From fe3516f9a5f238ecf6872b5315706c7c7942a496 Mon Sep 17 00:00:00 2001
From: Andrew Trick <atrick@apple.com>
Date: Wed, 30 May 2012 03:35:20 +0000
Subject: [PATCH] SCEV: Handle a corner case reducing AddRecExpr * AddRecExpr

If integer overflow causes one of the terms to reach zero, that can
force the entire expression to zero.

Fixes PR12929: cast<Ty>() argument of incompatible type

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@157673 91177308-0d34-0410-b5e6-96231b3b80d8
---
 lib/Analysis/ScalarEvolution.cpp              |  5 ++-
 .../ScalarEvolution/2012-05-29-MulAddRec.ll   | 45 +++++++++++++++++++
 2 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 test/Analysis/ScalarEvolution/2012-05-29-MulAddRec.ll

diff --git a/lib/Analysis/ScalarEvolution.cpp b/lib/Analysis/ScalarEvolution.cpp
index 59f441e700c..8781441fd43 100644
--- a/lib/Analysis/ScalarEvolution.cpp
+++ b/lib/Analysis/ScalarEvolution.cpp
@@ -2088,9 +2088,12 @@ const SCEV *ScalarEvolution::getMulExpr(SmallVectorImpl<const SCEV *> &Ops,
           const SCEV *NewAddRec = getAddRecExpr(AddRecOps, AddRec->getLoop(),
                                                 SCEV::FlagAnyWrap);
           if (Ops.size() == 2) return NewAddRec;
-          Ops[Idx] = AddRec = cast<SCEVAddRecExpr>(NewAddRec);
+          Ops[Idx] = NewAddRec;
           Ops.erase(Ops.begin() + OtherIdx); --OtherIdx;
           OpsModified = true;
+          AddRec = dyn_cast<SCEVAddRecExpr>(NewAddRec);
+          if (!AddRec)
+            break;
         }
       }
       if (OpsModified)
diff --git a/test/Analysis/ScalarEvolution/2012-05-29-MulAddRec.ll b/test/Analysis/ScalarEvolution/2012-05-29-MulAddRec.ll
new file mode 100644
index 00000000000..eee4ec4333c
--- /dev/null
+++ b/test/Analysis/ScalarEvolution/2012-05-29-MulAddRec.ll
@@ -0,0 +1,45 @@
+; RUN: opt < %s -S -indvars -loop-unroll | FileCheck %s
+;
+; loop-unroll fully unrolls the inner loop, creating an interesting
+; chain of multiplication. indvars forces SCEV to run again on the
+; outer loop. While reducing the recurrence at %mul3, unsigned integer overflow
+; causes one of the terms to reach zero. This forces all multiples in
+; the recurrence to be zero, reducing the whole thing to a constant expression.
+;
+; PR12929: cast<Ty>() argument of incompatible type
+
+; CHECK: @func
+; CHECK: for.cond:
+; CHECK: %inc1 = phi i8 [ 0, %entry ], [ %0, %for.body ]
+; CHECK: br label %for.body
+
+; CHECK: for.body:
+; CHECK: %inc.9 = add i8 %inc.8, 1
+; CHECK: %0 = add i8 %inc1, 10
+; CHEKC: br label %for.cond
+
+target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
+define void @func() noreturn nounwind uwtable ssp {
+entry:
+  br label %for.cond
+
+for.cond.loopexit:                                ; preds = %for.body
+  %mul.lcssa = phi i8 [ %mul, %for.body ]
+  %0 = add i8 %inc1, 10
+  %indvars.iv.next = add i8 %indvars.iv, 10
+  br label %for.cond
+
+for.cond:                                         ; preds = %for.cond.loopexit, %entry
+  %indvars.iv = phi i8 [ %indvars.iv.next, %for.cond.loopexit ], [ 10, %entry ]
+  %mul3 = phi i8 [ undef, %entry ], [ %mul.lcssa, %for.cond.loopexit ]
+  %inc1 = phi i8 [ 0, %entry ], [ %0, %for.cond.loopexit ]
+  br label %for.body
+
+for.body:                                         ; preds = %for.body, %for.cond
+  %inc26 = phi i8 [ %inc1, %for.cond ], [ %inc, %for.body ]
+  %mul45 = phi i8 [ %mul3, %for.cond ], [ %mul, %for.body ]
+  %inc = add i8 %inc26, 1
+  %mul = mul i8 %inc26, %mul45
+  %exitcond = icmp ne i8 %inc, %indvars.iv
+  br i1 %exitcond, label %for.body, label %for.cond.loopexit
+}
-- 
2.34.1