[SCEV] inconsistent operand ordering

Hi,

I noticed an inconsistency in how ScalarEvolution orders instruction operands. This inconsistency can result in creation of separate (%a * %b) and (%b * %a) SCEVs as demonstrated by the example IR below (attached as gep-phi.ll)-

target datalayout = “e-m:e-p:32:32-f64:32:64-f80:32-n8:16:32-S128”

define void @foo(i8* nocapture %arr, i32 %n, i32* %A, i32* %B) local_unnamed_addr {

entry:

%cmp10 = icmp sgt i32 %n, 0

br i1 %cmp10, label %for.body.preheader, label %for.end

for.body.preheader: ; preds = %entry

%a = load i32, i32* %A, align 4

%b = load i32, i32* %B, align 4

%mul = mul nsw i32 %b, %a

%add.ptr = getelementptr inbounds i8, i8* %arr, i32 %mul

br label %for.body

for.body: ; preds = %for.body, %for.body.preheader

%q.012 = phi i8* [ %add.ptr2, %for.body ], [ %add.ptr, %for.body.preheader ]

%i.011 = phi i32 [ %inc, %for.body ], [ 0, %for.body.preheader ]

%conv = trunc i32 %i.011 to i8

store i8 %conv, i8* %q.012, align 1

%add.ptr2 = getelementptr inbounds i8, i8* %q.012, i32 %b

%inc = add nuw nsw i32 %i.011, 1

%exitcond = icmp eq i32 %inc, %n

br i1 %exitcond, label %for.end.loopexit, label %for.body

for.end.loopexit: ; preds = %for.body

br label %for.end

for.end: ; preds = %for.end.loopexit, %entry

ret void

}

For this IR, if I call getSCEV() in the following order-

1) getSCEV(%q.012)

  1. getSCEV(%add.ptr2)

3) getSCEV(%q.012)

The output I get is this-

{((%a * %b) + %arr),+,%b}<%for.body>

{(((1 + %a) * %b) + %arr),+,%b}<%for.body>

%q.012

Please note that we are getting a different SCEV for %q.012 based on the order of getSCEV() calls. This happens because in the second call to getSCEV(%q.012), ScalarEvolution tries to form the SCEV by shifting the SCEV of %add.ptr2 by performing this subtraction-

(((1 + %a) * %b) - %b)

This results in the creation of the swapped SCEV (%b * %a). A later pointer comparison between two (SCEV *) fails due to the presence of the swapped SCEV and we get the conservative SCEVUnknown %q.012.

The easiest way to reproduce the issue is to apply the attached se.patch to the compiler which changes the print function of ScalarEvolution to print in this particular order and then execute this-

$ opt -analyze -scalar-evolution gep-phi.ll

The root cause of this issue is the function CompareSCEVComplexity(). The ordering for instruction operands is not very robust as acknowledged by the comment for this particular piece of code-

// For instructions, compare their loop depth, and their operand

// count. This is pretty loose.

Can this be fixed?

Thanks,

Pankaj

se.patch (1.72 KB)

gep-phi.ll (1.19 KB)

Hi Pankaj,

Thanks for the detailed report and analysis. I think I've fixed this specific issue in 284501.

However, if you see more cases like this, please don't hesitate to bring them up -- the ordering logic in SCEV should definitely be smart enough to handle all real world cases.

-- Sanjoy

Thanks for fixing this Sanjoy!

I do have a few questions/suggestions on the fix if you don't mind.

1) Would this work correctly if the values are call instructions with no operands, like this-
%a = foo()
%b = bar()

2) From the way this function is set up, it looks like the emphasis is on saving compile time by trading off robustness. Is compile time such a big concern here that we want to fix this one test case at a time? We can perhaps use dominator logic to fix this once and for all.

3) When both instructions are in the same basic block, iterating the bblock and returning based on the instruction which is encountered first might be better.

Thanks,
Pankaj

Hi Pankaj,

Chawla, Pankaj wrote:

Thanks for fixing this Sanjoy!

I do have a few questions/suggestions on the fix if you don't mind.

1) Would this work correctly if the values are call instructions with no operands, like this-
%a = foo()
%b = bar()

2) From the way this function is set up, it looks like the emphasis is on saving compile time by trading off robustness. Is compile time such a big concern here that we want to fix this one test case at a time? We can perhaps use dominator logic to fix this once and for all.

For (1), in addition to the recursion, I think we'll need to differentiate between global variables.

For (2), I'm not quite sure what you mean by "dominator logic".

I agree with you generally: within reason, we should try to canonicalize as much as possible.

3) When both instructions are in the same basic block, iterating the bblock and returning based on the instruction which is encountered first might be better.

This was my first impulse, but I'll have to think about whether:

  a. It makes SCEV too fragile around instruction ordering -- we don't want divergent behavior triggered by seemingly innocent ordering differences.

  b. What obligations will then exist for passes that move instructions with a basic block, since that can now change the definition of canonical SCEV expressions.

-- Sanjoy

Thanks for the helpful reply!

I see that we are trying to keep ScalarEvolution stable around instruction ordering. My suggestion would be to not restrict the fix by only recursing on the first operand.

By "dominator logic" I meant that if all other 'cheap' checks fail, we should decide by walking the dominator tree to see which instruction's basic block is encountered first from the function entry block. But we obviously cannot use this if we want ScalarEvolution to be stable around 'simple' CFG changes.

Thanks,
Pankaj

Hi Pankaj,

LGTM.
Thanks for fixing this!

-Pankaj