Skip to content

[Loads] Support dereference for non-constant offset #149551

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
+21 −45
Open

[Loads] Support dereference for non-constant offset #149551

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
23ac9f0
[Loads] Support dereference for non-constant offset
annamthomas Jul 17, 2025
2887ce4
Address review comments
annamthomas Aug 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions llvm/lib/Analysis/Loads.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -361,29 +361,29 @@ bool llvm::isDereferenceableAndAlignedInLoop(
AccessSize = MaxPtrDiff;
AccessSizeSCEV = PtrDiff;
} else if (auto *MinAdd = dyn_cast<SCEVAddExpr>(AccessStart)) {
if (MinAdd->getNumOperands() != 2)
return false;
const auto *NewBase = dyn_cast<SCEVUnknown>(SE.getPointerBase(MinAdd));
const auto *OffsetSCEV = SE.removePointerBase(MinAdd);

const auto *Offset = dyn_cast<SCEVConstant>(MinAdd->getOperand(0));
const auto *NewBase = dyn_cast<SCEVUnknown>(MinAdd->getOperand(1));
if (!Offset || !NewBase)
if (!OffsetSCEV || !NewBase)
return false;

// The following code below assumes the offset is unsigned, but GEP
// offsets are treated as signed so we can end up with a signed value
// here too. For example, suppose the initial PHI value is (i8 255),
// the offset will be treated as (i8 -1) and sign-extended to (i64 -1).
if (Offset->getAPInt().isNegative())
if (!SE.isKnownNonNegative(OffsetSCEV))
return false;

// For the moment, restrict ourselves to the case where the offset is a
// multiple of the requested alignment and the base is aligned.
// TODO: generalize if a case found which warrants
if (Offset->getAPInt().urem(Alignment.value()) != 0)
auto *OffsetSCEVTy = OffsetSCEV->getType();
if (!SE.isKnownPredicate(
ICmpInst::ICMP_EQ,
SE.getURemExpr(OffsetSCEV,
SE.getConstant(OffsetSCEVTy, Alignment.value())),
SE.getZero(OffsetSCEVTy)))
return false;

AccessSize = MaxPtrDiff + Offset->getAPInt();
AccessSizeSCEV = SE.getAddExpr(PtrDiff, Offset);
AccessSizeSCEV = SE.getAddExpr(PtrDiff, OffsetSCEV);
const auto *Offset = dyn_cast<SCEVConstant>(OffsetSCEV);
AccessSize = MaxPtrDiff + (Offset ? Offset->getAPInt()
: SE.getUnsignedRangeMax(OffsetSCEV));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just always using getUnsignedRangeMax here should be fine.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not familiar with this code, does it handle overflow in these adds correctly?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thats a good question. Just going by the original code as well, we can overflow this add:

AccessSize = MaxPtrDiff + Offset->getAPInt();

I wonder if it is enough to just use uadd_ov for computing AccessSize, check the overflow flag and bail out if overflowed. This would avoid the need for checking overflow in AccessSizeSCEV.

Copy link
Contributor Author

@annamthomas annamthomas Aug 7, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The other approach is using SE.willNotOverflow check for the add but it hits the limitation that the RHS is not constant.
Here's the example output:

OffsetSCEV: (16 + (4 * %iv.start)<nuw><nsw>)<nuw><nsw>   
PtrDiff: ((4 * %N)<nuw><nsw> + (-4 * %iv.start)<nsw>)
AccessSizeSCEV: (16 + (4 * %N)<nuw><nsw>)<nuw><nsw>

PtrDiff is actually AccessEnd - AccessStart, so the "base" is already removed.
Base is 16 + %a
OffsetSCEV is the expression when %a is removed in AccessStart, so it will be some symbolic expression containing AccessStart.

So, the AddExpr: <expr> + <constant> (constant here is 16) is easier to prove as not overflow, but it requires performing the operation and then splitting up the expression into LHS and RHS and trying to prove that operation doesn't overflow on LHS and RHS. Any other ideas?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the only comment I'm unsure of (and haven't addressed yet). In the original code as well, there was a chance of overflow. I think we need to add the SE.willNotOverflow and then improve that API, or do something similar to suggested above. Currently using that API does not allow us to improve this testcase to avoid predicated loads.

