate transformation:
1680 int a(int a, int b) { return (a==12)&(b>47)&(b<58); }
1682 The sgt and slt should be combined into a single comparison. Testcase derived
1685 //===---------------------------------------------------------------------===//
1687 Missed instcombine transformation:
1689 %382 = srem i32 %tmp14.i, 64 ; [#uses=1]
1690 %383 = zext i32 %382 to i64 ; [#uses=1]
1691 %384 = shl i64 %381, %383 ; [#uses=1]
1692 %385 = icmp slt i32 %tmp14.i, 64 ; [#uses=1]
1694 The srem can be transformed to an and because if %tmp14.i is negative, the
1695 shift is undefined. Testcase derived from 403.gcc.
1697 //===---------------------------------------------------------------------===//
1699 This is a range comparison on a divided result (from 403.gcc):
1701 %1337 = sdiv i32 %1336, 8 ; [#uses=1]
1702 %.off.i208 = add i32 %1336, 7 ; [#uses=1]
1703 %1338 = icmp ult i32 %.off.i208, 15 ; [#uses=1]
1705 We already catch this (removing the sdiv) if there isn't an add, we should
1706 handle the 'add' as well. This is a common idiom with it's builtin_alloca code.
1709 int a(int x) { return (unsigned)(x/16+7) < 15; }
1711 Another similar case involves truncations on 64-bit targets:
1713 %361 = sdiv i64 %.046, 8 ; [#uses=1]
1714 %362 = trunc i64 %361 to i32 ; [#uses=2]
1716 %367 = icmp eq i32 %362, 0 ; [#uses=1]
1718 //===---------------------------------------------------------------------===//
1720 Missed instcombine/dagcombine transformation:
1721 define void @lshift_lt(i8 zeroext %a) nounwind {
1723 %conv = zext i8 %a to i32
1724 %shl = shl i32 %conv, 3
1725 %cmp = icmp ult i32 %shl, 33
1726 br i1 %cmp, label %if.then, label %if.end
1729 tail call void @bar() nounwind
1735 declare void @bar() nounwind
1737 The shift should be eliminated. Testcase derived from gcc.
1739 //===---------------------------------------------------------------------===//
1741 These compile into different code, one gets recognized as a switch and the
1742 other doesn't due to phase ordering issues (PR6212):
1744 int test1(int mainType, int subType) {
1747 else if (mainType == 9)
1749 else if (mainType == 11)
1754 int test2(int mainType, int subType) {
1764 //===---------------------------------------------------------------------===//
1766 The following test case (from PR6576):
1768 define i32 @mul(i32 %a, i32 %b) nounwind readnone {
1770 %cond1 = icmp eq i32 %b, 0 ; <i1> [#uses=1]
1771 br i1 %cond1, label %exit, label %bb.nph
1772 bb.nph: ; preds = %entry
1773 %tmp = mul i32 %b, %a ; <i32> [#uses=1]
1775 exit: ; preds = %entry
1779 could be reduced to:
1781 define i32 @mul(i32 %a, i32 %b) nounwind readnone {
1783 %tmp = mul i32 %b, %a
1787 //===---------------------------------------------------------------------===//
1789 We should use DSE + llvm.lifetime.end to delete dead vtable pointer updates.
1792 Another interesting case is that something related could be used for variables
1793 that go const after their ctor has finished. In these cases, globalopt (which
1794 can statically run the constructor) could mark the global const (so it gets put
1795 in the readonly section). A testcase would be:
1798 using namespace std;
1799 const complex<char> should_be_in_rodata (42,-42);
1800 complex<char> should_be_in_data (42,-42);
1801 complex<char> should_be_in_bss;
1803 Where we currently evaluate the ctors but the globals don't become const because
1804 the optimizer doesn't know they "become const" after the ctor is done. See
1805 GCC PR4131 for more examples.
1807 //===---------------------------------------------------------------------===//
1812 return x > 1 ? x : 1;
1815 LLVM emits a comparison with 1 instead of 0. 0 would be equivalent
1816 and cheaper on most targets.
1818 LLVM prefers comparisons with zero over non-zero in general, but in this
1819 case it choses instead to keep the max operation obvious.
