1 Target Independent Opportunities:
3 //===---------------------------------------------------------------------===//
5 With the recent changes to make the implicit def/use set explicit in
6 machineinstrs, we should change the target descriptions for 'call' instructions
7 so that the .td files don't list all the call-clobbered registers as implicit
8 defs. Instead, these should be added by the code generator (e.g. on the dag).
10 This has a number of uses:
12 1. PPC32/64 and X86 32/64 can avoid having multiple copies of call instructions
13 for their different impdef sets.
14 2. Targets with multiple calling convs (e.g. x86) which have different clobber
15 sets don't need copies of call instructions.
16 3. 'Interprocedural register allocation' can be done to reduce the clobber sets
19 //===---------------------------------------------------------------------===//
21 We should recognized various "overflow detection" idioms and translate them into
22 llvm.uadd.with.overflow and similar intrinsics. Here is a multiply idiom:
24 unsigned int mul(unsigned int a,unsigned int b) {
25 if ((unsigned long long)a*b>0xffffffff)
30 The legalization code for mul-with-overflow needs to be made more robust before
31 this can be implemented though.
33 //===---------------------------------------------------------------------===//
35 Get the C front-end to expand hypot(x,y) -> llvm.sqrt(x*x+y*y) when errno and
36 precision don't matter (ffastmath). Misc/mandel will like this. :) This isn't
37 safe in general, even on darwin. See the libm implementation of hypot for
38 examples (which special case when x/y are exactly zero to get signed zeros etc
41 //===---------------------------------------------------------------------===//
43 On targets with expensive 64-bit multiply, we could LSR this:
50 for (i = ...; ++i, tmp+=tmp)
53 This would be a win on ppc32, but not x86 or ppc64.
55 //===---------------------------------------------------------------------===//
57 Shrink: (setlt (loadi32 P), 0) -> (setlt (loadi8 Phi), 0)
59 //===---------------------------------------------------------------------===//
61 Reassociate should turn things like:
63 int factorial(int X) {
64 return X*X*X*X*X*X*X*X;
67 into llvm.powi calls, allowing the code generator to produce balanced
70 First, the intrinsic needs to be extended to support integers, and second the
71 code generator needs to be enhanced to lower these to multiplication trees.
73 //===---------------------------------------------------------------------===//
75 Interesting? testcase for add/shift/mul reassoc:
77 int bar(int x, int y) {
78 return x*x*x+y+x*x*x*x*x*y*y*y*y;
80 int foo(int z, int n) {
81 return bar(z, n) + bar(2*z, 2*n);
84 This is blocked on not handling X*X*X -> powi(X, 3) (see note above). The issue
85 is that we end up getting t = 2*X s = t*t and don't turn this into 4*X*X,
86 which is the same number of multiplies and is canonical, because the 2*X has
87 multiple uses. Here's a simple example:
89 define i32 @test15(i32 %X1) {
90 %B = mul i32 %X1, 47 ; X1*47
96 //===---------------------------------------------------------------------===//
98 Reassociate should handle the example in GCC PR16157:
100 extern int a0, a1, a2, a3, a4; extern int b0, b1, b2, b3, b4;
101 void f () { /* this can be optimized to four additions... */
102 b4 = a4 + a3 + a2 + a1 + a0;
103 b3 = a3 + a2 + a1 + a0;
108 This requires reassociating to forms of expressions that are already available,
109 something that reassoc doesn't think about yet.
112 //===---------------------------------------------------------------------===//
114 This function: (derived from GCC PR19988)
115 double foo(double x, double y) {
116 return ((x + 0.1234 * y) * (x + -0.1234 * y));
122 mulsd LCPI1_1(%rip), %xmm1
123 mulsd LCPI1_0(%rip), %xmm2
130 Reassociate should be able to turn it into:
132 double foo(double x, double y) {
133 return ((x + 0.1234 * y) * (x - 0.1234 * y));
136 Which allows the multiply by constant to be CSE'd, producing:
139 mulsd LCPI1_0(%rip), %xmm1
146 This doesn't need -ffast-math support at all. This is particularly bad because
147 the llvm-gcc frontend is canonicalizing the later into the former, but clang
148 doesn't have this problem.
150 //===---------------------------------------------------------------------===//
152 These two functions should generate the same code on big-endian systems:
154 int g(int *j,int *l) { return memcmp(j,l,4); }
155 int h(int *j, int *l) { return *j - *l; }
157 this could be done in SelectionDAGISel.cpp, along with other special cases,
160 //===---------------------------------------------------------------------===//
162 It would be nice to revert this patch:
163 http://lists.cs.uiuc.edu/pipermail/llvm-commits/Week-of-Mon-20060213/031986.html
165 And teach the dag combiner enough to simplify the code expanded before
166 legalize. It seems plausible that this knowledge would let it simplify other
169 //===---------------------------------------------------------------------===//
171 For vector types, TargetData.cpp::getTypeInfo() returns alignment that is equal
172 to the type size. It works but can be overly conservative as the alignment of
173 specific vector types are target dependent.
175 //===---------------------------------------------------------------------===//
177 We should produce an unaligned load from code like this:
179 v4sf example(float *P) {
180 return (v4sf){P[0], P[1], P[2], P[3] };
183 //===---------------------------------------------------------------------===//
185 Add support for conditional increments, and other related patterns. Instead
190 je LBB16_2 #cond_next
201 //===---------------------------------------------------------------------===//
203 Combine: a = sin(x), b = cos(x) into a,b = sincos(x).
205 Expand these to calls of sin/cos and stores:
206 double sincos(double x, double *sin, double *cos);
207 float sincosf(float x, float *sin, float *cos);
208 long double sincosl(long double x, long double *sin, long double *cos);
210 Doing so could allow SROA of the destination pointers. See also:
211 http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17687
213 This is now easily doable with MRVs. We could even make an intrinsic for this
214 if anyone cared enough about sincos.
216 //===---------------------------------------------------------------------===//
218 quantum_sigma_x in 462.libquantum contains the following loop:
220 for(i=0; i<reg->size; i++)
222 /* Flip the target bit of each basis state */
223 reg->node[i].state ^= ((MAX_UNSIGNED) 1 << target);
226 Where MAX_UNSIGNED/state is a 64-bit int. On a 32-bit platform it would be just
227 so cool to turn it into something like:
229 long long Res = ((MAX_UNSIGNED) 1 << target);
231 for(i=0; i<reg->size; i++)
232 reg->node[i].state ^= Res & 0xFFFFFFFFULL;
234 for(i=0; i<reg->size; i++)
235 reg->node[i].state ^= Res & 0xFFFFFFFF00000000ULL
238 ... which would only do one 32-bit XOR per loop iteration instead of two.
240 It would also be nice to recognize the reg->size doesn't alias reg->node[i], but
243 //===---------------------------------------------------------------------===//
245 This isn't recognized as bswap by instcombine (yes, it really is bswap):
247 unsigned long reverse(unsigned v) {
249 t = v ^ ((v << 16) | (v >> 16));
251 v = (v << 24) | (v >> 8);
255 //===---------------------------------------------------------------------===//
259 We don't delete this output free loop, because trip count analysis doesn't
260 realize that it is finite (if it were infinite, it would be undefined). Not
261 having this blocks Loop Idiom from matching strlen and friends.
269 //===---------------------------------------------------------------------===//
273 These idioms should be recognized as popcount (see PR1488):
275 unsigned countbits_slow(unsigned v) {
277 for (c = 0; v; v >>= 1)
281 unsigned countbits_fast(unsigned v){
284 v &= v - 1; // clear the least significant bit set
288 BITBOARD = unsigned long long
289 int PopCnt(register BITBOARD a) {
297 unsigned int popcount(unsigned int input) {
298 unsigned int count = 0;
299 for (unsigned int i = 0; i < 4 * 8; i++)
300 count += (input >> i) & i;
304 This should be recognized as CLZ: rdar://8459039
306 unsigned clz_a(unsigned a) {
314 This sort of thing should be added to the loop idiom pass.
316 //===---------------------------------------------------------------------===//
318 These should turn into single 16-bit (unaligned?) loads on little/big endian
321 unsigned short read_16_le(const unsigned char *adr) {
322 return adr[0] | (adr[1] << 8);
324 unsigned short read_16_be(const unsigned char *adr) {
325 return (adr[0] << 8) | adr[1];
328 //===---------------------------------------------------------------------===//
330 -instcombine should handle this transform:
331 icmp pred (sdiv X / C1 ), C2
332 when X, C1, and C2 are unsigned. Similarly for udiv and signed operands.
334 Currently InstCombine avoids this transform but will do it when the signs of
335 the operands and the sign of the divide match. See the FIXME in
336 InstructionCombining.cpp in the visitSetCondInst method after the switch case
337 for Instruction::UDiv (around line 4447) for more details.