@fhahn @nikic any suggestions or other ideas?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's the expression for AccessStart here? I feel like just having nuw on it may be sufficient. getStartAndEndForAccess should already guarantee that there is no wrapping between AccessStart and AccessEnd, so it should just be a matter of the addrec itself wrapping. Unless that's already excluded by something else at this point.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

AccessStart: (16 + (4 * %iv.start) + %P)
AccessEnd: (16 + (4 * %N) + %P)
We also have checks in getStartAndEndForAccess that makes sure AccessEnd does not wrap at MaxBTC.
There is a comment in getStartAndEndForAccess that LAA separately checks that accesses cannot wrap in the loop. .

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, I think what we need to check is that AccessStart uge NewBase. This ensures that the offset stripping did not wrap, and the rest is checked by getStartAndEndForAccess. Do we have isKnownPredicate(uge, AccessStart, NewBase) here?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately, it doesn't. I tried isKnownPredicateAt with Loop's predecessor's terminator as CtxI as well (in case assumes help).

define void @deref_assumption_loop_access_start_variable(i8 %v, ptr noundef %P, i64 range(i64 0, 2000) %N, ptr noalias %b, ptr noalias %c, i64 range(i64 0, 2000) %iv.start) nofree nosync {
  entry:
    %a = getelementptr i8, ptr %P, i64 16
    %cmp = icmp slt i64 %iv.start, %N
    call void @llvm.assume(i1 %cmp)
    %mul = mul i64 %N, 4
    %add = add i64 %mul, 16
    call void @llvm.assume(i1 true) [ "dereferenceable"(ptr %P, i64 %add) ]
    br label %loop
    ...

NewBase is %P. AccessStart is `(16 + (4 * %iv.start) + %P). Note the nuw/nsw flags on the "4 * %iv.start". This is present because of the range on iv.start.

From the above we should get that the offset computation itself does not wrap: should be known from the range on %iv.start.
i.e. (16 + (4 * %iv.start))

Isn't that enough for AccessStart uge NewBase. But something is missing in the logic because we don't identify the range of this arithmetic operation given the range of iv.start is (0, 2000)