1821 //===---------------------------------------------------------------------===//
1823 Take the following testcase on x86-64 (similar testcases exist for all targets
1826 define void @a(i64* nocapture %s, i64* nocapture %t, i64 %a, i64 %b,
1829 %0 = zext i64 %a to i128 ; <i128> [#uses=1]
1830 %1 = zext i64 %b to i128 ; <i128> [#uses=1]
1831 %2 = add i128 %1, %0 ; <i128> [#uses=2]
1832 %3 = zext i64 %c to i128 ; <i128> [#uses=1]
1833 %4 = shl i128 %3, 64 ; <i128> [#uses=1]
1834 %5 = add i128 %4, %2 ; <i128> [#uses=1]
1835 %6 = lshr i128 %5, 64 ; <i128> [#uses=1]
1836 %7 = trunc i128 %6 to i64 ; <i64> [#uses=1]
1837 store i64 %7, i64* %s, align 8
1838 %8 = trunc i128 %2 to i64 ; <i64> [#uses=1]
1839 store i64 %8, i64* %t, align 8
1859 The generated SelectionDAG has an ADD of an ADDE, where both operands of the
1860 ADDE are zero. Replacing one of the operands of the ADDE with the other operand
1861 of the ADD, and replacing the ADD with the ADDE, should give the desired result.
1863 (That said, we are doing a lot better than gcc on this testcase. :) )
1865 //===---------------------------------------------------------------------===//
1867 Switch lowering generates less than ideal code for the following switch:
1868 define void @a(i32 %x) nounwind {
1870 switch i32 %x, label %if.end [
1871 i32 0, label %if.then
1872 i32 1, label %if.then
1873 i32 2, label %if.then
1874 i32 3, label %if.then
1875 i32 5, label %if.then
1878 tail call void @foo() nounwind
1885 Generated code on x86-64 (other platforms give similar results):
1898 The movl+movl+btq+jb could be simplified to a cmpl+jne.
1900 Or, if we wanted to be really clever, we could simplify the whole thing to
1901 something like the following, which eliminates a branch:
1908 //===---------------------------------------------------------------------===//
1909 Given a branch where the two target blocks are identical ("ret i32 %b" in
1910 both), simplifycfg will simplify them away. But not so for a switch statement:
1912 define i32 @f(i32 %a, i32 %b) nounwind readnone {
1914 switch i32 %a, label %bb3 [
1919 bb: ; preds = %entry, %entry
1922 bb3: ; preds = %entry
1925 //===---------------------------------------------------------------------===//
1927 clang -O3 fails to devirtualize this virtual inheritance case: (GCC PR45875)
1928 Looks related to PR3100
1932 virtual void foo ();
1934 struct c11 : c10, c1{
1937 struct c28 : virtual c11{
1946 //===---------------------------------------------------------------------===//
1950 int foo(int a) { return (a & (~15)) / 16; }
1954 define i32 @foo(i32 %a) nounwind readnone ssp {
1956 %and = and i32 %a, -16
1957 %div = sdiv i32 %and, 16
1961 but this code (X & -A)/A is X >> log2(A) when A is a power of 2, so this case
1962 should be instcombined into just "a >> 4".
1964 We do get this at the codegen level, so something knows about it, but
1965 instcombine should catch it earlier:
1973 //===---------------------------------------------------------------------===//
1975 This code (from GCC PR28685):
1977 int test(int a, int b) {
1987 define i32 @test(i32 %a, i32 %b) nounwind readnone ssp {
1989 %cmp = icmp slt i32 %a, %b
1990 br i1 %cmp, label %return, label %if.end
1992 if.end: ; preds = %entry
1993 %cmp5 = icmp eq i32 %a, %b
1994 %conv6 = zext i1 %cmp5 to i32
1997 return: ; preds = %entry
2003 define i32 @test__(i32 %a, i32 %b) nounwind readnone ssp {
2005 %0 = icmp sle i32 %a, %b
2006 %retval = zext i1 %0 to i32
2010 //===---------------------------------------------------------------------===//
2012 This code can be seen in viterbi:
2014 %64 = call noalias i8* @malloc(i64 %62) nounwind
2016 %67 = call i64 @llvm.objectsize.i64(i8* %64, i1 false) nounwind
2017 %68 = call i8* @__memset_chk(i8* %64, i32 0, i64 %62, i64 %67) nounwind
2019 llvm.objectsize.i64 should be taught about malloc/calloc, allowing it to
2020 fold to %62. This is a security win (overflows of malloc will get caught)
2021 and also a performance win by exposing more memsets to the optimizer.