339 The SingleSource/Benchmarks/Shootout-C++/hash and hash2 tests have examples of
342 //===---------------------------------------------------------------------===//
346 SingleSource/Benchmarks/Misc/dt.c shows several interesting optimization
347 opportunities in its double_array_divs_variable function: it needs loop
348 interchange, memory promotion (which LICM already does), vectorization and
349 variable trip count loop unrolling (since it has a constant trip count). ICC
350 apparently produces this very nice code with -ffast-math:
352 ..B1.70: # Preds ..B1.70 ..B1.69
353 mulpd %xmm0, %xmm1 #108.2
354 mulpd %xmm0, %xmm1 #108.2
355 mulpd %xmm0, %xmm1 #108.2
356 mulpd %xmm0, %xmm1 #108.2
358 cmpl $131072, %edx #108.2
359 jb ..B1.70 # Prob 99% #108.2
361 It would be better to count down to zero, but this is a lot better than what we
364 //===---------------------------------------------------------------------===//
368 typedef unsigned U32;
369 typedef unsigned long long U64;
370 int test (U32 *inst, U64 *regs) {
373 int r1 = (temp >> 20) & 0xf;
374 int b2 = (temp >> 16) & 0xf;
375 effective_addr2 = temp & 0xfff;
376 if (b2) effective_addr2 += regs[b2];
377 b2 = (temp >> 12) & 0xf;
378 if (b2) effective_addr2 += regs[b2];
379 effective_addr2 &= regs[4];
380 if ((effective_addr2 & 3) == 0)
385 Note that only the low 2 bits of effective_addr2 are used. On 32-bit systems,
386 we don't eliminate the computation of the top half of effective_addr2 because
387 we don't have whole-function selection dags. On x86, this means we use one
388 extra register for the function when effective_addr2 is declared as U64 than
389 when it is declared U32.
391 PHI Slicing could be extended to do this.
393 //===---------------------------------------------------------------------===//
395 Tail call elim should be more aggressive, checking to see if the call is
396 followed by an uncond branch to an exit block.
398 ; This testcase is due to tail-duplication not wanting to copy the return
399 ; instruction into the terminating blocks because there was other code
400 ; optimized out of the function after the taildup happened.
401 ; RUN: llvm-as < %s | opt -tailcallelim | llvm-dis | not grep call
403 define i32 @t4(i32 %a) {
405 %tmp.1 = and i32 %a, 1 ; <i32> [#uses=1]
406 %tmp.2 = icmp ne i32 %tmp.1, 0 ; <i1> [#uses=1]
407 br i1 %tmp.2, label %then.0, label %else.0
409 then.0: ; preds = %entry
410 %tmp.5 = add i32 %a, -1 ; <i32> [#uses=1]
411 %tmp.3 = call i32 @t4( i32 %tmp.5 ) ; <i32> [#uses=1]
414 else.0: ; preds = %entry
415 %tmp.7 = icmp ne i32 %a, 0 ; <i1> [#uses=1]
416 br i1 %tmp.7, label %then.1, label %return
418 then.1: ; preds = %else.0
419 %tmp.11 = add i32 %a, -2 ; <i32> [#uses=1]
420 %tmp.9 = call i32 @t4( i32 %tmp.11 ) ; <i32> [#uses=1]
423 return: ; preds = %then.1, %else.0, %then.0
424 %result.0 = phi i32 [ 0, %else.0 ], [ %tmp.3, %then.0 ],
429 //===---------------------------------------------------------------------===//
431 Tail recursion elimination should handle:
436 return 2 * pow2m1 (n - 1) + 1;
439 Also, multiplies can be turned into SHL's, so they should be handled as if
440 they were associative. "return foo() << 1" can be tail recursion eliminated.
442 //===---------------------------------------------------------------------===//
444 Argument promotion should promote arguments for recursive functions, like
447 ; RUN: llvm-as < %s | opt -argpromotion | llvm-dis | grep x.val
449 define internal i32 @foo(i32* %x) {
451 %tmp = load i32* %x ; <i32> [#uses=0]
452 %tmp.foo = call i32 @foo( i32* %x ) ; <i32> [#uses=1]
456 define i32 @bar(i32* %x) {
458 %tmp3 = call i32 @foo( i32* %x ) ; <i32> [#uses=1]
462 //===---------------------------------------------------------------------===//
464 We should investigate an instruction sinking pass. Consider this silly
480 je LBB1_2 # cond_true
488 The PIC base computation (call+popl) is only used on one path through the
489 code, but is currently always computed in the entry block. It would be
490 better to sink the picbase computation down into the block for the
491 assertion, as it is the only one that uses it. This happens for a lot of
492 code with early outs.
494 Another example is loads of arguments, which are usually emitted into the
495 entry block on targets like x86. If not used in all paths through a
496 function, they should be sunk into the ones that do.
498 In this case, whole-function-isel would also handle this.
500 //===---------------------------------------------------------------------===//
502 Investigate lowering of sparse switch statements into perfect hash tables:
503 http://burtleburtle.net/bob/hash/perfect.html
505 //===---------------------------------------------------------------------===//
507 We should turn things like "load+fabs+store" and "load+fneg+store" into the
508 corresponding integer operations. On a yonah, this loop:
513 for (b = 0; b < 10000000; b++)
514 for (i = 0; i < 256; i++)
518 is twice as slow as this loop:
523 for (b = 0; b < 10000000; b++)
524 for (i = 0; i < 256; i++)
525 a[i] ^= (1ULL << 63);
528 and I suspect other processors are similar. On X86 in particular this is a
529 big win because doing this with integers allows the use of read/modify/write
532 //===---------------------------------------------------------------------===//
534 DAG Combiner should try to combine small loads into larger loads when
535 profitable. For example, we compile this C++ example:
537 struct THotKey { short Key; bool Control; bool Shift; bool Alt; };
538 extern THotKey m_HotKey;
539 THotKey GetHotKey () { return m_HotKey; }
541 into (-m64 -O3 -fno-exceptions -static -fomit-frame-pointer):
543 __Z9GetHotKeyv: ## @_Z9GetHotKeyv
544 movq _m_HotKey@GOTPCREL(%rip), %rax
557 //===---------------------------------------------------------------------===//
559 We should add an FRINT node to the DAG to model targets that have legal
560 implementations of ceil/floor/rint.
562 //===---------------------------------------------------------------------===//
567 long long input[8] = {1,0,1,0,1,0,1,0};
571 Clang compiles this into:
573 call void @llvm.memset.p0i8.i64(i8* %tmp, i8 0, i64 64, i32 16, i1 false)
574 %0 = getelementptr [8 x i64]* %input, i64 0, i64 0
575 store i64 1, i64* %0, align 16
576 %1 = getelementptr [8 x i64]* %input, i64 0, i64 2
577 store i64 1, i64* %1, align 16
578 %2 = getelementptr [8 x i64]* %input, i64 0, i64 4
579 store i64 1, i64* %2, align 16
580 %3 = getelementptr [8 x i64]* %input, i64 0, i64 6
581 store i64 1, i64* %3, align 16
583 Which gets codegen'd into:
586 movaps %xmm0, -16(%rbp)
587 movaps %xmm0, -32(%rbp)
588 movaps %xmm0, -48(%rbp)
589 movaps %xmm0, -64(%rbp)
595 It would be better to have 4 movq's of 0 instead of the movaps's.
597 //===---------------------------------------------------------------------===//
599 http://llvm.org/PR717:
601 The following code should compile into "ret int undef". Instead, LLVM
602 produces "ret int 0":
611 //===---------------------------------------------------------------------===//
613 The loop unroller should partially unroll loops (instead of peeling them)
614 when code growth isn't too bad and when an unroll count allows simplification
615 of some code within the loop. One trivial example is:
621 for ( nLoop = 0; nLoop < 1000; nLoop++ ) {
630 Unrolling by 2 would eliminate the '&1' in both copies, leading to a net
631 reduction in code size. The resultant code would then also be suitable for
632 exit value computation.
634 //===---------------------------------------------------------------------===//
636 We miss a bunch of rotate opportunities on various targets, including ppc, x86,
637 etc. On X86, we miss a bunch of 'rotate by variable' cases because the rotate
638 matching code in dag combine doesn't look through truncates aggressively
639 enough. Here are some testcases reduces from GCC PR17886:
641 unsigned long long f5(unsigned long long x, unsigned long long y) {
642 return (x << 8) | ((y >> 48) & 0xffull);
644 unsigned long long f6(unsigned long long x, unsigned long long y, int z) {
647 return (x << 8) | ((y >> 48) & 0xffull);
649 return (x << 16) | ((y >> 40) & 0xffffull);
651 return (x << 24) | ((y >> 32) & 0xffffffull);
653 return (x << 32) | ((y >> 24) & 0xffffffffull);
655 return (x << 40) | ((y >> 16) & 0xffffffffffull);
659 //===---------------------------------------------------------------------===//
661 This (and similar related idioms):
663 unsigned int foo(unsigned char i) {
664 return i | (i<<8) | (i<<16) | (i<<24);
669 define i32 @foo(i8 zeroext %i) nounwind readnone ssp noredzone {
671 %conv = zext i8 %i to i32
672 %shl = shl i32 %conv, 8
673 %shl5 = shl i32 %conv, 16
674 %shl9 = shl i32 %conv, 24
675 %or = or i32 %shl9, %conv
676 %or6 = or i32 %or, %shl5
677 %or10 = or i32 %or6, %shl
681 it would be better as:
683 unsigned int bar(unsigned char i) {
684 unsigned int j=i | (i << 8);
690 define i32 @bar(i8 zeroext %i) nounwind readnone ssp noredzone {
692 %conv = zext i8 %i to i32
693 %shl = shl i32 %conv, 8
694 %or = or i32 %shl, %conv
695 %shl5 = shl i32 %or, 16
696 %or6 = or i32 %shl5, %or
700 or even i*0x01010101, depending on the speed of the multiplier. The best way to
701 handle this is to canonicalize it to a multiply in IR and have codegen handle
702 lowering multiplies to shifts on cpus where shifts are faster.
