Fix endless loop in Legalization::visitBinaryOperator for optimized and/or sequences

Collected users of the instruction into a vector before updating them to prevent an endless loop when an instruction is used both in the condition and value of a select instruction.

Author: ustachow

IGC/Compiler/LegalizationPass.cpp

@@ -280,7 +280,10 @@ void Legalization::visitBinaryOperator(llvm::BinaryOperator &I) {
           break;
         }
         // check select i1 with I not used as condition
-        if (isa<SelectInst>(*U) && U->getOperand(0) != &I) {
+       if (isa<SelectInst>(*U) &&
+           (U->getOperand(0) != &I ||
+            U->getOperand(1) == &I ||
+            U->getOperand(2) == &I)) {
           flippable = false;
           break;
         }
@@ -297,20 +300,25 @@ void Legalization::visitBinaryOperator(llvm::BinaryOperator &I) {
         if (invert) {
           invert->setDebugLoc(I.getDebugLoc());
         }
-        while (!I.user_empty()) {
-          auto U = I.user_begin();
-          if (SelectInst *s = dyn_cast<SelectInst>(*U)) {
+        // Collect users before modifying them
+        std::vector<User *> users(I.user_begin(), I.user_end());
+        for (auto U : users) {
+          if (SelectInst *s = dyn_cast<SelectInst>(U)) {
             Value *trueValue = s->getTrueValue();
             Value *falseValue = s->getFalseValue();
             s->setOperand(1, falseValue);
             s->setOperand(2, trueValue);
             s->setOperand(0, invert);
-          } else if (BranchInst *br = dyn_cast<BranchInst>(*U)) {
+          } else if (BranchInst *br = dyn_cast<BranchInst>(U)) {
             IGC_ASSERT(br->isConditional());
             br->swapSuccessors();
             br->setCondition(invert);
           }
         }
+        IGC_ASSERT(
+            I.user_empty() &&
+            "Instruction should have no remaining uses after transformation"
+        );
         I.eraseFromParent();
         cast<llvm::Instruction>(src0)->eraseFromParent();
         cast<llvm::Instruction>(src1)->eraseFromParent();

IGC/Compiler/tests/Legalization/test_select.ll

@@ -0,0 +1,37 @@
+;=========================== begin_copyright_notice ============================
+;
+; Copyright (C) 2025 Intel Corporation
+;
+; SPDX-License-Identifier: MIT
+;
+;============================ end_copyright_notice =============================
+;
+; RUN: igc_opt -igc-legalization -verify -S %s -o - | FileCheck %s
+
+; ------------------------------------------------
+; Legalization: handle optimized and/or sequence
+; ------------------------------------------------
+
+define i1 @test_select(i1 %src1, i1 %src2, i1 %cc) {
+; CHECK-LABEL: define i1 @test_select(
+; CHECK-SAME: i1 [[SRC1:%.*]], i1 [[SRC2:%.*]], i1 [[CC:%.*]]) {
+; CHECK: [[XOR1:%.*]] = xor i1 [[SRC1]], true
+; CHECK-NEXT: [[XOR2:%.*]] = xor i1 [[SRC2]], true
+; CHECK-NEXT: [[AND1:%.*]] = and i1 [[XOR1]], [[XOR2]]
+; CHECK-NEXT: [[ZEXT1:%.*]] = zext i1 [[AND1]] to i32
+; CHECK-NEXT: [[ZEXT2:%.*]] = zext i1 [[CC]] to i32
+; CHECK-NEXT: [[SELECT1:%.*]] = select i1 [[AND1]], i32 [[ZEXT1]], i32 [[ZEXT2]]
+; CHECK-NEXT: [[TRUNC1:%.*]] = trunc i32 [[SELECT1]] to i1
+; CHECK-NEXT: ret i1 [[TRUNC1]]
+;
+  %1 = xor i1 %src1, true
+  %2 = xor i1 %src2, true
+  %3 = and i1 %1, %2
+  %4 = select i1 %3, i1 %3, i1 %cc
+  ret i1 %4
+}
+
+!igc.functions = !{!0}
+
+!0 = !{i1 (i1, i1, i1)* @test_select, !1}
+!1 = !{}