Base = NewBase->getValue();
} else
return false;
Expand Down
42 changes: 11 additions & 31 deletions llvm/test/Transforms/LoopVectorize/dereferenceable-info-from-assumption-variable-size.ll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -562,38 +562,19 @@ define void @deref_assumption_loop_access_start_variable(i8 %v, ptr noundef %P,
; CHECK-NEXT: [[TMP1:%.*]] = add i64 [[IV_START]], [[N_VEC]]
; CHECK-NEXT: br label %[[VECTOR_BODY:.*]]
; CHECK: [[VECTOR_BODY]]:
; CHECK-NEXT: [[INDEX:%.*]] = phi i64 [ 0, %[[VECTOR_PH]] ], [ [[INDEX_NEXT:%.*]], %[[PRED_LOAD_CONTINUE2:.*]] ]
; CHECK-NEXT: [[INDEX:%.*]] = phi i64 [ 0, %[[VECTOR_PH]] ], [ [[INDEX_NEXT:%.*]], %[[VECTOR_BODY]] ]
; CHECK-NEXT: [[OFFSET_IDX:%.*]] = add i64 [[IV_START]], [[INDEX]]
; CHECK-NEXT: [[TMP6:%.*]] = getelementptr inbounds i32, ptr [[B]], i64 [[OFFSET_IDX]]
; CHECK-NEXT: [[WIDE_LOAD:%.*]] = load <2 x i32>, ptr [[TMP6]], align 1
; CHECK-NEXT: [[TMP8:%.*]] = icmp sge <2 x i32> [[WIDE_LOAD]], zeroinitializer
; CHECK-NEXT: [[TMP4:%.*]] = xor <2 x i1> [[TMP8]], splat (i1 true)
; CHECK-NEXT: [[TMP5:%.*]] = extractelement <2 x i1> [[TMP4]], i32 0
; CHECK-NEXT: br i1 [[TMP5]], label %[[PRED_LOAD_IF:.*]], label %[[PRED_LOAD_CONTINUE:.*]]
; CHECK: [[PRED_LOAD_IF]]:
; CHECK-NEXT: [[TMP16:%.*]] = add i64 [[OFFSET_IDX]], 0
; CHECK-NEXT: [[TMP7:%.*]] = getelementptr inbounds i32, ptr [[A]], i64 [[TMP16]]
; CHECK-NEXT: [[TMP19:%.*]] = load i32, ptr [[TMP7]], align 1
; CHECK-NEXT: [[TMP9:%.*]] = insertelement <2 x i32> poison, i32 [[TMP19]], i32 0
; CHECK-NEXT: br label %[[PRED_LOAD_CONTINUE]]
; CHECK: [[PRED_LOAD_CONTINUE]]:
; CHECK-NEXT: [[TMP10:%.*]] = phi <2 x i32> [ poison, %[[VECTOR_BODY]] ], [ [[TMP9]], %[[PRED_LOAD_IF]] ]
; CHECK-NEXT: [[TMP11:%.*]] = extractelement <2 x i1> [[TMP4]], i32 1
; CHECK-NEXT: br i1 [[TMP11]], label %[[PRED_LOAD_IF1:.*]], label %[[PRED_LOAD_CONTINUE2]]
; CHECK: [[PRED_LOAD_IF1]]:
; CHECK-NEXT: [[TMP12:%.*]] = add i64 [[OFFSET_IDX]], 1
; CHECK-NEXT: [[TMP13:%.*]] = getelementptr inbounds i32, ptr [[A]], i64 [[TMP12]]
; CHECK-NEXT: [[TMP14:%.*]] = load i32, ptr [[TMP13]], align 1
; CHECK-NEXT: [[TMP15:%.*]] = insertelement <2 x i32> [[TMP10]], i32 [[TMP14]], i32 1
; CHECK-NEXT: br label %[[PRED_LOAD_CONTINUE2]]
; CHECK: [[PRED_LOAD_CONTINUE2]]:
; CHECK-NEXT: [[WIDE_LOAD1:%.*]] = phi <2 x i32> [ [[TMP10]], %[[PRED_LOAD_CONTINUE]] ], [ [[TMP15]], %[[PRED_LOAD_IF1]] ]
; CHECK-NEXT: [[PREDPHI:%.*]] = select <2 x i1> [[TMP8]], <2 x i32> [[WIDE_LOAD]], <2 x i32> [[WIDE_LOAD1]]
; CHECK-NEXT: [[TMP17:%.*]] = getelementptr inbounds i32, ptr [[C]], i64 [[OFFSET_IDX]]
; CHECK-NEXT: store <2 x i32> [[PREDPHI]], ptr [[TMP17]], align 1
; CHECK-NEXT: [[TMP2:%.*]] = getelementptr i32, ptr [[A]], i64 [[OFFSET_IDX]]
; CHECK-NEXT: [[TMP7:%.*]] = getelementptr inbounds i32, ptr [[B]], i64 [[OFFSET_IDX]]
; CHECK-NEXT: [[WIDE_LOAD:%.*]] = load <2 x i32>, ptr [[TMP7]], align 1
; CHECK-NEXT: [[TMP4:%.*]] = icmp sge <2 x i32> [[WIDE_LOAD]], zeroinitializer
; CHECK-NEXT: [[WIDE_LOAD1:%.*]] = load <2 x i32>, ptr [[TMP2]], align 1
; CHECK-NEXT: [[PREDPHI:%.*]] = select <2 x i1> [[TMP4]], <2 x i32> [[WIDE_LOAD]], <2 x i32> [[WIDE_LOAD1]]
; CHECK-NEXT: [[TMP5:%.*]] = getelementptr inbounds i32, ptr [[C]], i64 [[OFFSET_IDX]]
; CHECK-NEXT: store <2 x i32> [[PREDPHI]], ptr [[TMP5]], align 1
; CHECK-NEXT: [[INDEX_NEXT]] = add nuw i64 [[INDEX]], 2
; CHECK-NEXT: [[TMP18:%.*]] = icmp eq i64 [[INDEX_NEXT]], [[N_VEC]]
; CHECK-NEXT: br i1 [[TMP18]], label %[[MIDDLE_BLOCK:.*]], label %[[VECTOR_BODY]], !llvm.loop [[LOOP14:![0-9]+]]
; CHECK-NEXT: [[TMP6:%.*]] = icmp eq i64 [[INDEX_NEXT]], [[N_VEC]]
; CHECK-NEXT: br i1 [[TMP6]], label %[[MIDDLE_BLOCK:.*]], label %[[VECTOR_BODY]], !llvm.loop [[LOOP14:![0-9]+]]
; CHECK: [[MIDDLE_BLOCK]]:
; CHECK-NEXT: [[CMP_N:%.*]] = icmp eq i64 [[TMP3]], [[N_VEC]]
; CHECK-NEXT: br i1 [[CMP_N]], label %[[EXIT:.*]], label %[[SCALAR_PH]]
Expand All @@ -620,7 +601,6 @@ define void @deref_assumption_loop_access_start_variable(i8 %v, ptr noundef %P,
; CHECK: [[EXIT]]:
; CHECK-NEXT: ret void
;

entry:
%a = getelementptr i8, ptr %P, i64 16
%cmp = icmp slt i64 %iv.start, %N
Expand Down