704 //===---------------------------------------------------------------------===//
706 We do a number of simplifications in simplify libcalls to strength reduce
707 standard library functions, but we don't currently merge them together. For
708 example, it is useful to merge memcpy(a,b,strlen(b)) -> strcpy. This can only
709 be done safely if "b" isn't modified between the strlen and memcpy of course.
711 //===---------------------------------------------------------------------===//
713 We compile this program: (from GCC PR11680)
714 http://gcc.gnu.org/bugzilla/attachment.cgi?id=4487
716 Into code that runs the same speed in fast/slow modes, but both modes run 2x
717 slower than when compile with GCC (either 4.0 or 4.2):
719 $ llvm-g++ perf.cpp -O3 -fno-exceptions
721 1.821u 0.003s 0:01.82 100.0% 0+0k 0+0io 0pf+0w
723 $ g++ perf.cpp -O3 -fno-exceptions
725 0.821u 0.001s 0:00.82 100.0% 0+0k 0+0io 0pf+0w
727 It looks like we are making the same inlining decisions, so this may be raw
728 codegen badness or something else (haven't investigated).
730 //===---------------------------------------------------------------------===//
732 Divisibility by constant can be simplified (according to GCC PR12849) from
733 being a mulhi to being a mul lo (cheaper). Testcase:
735 void bar(unsigned n) {
740 This is equivalent to the following, where 2863311531 is the multiplicative
741 inverse of 3, and 1431655766 is ((2^32)-1)/3+1:
742 void bar(unsigned n) {
743 if (n * 2863311531U < 1431655766U)
747 The same transformation can work with an even modulo with the addition of a
748 rotate: rotate the result of the multiply to the right by the number of bits
749 which need to be zero for the condition to be true, and shrink the compare RHS
750 by the same amount. Unless the target supports rotates, though, that
751 transformation probably isn't worthwhile.
753 The transformation can also easily be made to work with non-zero equality
754 comparisons: just transform, for example, "n % 3 == 1" to "(n-1) % 3 == 0".
756 //===---------------------------------------------------------------------===//
758 Better mod/ref analysis for scanf would allow us to eliminate the vtable and a
759 bunch of other stuff from this example (see PR1604):
769 std::scanf("%d", &t.val);
770 std::printf("%d\n", t.val);
773 //===---------------------------------------------------------------------===//
775 These functions perform the same computation, but produce different assembly.
777 define i8 @select(i8 %x) readnone nounwind {
778 %A = icmp ult i8 %x, 250
779 %B = select i1 %A, i8 0, i8 1
783 define i8 @addshr(i8 %x) readnone nounwind {
784 %A = zext i8 %x to i9
785 %B = add i9 %A, 6 ;; 256 - 250 == 6
787 %D = trunc i9 %C to i8
791 //===---------------------------------------------------------------------===//
795 f (unsigned long a, unsigned long b, unsigned long c)
797 return ((a & (c - 1)) != 0) || ((b & (c - 1)) != 0);
800 f (unsigned long a, unsigned long b, unsigned long c)
802 return ((a & (c - 1)) != 0) | ((b & (c - 1)) != 0);
804 Both should combine to ((a|b) & (c-1)) != 0. Currently not optimized with
805 "clang -emit-llvm-bc | opt -std-compile-opts".
807 //===---------------------------------------------------------------------===//
810 #define PMD_MASK (~((1UL << 23) - 1))
811 void clear_pmd_range(unsigned long start, unsigned long end)
813 if (!(start & ~PMD_MASK) && !(end & ~PMD_MASK))
816 The expression should optimize to something like
817 "!((start|end)&~PMD_MASK). Currently not optimized with "clang
818 -emit-llvm-bc | opt -std-compile-opts".
820 //===---------------------------------------------------------------------===//
822 unsigned int f(unsigned int i, unsigned int n) {++i; if (i == n) ++i; return
824 unsigned int f2(unsigned int i, unsigned int n) {++i; i += i == n; return i;}
825 These should combine to the same thing. Currently, the first function
826 produces better code on X86.
828 //===---------------------------------------------------------------------===//
831 #define abs(x) x>0?x:-x
834 return (abs(x)) >= 0;
836 This should optimize to x == INT_MIN. (With -fwrapv.) Currently not
837 optimized with "clang -emit-llvm-bc | opt -std-compile-opts".
839 //===---------------------------------------------------------------------===//
843 rotate_cst (unsigned int a)
845 a = (a << 10) | (a >> 22);
850 minus_cst (unsigned int a)
859 mask_gt (unsigned int a)
861 /* This is equivalent to a > 15. */
866 rshift_gt (unsigned int a)
868 /* This is equivalent to a > 23. */
873 All should simplify to a single comparison. All of these are
874 currently not optimized with "clang -emit-llvm-bc | opt
877 //===---------------------------------------------------------------------===//
880 int c(int* x) {return (char*)x+2 == (char*)x;}
881 Should combine to 0. Currently not optimized with "clang
882 -emit-llvm-bc | opt -std-compile-opts" (although llc can optimize it).
884 //===---------------------------------------------------------------------===//
886 int a(unsigned b) {return ((b << 31) | (b << 30)) >> 31;}
887 Should be combined to "((b >> 1) | b) & 1". Currently not optimized
888 with "clang -emit-llvm-bc | opt -std-compile-opts".
890 //===---------------------------------------------------------------------===//
892 unsigned a(unsigned x, unsigned y) { return x | (y & 1) | (y & 2);}
893 Should combine to "x | (y & 3)". Currently not optimized with "clang
894 -emit-llvm-bc | opt -std-compile-opts".
896 //===---------------------------------------------------------------------===//
898 int a(int a, int b, int c) {return (~a & c) | ((c|a) & b);}
899 Should fold to "(~a & c) | (a & b)". Currently not optimized with
900 "clang -emit-llvm-bc | opt -std-compile-opts".
902 //===---------------------------------------------------------------------===//
904 int a(int a,int b) {return (~(a|b))|a;}
905 Should fold to "a|~b". Currently not optimized with "clang
906 -emit-llvm-bc | opt -std-compile-opts".
908 //===---------------------------------------------------------------------===//
910 int a(int a, int b) {return (a&&b) || (a&&!b);}
911 Should fold to "a". Currently not optimized with "clang -emit-llvm-bc
912 | opt -std-compile-opts".
914 //===---------------------------------------------------------------------===//
916 int a(int a, int b, int c) {return (a&&b) || (!a&&c);}
917 Should fold to "a ? b : c", or at least something sane. Currently not
918 optimized with "clang -emit-llvm-bc | opt -std-compile-opts".
920 //===---------------------------------------------------------------------===//
922 int a(int a, int b, int c) {return (a&&b) || (a&&c) || (a&&b&&c);}
923 Should fold to a && (b || c). Currently not optimized with "clang
924 -emit-llvm-bc | opt -std-compile-opts".
926 //===---------------------------------------------------------------------===//
928 int a(int x) {return x | ((x & 8) ^ 8);}
929 Should combine to x | 8. Currently not optimized with "clang
930 -emit-llvm-bc | opt -std-compile-opts".
932 //===---------------------------------------------------------------------===//
934 int a(int x) {return x ^ ((x & 8) ^ 8);}
935 Should also combine to x | 8. Currently not optimized with "clang
936 -emit-llvm-bc | opt -std-compile-opts".
938 //===---------------------------------------------------------------------===//
940 int a(int x) {return ((x | -9) ^ 8) & x;}
941 Should combine to x & -9. Currently not optimized with "clang
942 -emit-llvm-bc | opt -std-compile-opts".
944 //===---------------------------------------------------------------------===//
946 unsigned a(unsigned a) {return a * 0x11111111 >> 28 & 1;}
947 Should combine to "a * 0x88888888 >> 31". Currently not optimized
948 with "clang -emit-llvm-bc | opt -std-compile-opts".
950 //===---------------------------------------------------------------------===//
952 unsigned a(char* x) {if ((*x & 32) == 0) return b();}
953 There's an unnecessary zext in the generated code with "clang
954 -emit-llvm-bc | opt -std-compile-opts".
956 //===---------------------------------------------------------------------===//
958 unsigned a(unsigned long long x) {return 40 * (x >> 1);}
959 Should combine to "20 * (((unsigned)x) & -2)". Currently not
960 optimized with "clang -emit-llvm-bc | opt -std-compile-opts".
962 //===---------------------------------------------------------------------===//
964 int g(int x) { return (x - 10) < 0; }
965 Should combine to "x <= 9" (the sub has nsw). Currently not
966 optimized with "clang -emit-llvm-bc | opt -std-compile-opts".
968 //===---------------------------------------------------------------------===//
970 int g(int x) { return (x + 10) < 0; }
971 Should combine to "x < -10" (the add has nsw). Currently not
972 optimized with "clang -emit-llvm-bc | opt -std-compile-opts".