2023 This occurs several times in viterbi.
2025 Note that this would change the semantics of @llvm.objectsize which by its
2026 current definition always folds to a constant. We also should make sure that
2027 we remove checking in code like
2029 char *p = malloc(strlen(s)+1);
2030 __strcpy_chk(p, s, __builtin_objectsize(p, 0));
2032 //===---------------------------------------------------------------------===//
2034 This code (from Benchmarks/Dhrystone/dry.c):
2036 define i32 @Func1(i32, i32) nounwind readnone optsize ssp {
2038 %sext = shl i32 %0, 24
2039 %conv = ashr i32 %sext, 24
2040 %sext6 = shl i32 %1, 24
2041 %conv4 = ashr i32 %sext6, 24
2042 %cmp = icmp eq i32 %conv, %conv4
2043 %. = select i1 %cmp, i32 10000, i32 0
2047 Should be simplified into something like:
2049 define i32 @Func1(i32, i32) nounwind readnone optsize ssp {
2051 %sext = shl i32 %0, 24
2052 %conv = and i32 %sext, 0xFF000000
2053 %sext6 = shl i32 %1, 24
2054 %conv4 = and i32 %sext6, 0xFF000000
2055 %cmp = icmp eq i32 %conv, %conv4
2056 %. = select i1 %cmp, i32 10000, i32 0
2062 define i32 @Func1(i32, i32) nounwind readnone optsize ssp {
2064 %conv = and i32 %0, 0xFF
2065 %conv4 = and i32 %1, 0xFF
2066 %cmp = icmp eq i32 %conv, %conv4
2067 %. = select i1 %cmp, i32 10000, i32 0
2070 //===---------------------------------------------------------------------===//
2072 clang -O3 currently compiles this code
2074 int g(unsigned int a) {
2075 unsigned int c[100];
2078 unsigned int b = c[10] + c[11];
2086 define i32 @g(i32 a) nounwind readnone {
2087 %add = shl i32 %a, 1
2088 %mul = shl i32 %a, 1
2089 %cmp = icmp ugt i32 %add, %mul
2090 %a.addr.0 = select i1 %cmp, i32 11, i32 15
2094 The icmp should fold to false. This CSE opportunity is only available
2095 after GVN and InstCombine have run.
2097 //===---------------------------------------------------------------------===//
2099 memcpyopt should turn this:
2101 define i8* @test10(i32 %x) {
2102 %alloc = call noalias i8* @malloc(i32 %x) nounwind
2103 call void @llvm.memset.p0i8.i32(i8* %alloc, i8 0, i32 %x, i32 1, i1 false)
2107 into a call to calloc. We should make sure that we analyze calloc as
2108 aggressively as malloc though.
2110 //===---------------------------------------------------------------------===//
2112 clang -03 currently compiles this code
2114 void f1(int* begin, int* end) {
2115 std::fill(begin, end, 0);
2120 define void @_Z2f1PiS_(i32* %begin, i32* %end) nounwind {
2122 %cmp7.i.i = icmp eq i32* %begin, %end
2123 br i1 %cmp7.i.i, label %_ZSt4fillIPiiEvT_S1_RKT0_.exit, label %for.body.i.i
2125 for.body.i.i: ; preds = %entry, %for.body.i.i
2126 %indvar.i.i = phi i64 [ %tmp, %for.body.i.i ], [ 0, %entry ]
2127 %tmp = add i64 %indvar.i.i, 1
2128 %ptrincdec.i.i = getelementptr i32* %begin, i64 %tmp
2129 %__first.addr.08.i.i = getelementptr i32* %begin, i64 %indvar.i.i
2130 store i32 0, i32* %__first.addr.08.i.i, align 4, !tbaa !0
2131 %cmp.i.i = icmp eq i32* %ptrincdec.i.i, %end
2132 br i1 %cmp.i.i, label %_ZSt4fillIPiiEvT_S1_RKT0_.exit, label %for.body.i.i
2134 _ZSt4fillIPiiEvT_S1_RKT0_.exit: ; preds = %for.body.i.i, %entry
2138 It should compile it to a memset.
2140 //===---------------------------------------------------------------------===//
2142 clang -O3 -fno-exceptions currently compiles this code:
2145 std::vector<int> v(N);
2147 extern void sink(void*); sink(&v);
2152 define void @_Z1fi(i32 %N) nounwind {
2154 %v2 = alloca [3 x i32*], align 8
2155 %v2.sub = getelementptr inbounds [3 x i32*]* %v2, i64 0, i64 0
2156 %tmpcast = bitcast [3 x i32*]* %v2 to %"class.std::vector"*
2157 %conv = sext i32 %N to i64
2158 store i32* null, i32** %v2.sub, align 8, !tbaa !0
2159 %tmp3.i.i.i.i.i = getelementptr inbounds [3 x i32*]* %v2, i64 0, i64 1
2160 store i32* null, i32** %tmp3.i.i.i.i.i, align 8, !tbaa !0
