From 4498b9bc6ab1d1cfb93dc8dd6d10472d004db905 Mon Sep 17 00:00:00 2001 From: Yingwei Zheng Date: Sun, 24 Aug 2025 01:41:57 +0800 Subject: [PATCH 1/4] [VectorCombine] Avoid crash when the next node is deleted. --- .../Transforms/Vectorize/VectorCombine.cpp | 21 ++++++++++++++----- .../X86/insert-binop-inseltpoison.ll | 20 ++++++++++++++++++ 2 files changed, 36 insertions(+), 5 deletions(-) diff --git a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp index 1275d53a075b5..dbc4f57537821 100644 --- a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp +++ b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp @@ -99,6 +99,10 @@ class VectorCombine { InstructionWorklist Worklist; + /// Next instruction to iterate. It will be updated when it is erased by + /// RecursivelyDeleteTriviallyDeadInstructions. + Instruction *NextInst; + // TODO: Direct calls from the top-level "run" loop use a plain "Instruction" // parameter. That should be updated to specific sub-classes because the // run loop was changed to dispatch on opcode. @@ -172,9 +176,11 @@ class VectorCombine { if (auto *OpI = dyn_cast(Op)) { if (RecursivelyDeleteTriviallyDeadInstructions( OpI, nullptr, nullptr, [this](Value *V) { - if (auto I = dyn_cast(V)) { + if (auto *I = dyn_cast(V)) { LLVM_DEBUG(dbgs() << "VC: Erased: " << *I << '\n'); Worklist.remove(I); + if (I == NextInst) + NextInst = NextInst->getNextNode(); } })) continue; @@ -4254,13 +4260,18 @@ bool VectorCombine::run() { if (!DT.isReachableFromEntry(&BB)) continue; // Use early increment range so that we can erase instructions in loop. - for (Instruction &I : make_early_inc_range(BB)) { - if (I.isDebugOrPseudoInst()) - continue; - MadeChange |= FoldInst(I); + Instruction *I = &BB.front(); + while (I) { + NextInst = I->getNextNode(); + if (!I->isDebugOrPseudoInst()) { + MadeChange |= FoldInst(*I); + } + I = NextInst; } } + NextInst = nullptr; + while (!Worklist.isEmpty()) { Instruction *I = Worklist.removeOne(); if (!I) diff --git a/llvm/test/Transforms/VectorCombine/X86/insert-binop-inseltpoison.ll b/llvm/test/Transforms/VectorCombine/X86/insert-binop-inseltpoison.ll index c1100780254c1..6228b09884c03 100644 --- a/llvm/test/Transforms/VectorCombine/X86/insert-binop-inseltpoison.ll +++ b/llvm/test/Transforms/VectorCombine/X86/insert-binop-inseltpoison.ll @@ -232,3 +232,23 @@ define <4 x float> @ins3_ins3_fdiv(float %x, float %y) { %r = fdiv <4 x float> %i0, %i1 ret <4 x float> %r } + +; EEnsure we don't crash when erasing dead instructions. + +define i32 @pr155110(i32 %x) { +; CHECK-LABEL: @pr155110( +; CHECK-NEXT: entry: +; CHECK-NEXT: br label [[VECTOR_PH:%.*]] +; CHECK: vector.ph: +; CHECK-NEXT: br label [[VECTOR_PH]] +; +entry: + br label %vector.ph + +vector.ph: ; preds = %vector.ph, %entry + %phi = phi i32 [ 0, %entry ], [ %reduce, %vector.ph ] + %inselt = insertelement <4 x i32> poison, i32 %phi, i64 0 + %and = and <4 x i32> %inselt, zeroinitializer + %reduce = call i32 @llvm.vector.reduce.and.v4i32(<4 x i32> zeroinitializer) + br label %vector.ph +} From 35e56ab523ce1da41d897503958c79bccb63dee9 Mon Sep 17 00:00:00 2001 From: Yingwei Zheng Date: Sun, 24 Aug 2025 01:54:16 +0800 Subject: [PATCH 2/4] [VectorCombine] Fix typo. NFC. --- .../Transforms/VectorCombine/X86/insert-binop-inseltpoison.ll | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/llvm/test/Transforms/VectorCombine/X86/insert-binop-inseltpoison.ll b/llvm/test/Transforms/VectorCombine/X86/insert-binop-inseltpoison.ll index 6228b09884c03..31a6ebde5b1c6 100644 --- a/llvm/test/Transforms/VectorCombine/X86/insert-binop-inseltpoison.ll +++ b/llvm/test/Transforms/VectorCombine/X86/insert-binop-inseltpoison.ll @@ -233,7 +233,7 @@ define <4 x float> @ins3_ins3_fdiv(float %x, float %y) { ret <4 x float> %r } -; EEnsure we don't crash when erasing dead instructions. +; Ensure we don't crash when erasing dead instructions. define i32 @pr155110(i32 %x) { ; CHECK-LABEL: @pr155110( From 36f4de8ec674838798151f6637fe8da8b509982c Mon Sep 17 00:00:00 2001 From: Yingwei Zheng Date: Sun, 24 Aug 2025 12:39:47 +0800 Subject: [PATCH 3/4] [VectorCombine] Update comments. NFC. --- llvm/lib/Transforms/Vectorize/VectorCombine.cpp | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp index dbc4f57537821..2a63f548d5c01 100644 --- a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp +++ b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp @@ -4260,6 +4260,10 @@ bool VectorCombine::run() { if (!DT.isReachableFromEntry(&BB)) continue; // Use early increment range so that we can erase instructions in loop. + // make_early_inc_range is not applicable here, as the next iterator may + // be invalidated by RecursivelyDeleteTriviallyDeadInstructions. + // We manually maintain the next instruction and update it when it is about + // to be deleted. Instruction *I = &BB.front(); while (I) { NextInst = I->getNextNode(); From 08d2e9acfc27338d1972b24bdcb6578ecf6ef785 Mon Sep 17 00:00:00 2001 From: Yingwei Zheng Date: Mon, 25 Aug 2025 22:53:14 +0800 Subject: [PATCH 4/4] Drop braces. NFC. --- llvm/lib/Transforms/Vectorize/VectorCombine.cpp | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp index 2a63f548d5c01..77750f296fa89 100644 --- a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp +++ b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp @@ -4267,9 +4267,8 @@ bool VectorCombine::run() { Instruction *I = &BB.front(); while (I) { NextInst = I->getNextNode(); - if (!I->isDebugOrPseudoInst()) { + if (!I->isDebugOrPseudoInst()) MadeChange |= FoldInst(*I); - } I = NextInst; } }