974 //===---------------------------------------------------------------------===//
976 int f(int i, int j) { return i < j + 1; }
977 int g(int i, int j) { return j > i - 1; }
978 Should combine to "i <= j" (the add/sub has nsw). Currently not
979 optimized with "clang -emit-llvm-bc | opt -std-compile-opts".
981 //===---------------------------------------------------------------------===//
983 This was noticed in the entryblock for grokdeclarator in 403.gcc:
985 %tmp = icmp eq i32 %decl_context, 4
986 %decl_context_addr.0 = select i1 %tmp, i32 3, i32 %decl_context
987 %tmp1 = icmp eq i32 %decl_context_addr.0, 1
988 %decl_context_addr.1 = select i1 %tmp1, i32 0, i32 %decl_context_addr.0
990 tmp1 should be simplified to something like:
991 (!tmp || decl_context == 1)
993 This allows recursive simplifications, tmp1 is used all over the place in
994 the function, e.g. by:
996 %tmp23 = icmp eq i32 %decl_context_addr.1, 0 ; <i1> [#uses=1]
997 %tmp24 = xor i1 %tmp1, true ; <i1> [#uses=1]
998 %or.cond8 = and i1 %tmp23, %tmp24 ; <i1> [#uses=1]
1002 //===---------------------------------------------------------------------===//
1006 Store sinking: This code:
1008 void f (int n, int *cond, int *res) {
1011 for (i = 0; i < n; i++)
1013 *res ^= 234; /* (*) */
1016 On this function GVN hoists the fully redundant value of *res, but nothing
1017 moves the store out. This gives us this code:
1019 bb: ; preds = %bb2, %entry
1020 %.rle = phi i32 [ 0, %entry ], [ %.rle6, %bb2 ]
1021 %i.05 = phi i32 [ 0, %entry ], [ %indvar.next, %bb2 ]
1022 %1 = load i32* %cond, align 4
1023 %2 = icmp eq i32 %1, 0
1024 br i1 %2, label %bb2, label %bb1
1027 %3 = xor i32 %.rle, 234
1028 store i32 %3, i32* %res, align 4
1031 bb2: ; preds = %bb, %bb1
1032 %.rle6 = phi i32 [ %3, %bb1 ], [ %.rle, %bb ]
1033 %indvar.next = add i32 %i.05, 1
1034 %exitcond = icmp eq i32 %indvar.next, %n
1035 br i1 %exitcond, label %return, label %bb
1037 DSE should sink partially dead stores to get the store out of the loop.
1039 Here's another partial dead case:
1040 http://gcc.gnu.org/bugzilla/show_bug.cgi?id=12395
1042 //===---------------------------------------------------------------------===//
1044 Scalar PRE hoists the mul in the common block up to the else:
1046 int test (int a, int b, int c, int g) {
1056 It would be better to do the mul once to reduce codesize above the if.
1057 This is GCC PR38204.
1060 //===---------------------------------------------------------------------===//
1061 This simple function from 179.art:
1064 struct { double y; int reset; } *Y;
1069 for (i=0;i<numf2s;i++)
1070 if (Y[i].y > Y[winner].y)
1074 Compiles into (with clang TBAA):
1076 for.body: ; preds = %for.inc, %bb.nph
1077 %indvar = phi i64 [ 0, %bb.nph ], [ %indvar.next, %for.inc ]
1078 %i.01718 = phi i32 [ 0, %bb.nph ], [ %i.01719, %for.inc ]
1079 %tmp4 = getelementptr inbounds %struct.anon* %tmp3, i64 %indvar, i32 0
1080 %tmp5 = load double* %tmp4, align 8, !tbaa !4
1081 %idxprom7 = sext i32 %i.01718 to i64
1082 %tmp10 = getelementptr inbounds %struct.anon* %tmp3, i64 %idxprom7, i32 0
1083 %tmp11 = load double* %tmp10, align 8, !tbaa !4
1084 %cmp12 = fcmp ogt double %tmp5, %tmp11
1085 br i1 %cmp12, label %if.then, label %for.inc
1087 if.then: ; preds = %for.body
1088 %i.017 = trunc i64 %indvar to i32
1091 for.inc: ; preds = %for.body, %if.then
1092 %i.01719 = phi i32 [ %i.01718, %for.body ], [ %i.017, %if.then ]
1093 %indvar.next = add i64 %indvar, 1
1094 %exitcond = icmp eq i64 %indvar.next, %tmp22
1095 br i1 %exitcond, label %for.cond.for.end_crit_edge, label %for.body
1098 It is good that we hoisted the reloads of numf2's, and Y out of the loop and
1099 sunk the store to winner out.
1101 However, this is awful on several levels: the conditional truncate in the loop
1102 (-indvars at fault? why can't we completely promote the IV to i64?).
1104 Beyond that, we have a partially redundant load in the loop: if "winner" (aka
1105 %i.01718) isn't updated, we reload Y[winner].y the next time through the loop.
1106 Similarly, the addressing that feeds it (including the sext) is redundant. In
1107 the end we get this generated assembly:
1109 LBB0_2: ## %for.body
1110 ## =>This Inner Loop Header: Depth=1
1114 ucomisd (%rcx,%r8), %xmm0
1123 All things considered this isn't too bad, but we shouldn't need the movslq or
1124 the shlq instruction, or the load folded into ucomisd every time through the
1127 On an x86-specific topic, if the loop can't be restructure, the movl should be a
1130 //===---------------------------------------------------------------------===//
1134 GCC PR37810 is an interesting case where we should sink load/store reload
1135 into the if block and outside the loop, so we don't reload/store it on the
1156 We now hoist the reload after the call (Transforms/GVN/lpre-call-wrap.ll), but
1157 we don't sink the store. We need partially dead store sinking.
1159 //===---------------------------------------------------------------------===//
1161 [LOAD PRE CRIT EDGE SPLITTING]
1163 GCC PR37166: Sinking of loads prevents SROA'ing the "g" struct on the stack
1164 leading to excess stack traffic. This could be handled by GVN with some crazy
1165 symbolic phi translation. The code we get looks like (g is on the stack):
1169 %9 = getelementptr %struct.f* %g, i32 0, i32 0
1170 store i32 %8, i32* %9, align bel %bb3
1172 bb3: ; preds = %bb1, %bb2, %bb
1173 %c_addr.0 = phi %struct.f* [ %g, %bb2 ], [ %c, %bb ], [ %c, %bb1 ]
1174 %b_addr.0 = phi %struct.f* [ %b, %bb2 ], [ %g, %bb ], [ %b, %bb1 ]
1175 %10 = getelementptr %struct.f* %c_addr.0, i32 0, i32 0
1176 %11 = load i32* %10, align 4
1178 %11 is partially redundant, an in BB2 it should have the value %8.
1180 GCC PR33344 and PR35287 are similar cases.
1183 //===---------------------------------------------------------------------===//
1187 There are many load PRE testcases in testsuite/gcc.dg/tree-ssa/loadpre* in the
1188 GCC testsuite, ones we don't get yet are (checked through loadpre25):
1190 [CRIT EDGE BREAKING]
1191 loadpre3.c predcom-4.c
1193 [PRE OF READONLY CALL]
1196 [TURN SELECT INTO BRANCH]
1197 loadpre14.c loadpre15.c
1199 actually a conditional increment: loadpre18.c loadpre19.c
1201 //===---------------------------------------------------------------------===//
1203 [LOAD PRE / STORE SINKING / SPEC HACK]
1205 This is a chunk of code from 456.hmmer:
1207 int f(int M, int *mc, int *mpp, int *tpmm, int *ip, int *tpim, int *dpp,
1208 int *tpdm, int xmb, int *bp, int *ms) {
1210 for (k = 1; k <= M; k++) {
1211 mc[k] = mpp[k-1] + tpmm[k-1];
1212 if ((sc = ip[k-1] + tpim[k-1]) > mc[k]) mc[k] = sc;
1213 if ((sc = dpp[k-1] + tpdm[k-1]) > mc[k]) mc[k] = sc;
1214 if ((sc = xmb + bp[k]) > mc[k]) mc[k] = sc;
1219 It is very profitable for this benchmark to turn the conditional stores to mc[k]
1220 into a conditional move (select instr in IR) and allow the final store to do the
1221 store. See GCC PR27313 for more details. Note that this is valid to xform even
1222 with the new C++ memory model, since mc[k] is previously loaded and later
1225 //===---------------------------------------------------------------------===//
1228 There are many PRE testcases in testsuite/gcc.dg/tree-ssa/ssa-pre-*.c in the
1231 //===---------------------------------------------------------------------===//
1233 There are some interesting cases in testsuite/gcc.dg/tree-ssa/pred-comm* in the
1234 GCC testsuite. For example, we get the first example in predcom-1.c, but
1235 miss the second one:
1240 __attribute__ ((noinline))
1241 void count_averages(int n) {
1243 for (i = 1; i < n; i++)
1244 avg[i] = (((unsigned long) fib[i - 1] + fib[i] + fib[i + 1]) / 3) & 0xffff;
1247 which compiles into two loads instead of one in the loop.