2161 %tmp4.i.i.i.i.i = getelementptr inbounds [3 x i32*]* %v2, i64 0, i64 2
2162 store i32* null, i32** %tmp4.i.i.i.i.i, align 8, !tbaa !0
2163 %cmp.i.i.i.i = icmp eq i32 %N, 0
2164 br i1 %cmp.i.i.i.i, label %_ZNSt12_Vector_baseIiSaIiEEC2EmRKS0_.exit.thread.i.i, label %cond.true.i.i.i.i
2166 _ZNSt12_Vector_baseIiSaIiEEC2EmRKS0_.exit.thread.i.i: ; preds = %entry
2167 store i32* null, i32** %v2.sub, align 8, !tbaa !0
2168 store i32* null, i32** %tmp3.i.i.i.i.i, align 8, !tbaa !0
2169 %add.ptr.i5.i.i = getelementptr inbounds i32* null, i64 %conv
2170 store i32* %add.ptr.i5.i.i, i32** %tmp4.i.i.i.i.i, align 8, !tbaa !0
2171 br label %_ZNSt6vectorIiSaIiEEC1EmRKiRKS0_.exit
2173 cond.true.i.i.i.i: ; preds = %entry
2174 %cmp.i.i.i.i.i = icmp slt i32 %N, 0
2175 br i1 %cmp.i.i.i.i.i, label %if.then.i.i.i.i.i, label %_ZNSt12_Vector_baseIiSaIiEEC2EmRKS0_.exit.i.i
2177 if.then.i.i.i.i.i: ; preds = %cond.true.i.i.i.i
2178 call void @_ZSt17__throw_bad_allocv() noreturn nounwind
2181 _ZNSt12_Vector_baseIiSaIiEEC2EmRKS0_.exit.i.i: ; preds = %cond.true.i.i.i.i
2182 %mul.i.i.i.i.i = shl i64 %conv, 2
2183 %call3.i.i.i.i.i = call noalias i8* @_Znwm(i64 %mul.i.i.i.i.i) nounwind
2184 %0 = bitcast i8* %call3.i.i.i.i.i to i32*
2185 store i32* %0, i32** %v2.sub, align 8, !tbaa !0
2186 store i32* %0, i32** %tmp3.i.i.i.i.i, align 8, !tbaa !0
2187 %add.ptr.i.i.i = getelementptr inbounds i32* %0, i64 %conv
2188 store i32* %add.ptr.i.i.i, i32** %tmp4.i.i.i.i.i, align 8, !tbaa !0
2189 call void @llvm.memset.p0i8.i64(i8* %call3.i.i.i.i.i, i8 0, i64 %mul.i.i.i.i.i, i32 4, i1 false)
2190 br label %_ZNSt6vectorIiSaIiEEC1EmRKiRKS0_.exit
2192 This is just the handling the construction of the vector. Most surprising here
2193 is the fact that all three null stores in %entry are dead, but not eliminated.
2194 Also surprising is that %conv isn't simplified to 0 in %....exit.thread.i.i.
2196 //===---------------------------------------------------------------------===//
2198 clang -O3 -fno-exceptions currently compiles this code:
2201 std::vector<int> v(N);
2202 for (int k = 0; k < N; ++k)
2205 extern void sink(void*); sink(&v);
2208 into almost the same as the previous note, but replace its final BB with:
2210 for.body.lr.ph: ; preds = %cond.true.i.i.i.i
2211 %mul.i.i.i.i.i = shl i64 %conv, 2
2212 %call3.i.i.i.i.i = call noalias i8* @_Znwm(i64 %mul.i.i.i.i.i) nounwind
2213 %0 = bitcast i8* %call3.i.i.i.i.i to i32*
2214 store i32* %0, i32** %v8.sub, align 8, !tbaa !0
2215 %add.ptr.i.i.i = getelementptr inbounds i32* %0, i64 %conv
2216 store i32* %add.ptr.i.i.i, i32** %tmp4.i.i.i.i.i, align 8, !tbaa !0
2217 call void @llvm.memset.p0i8.i64(i8* %call3.i.i.i.i.i, i8 0, i64 %mul.i.i.i.i.i, i32 4, i1 false)
2218 store i32* %add.ptr.i.i.i, i32** %tmp3.i.i.i.i.i, align 8, !tbaa !0
2219 %tmp18 = add i32 %N, -1
2220 %tmp19 = zext i32 %tmp18 to i64
2221 %tmp20 = shl i64 %tmp19, 2
2222 %tmp21 = add i64 %tmp20, 4
2223 call void @llvm.memset.p0i8.i64(i8* %call3.i.i.i.i.i, i8 0, i64 %tmp21, i32 4, i1 false)
2226 First off, why (((zext %N - 1) << 2) + 4) instead of the ((sext %N) << 2) done
2227 previously? (or better yet, re-use that one?)
2229 Then, the really painful one is the second memset, of the same memory, to the
2232 //===---------------------------------------------------------------------===//
2234 clang -O3 -fno-exceptions currently compiles this code:
2237 unsigned short m1, m2;
2238 unsigned char m3, m4;
2242 std::vector<S> v(N);
2243 extern void sink(void*); sink(&v);
2246 into poor code for zero-initializing 'v' when N is >0. The problem is that
2247 S is only 6 bytes, but each element is 8 byte-aligned. We generate a loop and
2248 4 stores on each iteration. If the struct were 8 bytes, this gets turned into
2251 //===---------------------------------------------------------------------===//