1249 predcom-2.c is the same as predcom-1.c
1251 predcom-3.c is very similar but needs loads feeding each other instead of
1255 //===---------------------------------------------------------------------===//
1259 Type based alias analysis:
1260 http://gcc.gnu.org/bugzilla/show_bug.cgi?id=14705
1262 We should do better analysis of posix_memalign. At the least it should
1263 no-capture its pointer argument, at best, we should know that the out-value
1264 result doesn't point to anything (like malloc). One example of this is in
1265 SingleSource/Benchmarks/Misc/dt.c
1267 //===---------------------------------------------------------------------===//
1269 Interesting missed case because of control flow flattening (should be 2 loads):
1270 http://gcc.gnu.org/bugzilla/show_bug.cgi?id=26629
1271 With: llvm-gcc t2.c -S -o - -O0 -emit-llvm | llvm-as |
1272 opt -mem2reg -gvn -instcombine | llvm-dis
1273 we miss it because we need 1) CRIT EDGE 2) MULTIPLE DIFFERENT
1274 VALS PRODUCED BY ONE BLOCK OVER DIFFERENT PATHS
1276 //===---------------------------------------------------------------------===//
1278 http://gcc.gnu.org/bugzilla/show_bug.cgi?id=19633
1279 We could eliminate the branch condition here, loading from null is undefined:
1281 struct S { int w, x, y, z; };
1282 struct T { int r; struct S s; };
1283 void bar (struct S, int);
1284 void foo (int a, struct T b)
1292 //===---------------------------------------------------------------------===//
1294 simplifylibcalls should do several optimizations for strspn/strcspn:
1296 strcspn(x, "a") -> inlined loop for up to 3 letters (similarly for strspn):
1298 size_t __strcspn_c3 (__const char *__s, int __reject1, int __reject2,
1300 register size_t __result = 0;
1301 while (__s[__result] != '\0' && __s[__result] != __reject1 &&
1302 __s[__result] != __reject2 && __s[__result] != __reject3)
1307 This should turn into a switch on the character. See PR3253 for some notes on
1310 456.hmmer apparently uses strcspn and strspn a lot. 471.omnetpp uses strspn.
1312 //===---------------------------------------------------------------------===//
1314 simplifylibcalls should turn these snprintf idioms into memcpy (GCC PR47917)
1316 char buf1[6], buf2[6], buf3[4], buf4[4];
1320 int ret = snprintf (buf1, sizeof buf1, "abcde");
1321 ret += snprintf (buf2, sizeof buf2, "abcdef") * 16;
1322 ret += snprintf (buf3, sizeof buf3, "%s", i++ < 6 ? "abc" : "def") * 256;
1323 ret += snprintf (buf4, sizeof buf4, "%s", i++ > 10 ? "abcde" : "defgh")*4096;
1327 //===---------------------------------------------------------------------===//
1329 "gas" uses this idiom:
1330 else if (strchr ("+-/*%|&^:[]()~", *intel_parser.op_string))
1332 else if (strchr ("<>", *intel_parser.op_string)
1334 Those should be turned into a switch.
1336 //===---------------------------------------------------------------------===//
1338 252.eon contains this interesting code:
1340 %3072 = getelementptr [100 x i8]* %tempString, i32 0, i32 0
1341 %3073 = call i8* @strcpy(i8* %3072, i8* %3071) nounwind
1342 %strlen = call i32 @strlen(i8* %3072) ; uses = 1
1343 %endptr = getelementptr [100 x i8]* %tempString, i32 0, i32 %strlen
1344 call void @llvm.memcpy.i32(i8* %endptr,
1345 i8* getelementptr ([5 x i8]* @"\01LC42", i32 0, i32 0), i32 5, i32 1)
1346 %3074 = call i32 @strlen(i8* %endptr) nounwind readonly
1348 This is interesting for a couple reasons. First, in this:
1350 The memcpy+strlen strlen can be replaced with:
1352 %3074 = call i32 @strlen([5 x i8]* @"\01LC42") nounwind readonly
1354 Because the destination was just copied into the specified memory buffer. This,
1355 in turn, can be constant folded to "4".
1357 In other code, it contains:
1359 %endptr6978 = bitcast i8* %endptr69 to i32*
1360 store i32 7107374, i32* %endptr6978, align 1
1361 %3167 = call i32 @strlen(i8* %endptr69) nounwind readonly
1363 Which could also be constant folded. Whatever is producing this should probably
1364 be fixed to leave this as a memcpy from a string.
1366 Further, eon also has an interesting partially redundant strlen call:
1368 bb8: ; preds = %_ZN18eonImageCalculatorC1Ev.exit
1369 %682 = getelementptr i8** %argv, i32 6 ; <i8**> [#uses=2]
1370 %683 = load i8** %682, align 4 ; <i8*> [#uses=4]
1371 %684 = load i8* %683, align 1 ; <i8> [#uses=1]
1372 %685 = icmp eq i8 %684, 0 ; <i1> [#uses=1]
1373 br i1 %685, label %bb10, label %bb9
1376 %686 = call i32 @strlen(i8* %683) nounwind readonly
1377 %687 = icmp ugt i32 %686, 254 ; <i1> [#uses=1]
1378 br i1 %687, label %bb10, label %bb11
1380 bb10: ; preds = %bb9, %bb8
1381 %688 = call i32 @strlen(i8* %683) nounwind readonly
1383 This could be eliminated by doing the strlen once in bb8, saving code size and
1384 improving perf on the bb8->9->10 path.
1386 //===---------------------------------------------------------------------===//
1388 I see an interesting fully redundant call to strlen left in 186.crafty:InputMove
1390 %movetext11 = getelementptr [128 x i8]* %movetext, i32 0, i32 0
1393 bb62: ; preds = %bb55, %bb53
1394 %promote.0 = phi i32 [ %169, %bb55 ], [ 0, %bb53 ]
1395 %171 = call i32 @strlen(i8* %movetext11) nounwind readonly align 1
1396 %172 = add i32 %171, -1 ; <i32> [#uses=1]
1397 %173 = getelementptr [128 x i8]* %movetext, i32 0, i32 %172
1400 br i1 %or.cond, label %bb65, label %bb72
1402 bb65: ; preds = %bb62
1403 store i8 0, i8* %173, align 1
1406 bb72: ; preds = %bb65, %bb62
1407 %trank.1 = phi i32 [ %176, %bb65 ], [ -1, %bb62 ]
1408 %177 = call i32 @strlen(i8* %movetext11) nounwind readonly align 1
1410 Note that on the bb62->bb72 path, that the %177 strlen call is partially
1411 redundant with the %171 call. At worst, we could shove the %177 strlen call
1412 up into the bb65 block moving it out of the bb62->bb72 path. However, note
1413 that bb65 stores to the string, zeroing out the last byte. This means that on
1414 that path the value of %177 is actually just %171-1. A sub is cheaper than a
1417 This pattern repeats several times, basically doing:
1422 where it is "obvious" that B = A-1.
1424 //===---------------------------------------------------------------------===//
1426 186.crafty has this interesting pattern with the "out.4543" variable:
1428 call void @llvm.memcpy.i32(
1429 i8* getelementptr ([10 x i8]* @out.4543, i32 0, i32 0),
1430 i8* getelementptr ([7 x i8]* @"\01LC28700", i32 0, i32 0), i32 7, i32 1)
1431 %101 = call@printf(i8* ... @out.4543, i32 0, i32 0)) nounwind
1433 It is basically doing:
1435 memcpy(globalarray, "string");
1436 printf(..., globalarray);
1438 Anyway, by knowing that printf just reads the memory and forward substituting
1439 the string directly into the printf, this eliminates reads from globalarray.
1440 Since this pattern occurs frequently in crafty (due to the "DisplayTime" and
1441 other similar functions) there are many stores to "out". Once all the printfs
1442 stop using "out", all that is left is the memcpy's into it. This should allow
1443 globalopt to remove the "stored only" global.
1445 //===---------------------------------------------------------------------===//
1449 define inreg i32 @foo(i8* inreg %p) nounwind {
1451 %tmp1 = ashr i8 %tmp0, 5
1452 %tmp2 = sext i8 %tmp1 to i32
1456 could be dagcombine'd to a sign-extending load with a shift.
1457 For example, on x86 this currently gets this:
1463 while it could get this:
1468 //===---------------------------------------------------------------------===//
1472 int test(int x) { return 1-x == x; } // --> return false
1473 int test2(int x) { return 2-x == x; } // --> return x == 1 ?
1475 Always foldable for odd constants, what is the rule for even?
1477 //===---------------------------------------------------------------------===//
1479 PR 3381: GEP to field of size 0 inside a struct could be turned into GEP
1480 for next field in struct (which is at same address).
1482 For example: store of float into { {{}}, float } could be turned into a store to
1485 //===---------------------------------------------------------------------===//
1487 The arg promotion pass should make use of nocapture to make its alias analysis
1488 stuff much more precise.
1490 //===---------------------------------------------------------------------===//
1492 The following functions should be optimized to use a select instead of a
1493 branch (from gcc PR40072):
1495 char char_int(int m) {if(m>7) return 0; return m;}
1496 int int_char(char m) {if(m>7) return 0; return m;}
1498 //===---------------------------------------------------------------------===//
1500 int func(int a, int b) { if (a & 0x80) b |= 0x80; else b &= ~0x80; return b; }
1504 define i32 @func(i32 %a, i32 %b) nounwind readnone ssp {
1506 %0 = and i32 %a, 128 ; <i32> [#uses=1]
1507 %1 = icmp eq i32 %0, 0 ; <i1> [#uses=1]
1508 %2 = or i32 %b, 128 ; <i32> [#uses=1]
1509 %3 = and i32 %b, -129 ; <i32> [#uses=1]
1510 %b_addr.0 = select i1 %1, i32 %3, i32 %2 ; <i32> [#uses=1]
1514 However, it's functionally equivalent to:
1516 b = (b & ~0x80) | (a & 0x80);
1518 Which generates this:
1520 define i32 @func(i32 %a, i32 %b) nounwind readnone ssp {
1522 %0 = and i32 %b, -129 ; <i32> [#uses=1]
1523 %1 = and i32 %a, 128 ; <i32> [#uses=1]
1524 %2 = or i32 %0, %1 ; <i32> [#uses=1]
1528 This can be generalized for other forms:
1530 b = (b & ~0x80) | (a & 0x40) << 1;
1532 //===---------------------------------------------------------------------===//
1534 These two functions produce different code. They shouldn't:
1538 uint8_t p1(uint8_t b, uint8_t a) {
1539 b = (b & ~0xc0) | (a & 0xc0);
1543 uint8_t p2(uint8_t b, uint8_t a) {
1544 b = (b & ~0x40) | (a & 0x40);
1545 b = (b & ~0x80) | (a & 0x80);
1549 define zeroext i8 @p1(i8 zeroext %b, i8 zeroext %a) nounwind readnone ssp {
1551 %0 = and i8 %b, 63 ; <i8> [#uses=1]
1552 %1 = and i8 %a, -64 ; <i8> [#uses=1]
1553 %2 = or i8 %1, %0 ; <i8> [#uses=1]
1557 define zeroext i8 @p2(i8 zeroext %b, i8 zeroext %a) nounwind readnone ssp {
1559 %0 = and i8 %b, 63 ; <i8> [#uses=1]
1560 %.masked = and i8 %a, 64 ; <i8> [#uses=1]
1561 %1 = and i8 %a, -128 ; <i8> [#uses=1]
1562 %2 = or i8 %1, %0 ; <i8> [#uses=1]
1563 %3 = or i8 %2, %.masked ; <i8> [#uses=1]
1567 //===---------------------------------------------------------------------===//
1569 IPSCCP does not currently propagate argument dependent constants through
1570 functions where it does not not all of the callers. This includes functions
1571 with normal external linkage as well as templates, C99 inline functions etc.
1572 Specifically, it does nothing to:
1574 define i32 @test(i32 %x, i32 %y, i32 %z) nounwind {
1576 %0 = add nsw i32 %y, %z
1579 %3 = add nsw i32 %1, %2
1583 define i32 @test2() nounwind {
1585 %0 = call i32 @test(i32 1, i32 2, i32 4) nounwind
1589 It would be interesting extend IPSCCP to be able to handle simple cases like
1590 this, where all of the arguments to a call are constant. Because IPSCCP runs
1591 before inlining, trivial templates and inline functions are not yet inlined.
1592 The results for a function + set of constant arguments should be memoized in a
1595 //===---------------------------------------------------------------------===//
1597 The libcall constant folding stuff should be moved out of SimplifyLibcalls into
1598 libanalysis' constantfolding logic. This would allow IPSCCP to be able to
1599 handle simple things like this:
1601 static int foo(const char *X) { return strlen(X); }
1602 int bar() { return foo("abcd"); }
1604 //===---------------------------------------------------------------------===//
1606 functionattrs doesn't know much about memcpy/memset. This function should be
1607 marked readnone rather than readonly, since it only twiddles local memory, but
1608 functionattrs doesn't handle memset/memcpy/memmove aggressively:
1610 struct X { int *p; int *q; };
1617 p = __builtin_memcpy (&x, &y, sizeof (int *));
1621 This can be seen at:
1622 $ clang t.c -S -o - -mkernel -O0 -emit-llvm | opt -functionattrs -S
1625 //===---------------------------------------------------------------------===//
1627 Missed instcombine transformation:
1628 define i1 @a(i32 %x) nounwind readnone {
1630 %cmp = icmp eq i32 %x, 30
1631 %sub = add i32 %x, -30
1632 %cmp2 = icmp ugt i32 %sub, 9
1633 %or = or i1 %cmp, %cmp2
1636 This should be optimized to a single compare. Testcase derived from gcc.
1638 //===---------------------------------------------------------------------===//
1640 Missed instcombine or reassociate transformation:
1641 int a(int a, int b) { return (a==12)&(b>47)&(b<58); }
1643 The sgt and slt should be combined into a single comparison. Testcase derived
1646 //===---------------------------------------------------------------------===//
1648 Missed instcombine transformation:
1650 %382 = srem i32 %tmp14.i, 64 ; [#uses=1]
1651 %383 = zext i32 %382 to i64 ; [#uses=1]
1652 %384 = shl i64 %381, %383 ; [#uses=1]
1653 %385 = icmp slt i32 %tmp14.i, 64 ; [#uses=1]
1655 The srem can be transformed to an and because if %tmp14.i is negative, the
1656 shift is undefined. Testcase derived from 403.gcc.
1658 //===---------------------------------------------------------------------===//
1660 This is a range comparison on a divided result (from 403.gcc):
1662 %1337 = sdiv i32 %1336, 8 ; [#uses=1]
1663 %.off.i208 = add i32 %1336, 7 ; [#uses=1]
1664 %1338 = icmp ult i32 %.off.i208, 15 ; [#uses=1]
1666 We already catch this (removing the sdiv) if there isn't an add, we should
1667 handle the 'add' as well. This is a common idiom with it's builtin_alloca code.
1670 int a(int x) { return (unsigned)(x/16+7) < 15; }
1672 Another similar case involves truncations on 64-bit targets:
1674 %361 = sdiv i64 %.046, 8 ; [#uses=1]
1675 %362 = trunc i64 %361 to i32 ; [#uses=2]
1677 %367 = icmp eq i32 %362, 0 ; [#uses=1]
1679 //===---------------------------------------------------------------------===//
1681 Missed instcombine/dagcombine transformation:
1682 define void @lshift_lt(i8 zeroext %a) nounwind {
1684 %conv = zext i8 %a to i32
1685 %shl = shl i32 %conv, 3
1686 %cmp = icmp ult i32 %shl, 33
1687 br i1 %cmp, label %if.then, label %if.end
1690 tail call void @bar() nounwind
1696 declare void @bar() nounwind
1698 The shift should be eliminated. Testcase derived from gcc.
1700 //===---------------------------------------------------------------------===//
1702 These compile into different code, one gets recognized as a switch and the
1703 other doesn't due to phase ordering issues (PR6212):
1705 int test1(int mainType, int subType) {
1708 else if (mainType == 9)
1710 else if (mainType == 11)
1715 int test2(int mainType, int subType) {
1725 //===---------------------------------------------------------------------===//
1727 The following test case (from PR6576):
1729 define i32 @mul(i32 %a, i32 %b) nounwind readnone {
1731 %cond1 = icmp eq i32 %b, 0 ; <i1> [#uses=1]
1732 br i1 %cond1, label %exit, label %bb.nph
1733 bb.nph: ; preds = %entry
1734 %tmp = mul i32 %b, %a ; <i32> [#uses=1]
1736 exit: ; preds = %entry
1740 could be reduced to:
1742 define i32 @mul(i32 %a, i32 %b) nounwind readnone {
1744 %tmp = mul i32 %b, %a
1748 //===---------------------------------------------------------------------===//
1750 We should use DSE + llvm.lifetime.end to delete dead vtable pointer updates.
1753 Another interesting case is that something related could be used for variables
1754 that go const after their ctor has finished. In these cases, globalopt (which
1755 can statically run the constructor) could mark the global const (so it gets put
1756 in the readonly section). A testcase would be:
1759 using namespace std;
1760 const complex<char> should_be_in_rodata (42,-42);
1761 complex<char> should_be_in_data (42,-42);
1762 complex<char> should_be_in_bss;
1764 Where we currently evaluate the ctors but the globals don't become const because
1765 the optimizer doesn't know they "become const" after the ctor is done. See
1766 GCC PR4131 for more examples.
1768 //===---------------------------------------------------------------------===//
1773 return x > 1 ? x : 1;
1776 LLVM emits a comparison with 1 instead of 0. 0 would be equivalent
1777 and cheaper on most targets.
1779 LLVM prefers comparisons with zero over non-zero in general, but in this
1780 case it choses instead to keep the max operation obvious.
1782 //===---------------------------------------------------------------------===//
1784 define void @a(i32 %x) nounwind {
1786 switch i32 %x, label %if.end [
1787 i32 0, label %if.then
1788 i32 1, label %if.then
1789 i32 2, label %if.then
1790 i32 3, label %if.then
1791 i32 5, label %if.then
1794 tail call void @foo() nounwind
1801 Generated code on x86-64 (other platforms give similar results):
1812 If we wanted to be really clever, we could simplify the whole thing to
1813 something like the following, which eliminates a branch:
1821 //===---------------------------------------------------------------------===//
1825 int foo(int a) { return (a & (~15)) / 16; }
1829 define i32 @foo(i32 %a) nounwind readnone ssp {
1831 %and = and i32 %a, -16
1832 %div = sdiv i32 %and, 16
1836 but this code (X & -A)/A is X >> log2(A) when A is a power of 2, so this case
1837 should be instcombined into just "a >> 4".
1839 We do get this at the codegen level, so something knows about it, but
1840 instcombine should catch it earlier:
1848 //===---------------------------------------------------------------------===//
1850 This code (from GCC PR28685):
1852 int test(int a, int b) {
1862 define i32 @test(i32 %a, i32 %b) nounwind readnone ssp {
1864 %cmp = icmp slt i32 %a, %b
1865 br i1 %cmp, label %return, label %if.end
1867 if.end: ; preds = %entry
1868 %cmp5 = icmp eq i32 %a, %b
1869 %conv6 = zext i1 %cmp5 to i32
1872 return: ; preds = %entry
1878 define i32 @test__(i32 %a, i32 %b) nounwind readnone ssp {
1880 %0 = icmp sle i32 %a, %b
1881 %retval = zext i1 %0 to i32
1885 //===---------------------------------------------------------------------===//
1887 This code can be seen in viterbi:
1889 %64 = call noalias i8* @malloc(i64 %62) nounwind
1891 %67 = call i64 @llvm.objectsize.i64(i8* %64, i1 false) nounwind
1892 %68 = call i8* @__memset_chk(i8* %64, i32 0, i64 %62, i64 %67) nounwind
1894 llvm.objectsize.i64 should be taught about malloc/calloc, allowing it to
1895 fold to %62. This is a security win (overflows of malloc will get caught)
1896 and also a performance win by exposing more memsets to the optimizer.
1898 This occurs several times in viterbi.
1900 Note that this would change the semantics of @llvm.objectsize which by its
1901 current definition always folds to a constant. We also should make sure that
1902 we remove checking in code like
1904 char *p = malloc(strlen(s)+1);
1905 __strcpy_chk(p, s, __builtin_objectsize(p, 0));
1907 //===---------------------------------------------------------------------===//
1909 This code (from Benchmarks/Dhrystone/dry.c):
1911 define i32 @Func1(i32, i32) nounwind readnone optsize ssp {
1913 %sext = shl i32 %0, 24
1914 %conv = ashr i32 %sext, 24
1915 %sext6 = shl i32 %1, 24
1916 %conv4 = ashr i32 %sext6, 24
1917 %cmp = icmp eq i32 %conv, %conv4
1918 %. = select i1 %cmp, i32 10000, i32 0
1922 Should be simplified into something like:
1924 define i32 @Func1(i32, i32) nounwind readnone optsize ssp {
1926 %sext = shl i32 %0, 24
1927 %conv = and i32 %sext, 0xFF000000
1928 %sext6 = shl i32 %1, 24
1929 %conv4 = and i32 %sext6, 0xFF000000
1930 %cmp = icmp eq i32 %conv, %conv4
1931 %. = select i1 %cmp, i32 10000, i32 0
1937 define i32 @Func1(i32, i32) nounwind readnone optsize ssp {
1939 %conv = and i32 %0, 0xFF
1940 %conv4 = and i32 %1, 0xFF
1941 %cmp = icmp eq i32 %conv, %conv4
1942 %. = select i1 %cmp, i32 10000, i32 0
1945 //===---------------------------------------------------------------------===//
1947 clang -O3 currently compiles this code
1949 int g(unsigned int a) {
1950 unsigned int c[100];
1953 unsigned int b = c[10] + c[11];
1961 define i32 @g(i32 a) nounwind readnone {
1962 %add = shl i32 %a, 1
1963 %mul = shl i32 %a, 1
1964 %cmp = icmp ugt i32 %add, %mul
1965 %a.addr.0 = select i1 %cmp, i32 11, i32 15
1969 The icmp should fold to false. This CSE opportunity is only available
1970 after GVN and InstCombine have run.
1972 //===---------------------------------------------------------------------===//
1974 memcpyopt should turn this:
1976 define i8* @test10(i32 %x) {
1977 %alloc = call noalias i8* @malloc(i32 %x) nounwind
1978 call void @llvm.memset.p0i8.i32(i8* %alloc, i8 0, i32 %x, i32 1, i1 false)
1982 into a call to calloc. We should make sure that we analyze calloc as
1983 aggressively as malloc though.
1985 //===---------------------------------------------------------------------===//
1987 clang -O3 doesn't optimize this:
1989 void f1(int* begin, int* end) {
1990 std::fill(begin, end, 0);
1993 into a memset. This is PR8942.
1995 //===---------------------------------------------------------------------===//
1997 clang -O3 -fno-exceptions currently compiles this code:
2000 std::vector<int> v(N);
2002 extern void sink(void*); sink(&v);
2007 define void @_Z1fi(i32 %N) nounwind {
2009 %v2 = alloca [3 x i32*], align 8
2010 %v2.sub = getelementptr inbounds [3 x i32*]* %v2, i64 0, i64 0
2011 %tmpcast = bitcast [3 x i32*]* %v2 to %"class.std::vector"*
2012 %conv = sext i32 %N to i64
2013 store i32* null, i32** %v2.sub, align 8, !tbaa !0
2014 %tmp3.i.i.i.i.i = getelementptr inbounds [3 x i32*]* %v2, i64 0, i64 1
2015 store i32* null, i32** %tmp3.i.i.i.i.i, align 8, !tbaa !0
2016 %tmp4.i.i.i.i.i = getelementptr inbounds [3 x i32*]* %v2, i64 0, i64 2
2017 store i32* null, i32** %tmp4.i.i.i.i.i, align 8, !tbaa !0
2018 %cmp.i.i.i.i = icmp eq i32 %N, 0
2019 br i1 %cmp.i.i.i.i, label %_ZNSt12_Vector_baseIiSaIiEEC2EmRKS0_.exit.thread.i.i, label %cond.true.i.i.i.i
2021 _ZNSt12_Vector_baseIiSaIiEEC2EmRKS0_.exit.thread.i.i: ; preds = %entry
2022 store i32* null, i32** %v2.sub, align 8, !tbaa !0
2023 store i32* null, i32** %tmp3.i.i.i.i.i, align 8, !tbaa !0
2024 %add.ptr.i5.i.i = getelementptr inbounds i32* null, i64 %conv
2025 store i32* %add.ptr.i5.i.i, i32** %tmp4.i.i.i.i.i, align 8, !tbaa !0
2026 br label %_ZNSt6vectorIiSaIiEEC1EmRKiRKS0_.exit
2028 cond.true.i.i.i.i: ; preds = %entry
2029 %cmp.i.i.i.i.i = icmp slt i32 %N, 0
2030 br i1 %cmp.i.i.i.i.i, label %if.then.i.i.i.i.i, label %_ZNSt12_Vector_baseIiSaIiEEC2EmRKS0_.exit.i.i
2032 if.then.i.i.i.i.i: ; preds = %cond.true.i.i.i.i
2033 call void @_ZSt17__throw_bad_allocv() noreturn nounwind
2036 _ZNSt12_Vector_baseIiSaIiEEC2EmRKS0_.exit.i.i: ; preds = %cond.true.i.i.i.i
2037 %mul.i.i.i.i.i = shl i64 %conv, 2
2038 %call3.i.i.i.i.i = call noalias i8* @_Znwm(i64 %mul.i.i.i.i.i) nounwind
2039 %0 = bitcast i8* %call3.i.i.i.i.i to i32*
2040 store i32* %0, i32** %v2.sub, align 8, !tbaa !0
2041 store i32* %0, i32** %tmp3.i.i.i.i.i, align 8, !tbaa !0
2042 %add.ptr.i.i.i = getelementptr inbounds i32* %0, i64 %conv
2043 store i32* %add.ptr.i.i.i, i32** %tmp4.i.i.i.i.i, align 8, !tbaa !0
2044 call void @llvm.memset.p0i8.i64(i8* %call3.i.i.i.i.i, i8 0, i64 %mul.i.i.i.i.i, i32 4, i1 false)
2045 br label %_ZNSt6vectorIiSaIiEEC1EmRKiRKS0_.exit
2047 This is just the handling the construction of the vector. Most surprising here
2048 is the fact that all three null stores in %entry are dead (because we do no
2051 Also surprising is that %conv isn't simplified to 0 in %....exit.thread.i.i.
2052 This is a because the client of LazyValueInfo doesn't simplify all instruction
2053 operands, just selected ones.
2055 //===---------------------------------------------------------------------===//
2057 clang -O3 -fno-exceptions currently compiles this code:
2059 void f(char* a, int n) {
2060 __builtin_memset(a, 0, n);
2061 for (int i = 0; i < n; ++i)
2067 define void @_Z1fPci(i8* nocapture %a, i32 %n) nounwind {
2069 %conv = sext i32 %n to i64
2070 tail call void @llvm.memset.p0i8.i64(i8* %a, i8 0, i64 %conv, i32 1, i1 false)
2071 %cmp8 = icmp sgt i32 %n, 0
2072 br i1 %cmp8, label %for.body.lr.ph, label %for.end
2074 for.body.lr.ph: ; preds = %entry
2075 %tmp10 = add i32 %n, -1
2076 %tmp11 = zext i32 %tmp10 to i64
2077 %tmp12 = add i64 %tmp11, 1
2078 call void @llvm.memset.p0i8.i64(i8* %a, i8 0, i64 %tmp12, i32 1, i1 false)
2081 for.end: ; preds = %entry
2085 This shouldn't need the ((zext (%n - 1)) + 1) game, and it should ideally fold
2086 the two memset's together.
2088 The issue with the addition only occurs in 64-bit mode, and appears to be at
2089 least partially caused by Scalar Evolution not keeping its cache updated: it
2090 returns the "wrong" result immediately after indvars runs, but figures out the
2091 expected result if it is run from scratch on IR resulting from running indvars.
2093 //===---------------------------------------------------------------------===//
2095 clang -O3 -fno-exceptions currently compiles this code:
2098 unsigned short m1, m2;
2099 unsigned char m3, m4;
2103 std::vector<S> v(N);
2104 extern void sink(void*); sink(&v);
2107 into poor code for zero-initializing 'v' when N is >0. The problem is that
2108 S is only 6 bytes, but each element is 8 byte-aligned. We generate a loop and
2109 4 stores on each iteration. If the struct were 8 bytes, this gets turned into
2112 In order to handle this we have to:
2113 A) Teach clang to generate metadata for memsets of structs that have holes in
2115 B) Teach clang to use such a memset for zero init of this struct (since it has
2116 a hole), instead of doing elementwise zeroing.
2118 //===---------------------------------------------------------------------===//
2120 clang -O3 currently compiles this code:
2122 extern const int magic;
2123 double f() { return 0.0 * magic; }
2127 @magic = external constant i32
2129 define double @_Z1fv() nounwind readnone {
2131 %tmp = load i32* @magic, align 4, !tbaa !0
2132 %conv = sitofp i32 %tmp to double
2133 %mul = fmul double %conv, 0.000000e+00
2137 We should be able to fold away this fmul to 0.0. More generally, fmul(x,0.0)
2138 can be folded to 0.0 if we can prove that the LHS is not -0.0, not a NaN, and
2139 not an INF. The CannotBeNegativeZero predicate in value tracking should be
2140 extended to support general "fpclassify" operations that can return
2141 yes/no/unknown for each of these predicates.
2143 In this predicate, we know that uitofp is trivially never NaN or -0.0, and
2144 we know that it isn't +/-Inf if the floating point type has enough exponent bits
2145 to represent the largest integer value as < inf.
2147 //===---------------------------------------------------------------------===//
2149 When optimizing a transformation that can change the sign of 0.0 (such as the
2150 0.0*val -> 0.0 transformation above), it might be provable that the sign of the
2151 expression doesn't matter. For example, by the above rules, we can't transform
2152 fmul(sitofp(x), 0.0) into 0.0, because x might be -1 and the result of the
2153 expression is defined to be -0.0.
2155 If we look at the uses of the fmul for example, we might be able to prove that
2156 all uses don't care about the sign of zero. For example, if we have:
2158 fadd(fmul(sitofp(x), 0.0), 2.0)
2160 Since we know that x+2.0 doesn't care about the sign of any zeros in X, we can
2161 transform the fmul to 0.0, and then the fadd to 2.0.
2163 //===---------------------------------------------------------------------===//
2165 We should enhance memcpy/memcpy/memset to allow a metadata node on them
2166 indicating that some bytes of the transfer are undefined. This is useful for
2167 frontends like clang when lowering struct copies, when some elements of the
2168 struct are undefined. Consider something like this:
2174 void foo(struct x*P);
2175 struct x testfunc() {
2183 We currently compile this to:
2184 $ clang t.c -S -o - -O0 -emit-llvm | opt -scalarrepl -S
2187 %struct.x = type { i8, [4 x i32] }
2189 define void @testfunc(%struct.x* sret %agg.result) nounwind ssp {
2191 %V1 = alloca %struct.x, align 4
2192 call void @foo(%struct.x* %V1)
2193 %tmp1 = bitcast %struct.x* %V1 to i8*
2194 %0 = bitcast %struct.x* %V1 to i160*
2195 %srcval1 = load i160* %0, align 4
2196 %tmp2 = bitcast %struct.x* %agg.result to i8*
2197 %1 = bitcast %struct.x* %agg.result to i160*
2198 store i160 %srcval1, i160* %1, align 4
2202 This happens because SRoA sees that the temp alloca has is being memcpy'd into
2203 and out of and it has holes and it has to be conservative. If we knew about the
2204 holes, then this could be much much better.
2206 Having information about these holes would also improve memcpy (etc) lowering at
2207 llc time when it gets inlined, because we can use smaller transfers. This also
2208 avoids partial register stalls in some important cases.
2210 //===---------------------------------------------------------------------===//
2212 We don't fold (icmp (add) (add)) unless the two adds only have a single use.
2213 There are a lot of cases that we're refusing to fold in (e.g.) 256.bzip2, for
2216 %indvar.next90 = add i64 %indvar89, 1 ;; Has 2 uses
2217 %tmp96 = add i64 %tmp95, 1 ;; Has 1 use
2218 %exitcond97 = icmp eq i64 %indvar.next90, %tmp96
2220 We don't fold this because we don't want to introduce an overlapped live range
2221 of the ivar. However if we can make this more aggressive without causing
2222 performance issues in two ways:
2224 1. If *either* the LHS or RHS has a single use, we can definitely do the
2225 transformation. In the overlapping liverange case we're trading one register
2226 use for one fewer operation, which is a reasonable trade. Before doing this
2227 we should verify that the llc output actually shrinks for some benchmarks.
2228 2. If both ops have multiple uses, we can still fold it if the operations are
2229 both sinkable to *after* the icmp (e.g. in a subsequent block) which doesn't
2230 increase register pressure.
2232 There are a ton of icmp's we aren't simplifying because of the reg pressure
2233 concern. Care is warranted here though because many of these are induction
2234 variables and other cases that matter a lot to performance, like the above.
2235 Here's a blob of code that you can drop into the bottom of visitICmp to see some
2238 { Value *A, *B, *C, *D;
2239 if (match(Op0, m_Add(m_Value(A), m_Value(B))) &&
2240 match(Op1, m_Add(m_Value(C), m_Value(D))) &&
2241 (A == C || A == D || B == C || B == D)) {
2242 errs() << "OP0 = " << *Op0 << " U=" << Op0->getNumUses() << "\n";
2243 errs() << "OP1 = " << *Op1 << " U=" << Op1->getNumUses() << "\n";
2244 errs() << "CMP = " << I << "\n\n";
2248 //===---------------------------------------------------------------------===//
2250 define i1 @test1(i32 %x) nounwind {
2251 %and = and i32 %x, 3
2252 %cmp = icmp ult i32 %and, 2
2256 Can be folded to (x & 2) == 0.
2258 define i1 @test2(i32 %x) nounwind {
2259 %and = and i32 %x, 3
2260 %cmp = icmp ugt i32 %and, 1
2264 Can be folded to (x & 2) != 0.
2266 SimplifyDemandedBits shrinks the "and" constant to 2 but instcombine misses the
2269 //===---------------------------------------------------------------------===//
2295 Compiles into this IR (on x86-64 at least):
2297 %struct.t1 = type { i8, [3 x i8] }
2298 @s2 = global %struct.t1 zeroinitializer, align 4
2299 @s1 = global %struct.t1 zeroinitializer, align 4
2300 define void @func1() nounwind ssp noredzone {
2302 %0 = load i32* bitcast (%struct.t1* @s2 to i32*), align 4
2303 %bf.val.sext5 = and i32 %0, 1
2304 %1 = load i32* bitcast (%struct.t1* @s1 to i32*), align 4
2306 %3 = or i32 %2, %bf.val.sext5
2307 %bf.val.sext26 = and i32 %0, 2
2308 %4 = or i32 %3, %bf.val.sext26
2309 store i32 %4, i32* bitcast (%struct.t1* @s1 to i32*), align 4
2313 The two or/and's should be merged into one each.
2315 //===---------------------------------------------------------------------===//
2317 Machine level code hoisting can be useful in some cases. For example, PR9408
2325 void foo(funcs f, int which) {
2334 which we compile to:
2354 Note that bb1 and bb2 are the same. This doesn't happen at the IR level
2355 because one call is passing an i32 and the other is passing an i64.
2357 //===---------------------------------------------------------------------===//
2359 I see this sort of pattern in 176.gcc in a few places (e.g. the start of
2360 store_bit_field). The rem should be replaced with a multiply and subtract:
2362 %3 = sdiv i32 %A, %B
2363 %4 = srem i32 %A, %B
2365 Similarly for udiv/urem. Note that this shouldn't be done on X86 or ARM,
2366 which can do this in a single operation (instruction or libcall). It is
2367 probably best to do this in the code generator.
2369 //===---------------------------------------------------------------------===//
2371 unsigned foo(unsigned x, unsigned y) { return (x & y) == 0 || x == 0; }
2372 should fold to (x & y) == 0.
2374 //===---------------------------------------------------------------------===//
2376 unsigned foo(unsigned x, unsigned y) { return x > y && x != 0; }
2377 should fold to x > y.
2379 //===---------------------------------------------------------------------===//
2381 int f(double x) { return __builtin_fabs(x) < 0.0; }
2382 should fold to false.
2384 //===---------------------------------------------------------------------===//