LLVM  15.0.0git
InstCombineCompares.cpp
Go to the documentation of this file.
1 //===- InstCombineCompares.cpp --------------------------------------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file implements the visitICmp and visitFCmp functions.
10 //
11 //===----------------------------------------------------------------------===//
12 
13 #include "InstCombineInternal.h"
14 #include "llvm/ADT/APSInt.h"
15 #include "llvm/ADT/SetVector.h"
16 #include "llvm/ADT/Statistic.h"
20 #include "llvm/IR/ConstantRange.h"
21 #include "llvm/IR/DataLayout.h"
23 #include "llvm/IR/IntrinsicInst.h"
24 #include "llvm/IR/PatternMatch.h"
25 #include "llvm/Support/KnownBits.h"
27 
28 using namespace llvm;
29 using namespace PatternMatch;
30 
31 #define DEBUG_TYPE "instcombine"
32 
33 // How many times is a select replaced by one of its operands?
34 STATISTIC(NumSel, "Number of select opts");
35 
36 
37 /// Compute Result = In1+In2, returning true if the result overflowed for this
38 /// type.
39 static bool addWithOverflow(APInt &Result, const APInt &In1,
40  const APInt &In2, bool IsSigned = false) {
41  bool Overflow;
42  if (IsSigned)
43  Result = In1.sadd_ov(In2, Overflow);
44  else
45  Result = In1.uadd_ov(In2, Overflow);
46 
47  return Overflow;
48 }
49 
50 /// Compute Result = In1-In2, returning true if the result overflowed for this
51 /// type.
52 static bool subWithOverflow(APInt &Result, const APInt &In1,
53  const APInt &In2, bool IsSigned = false) {
54  bool Overflow;
55  if (IsSigned)
56  Result = In1.ssub_ov(In2, Overflow);
57  else
58  Result = In1.usub_ov(In2, Overflow);
59 
60  return Overflow;
61 }
62 
63 /// Given an icmp instruction, return true if any use of this comparison is a
64 /// branch on sign bit comparison.
65 static bool hasBranchUse(ICmpInst &I) {
66  for (auto *U : I.users())
67  if (isa<BranchInst>(U))
68  return true;
69  return false;
70 }
71 
72 /// Returns true if the exploded icmp can be expressed as a signed comparison
73 /// to zero and updates the predicate accordingly.
74 /// The signedness of the comparison is preserved.
75 /// TODO: Refactor with decomposeBitTestICmp()?
76 static bool isSignTest(ICmpInst::Predicate &Pred, const APInt &C) {
77  if (!ICmpInst::isSigned(Pred))
78  return false;
79 
80  if (C.isZero())
81  return ICmpInst::isRelational(Pred);
82 
83  if (C.isOne()) {
84  if (Pred == ICmpInst::ICMP_SLT) {
85  Pred = ICmpInst::ICMP_SLE;
86  return true;
87  }
88  } else if (C.isAllOnes()) {
89  if (Pred == ICmpInst::ICMP_SGT) {
90  Pred = ICmpInst::ICMP_SGE;
91  return true;
92  }
93  }
94 
95  return false;
96 }
97 
98 /// This is called when we see this pattern:
99 /// cmp pred (load (gep GV, ...)), cmpcst
100 /// where GV is a global variable with a constant initializer. Try to simplify
101 /// this into some simple computation that does not need the load. For example
102 /// we can optimize "icmp eq (load (gep "foo", 0, i)), 0" into "icmp eq i, 3".
103 ///
104 /// If AndCst is non-null, then the loaded value is masked with that constant
105 /// before doing the comparison. This handles cases like "A[i]&4 == 0".
108  ConstantInt *AndCst) {
109  if (LI->isVolatile() || LI->getType() != GEP->getResultElementType() ||
110  GV->getValueType() != GEP->getSourceElementType() ||
111  !GV->isConstant() || !GV->hasDefinitiveInitializer())
112  return nullptr;
113 
114  Constant *Init = GV->getInitializer();
115  if (!isa<ConstantArray>(Init) && !isa<ConstantDataArray>(Init))
116  return nullptr;
117 
118  uint64_t ArrayElementCount = Init->getType()->getArrayNumElements();
119  // Don't blow up on huge arrays.
120  if (ArrayElementCount > MaxArraySizeForCombine)
121  return nullptr;
122 
123  // There are many forms of this optimization we can handle, for now, just do
124  // the simple index into a single-dimensional array.
125  //
126  // Require: GEP GV, 0, i {{, constant indices}}
127  if (GEP->getNumOperands() < 3 ||
128  !isa<ConstantInt>(GEP->getOperand(1)) ||
129  !cast<ConstantInt>(GEP->getOperand(1))->isZero() ||
130  isa<Constant>(GEP->getOperand(2)))
131  return nullptr;
132 
133  // Check that indices after the variable are constants and in-range for the
134  // type they index. Collect the indices. This is typically for arrays of
135  // structs.
136  SmallVector<unsigned, 4> LaterIndices;
137 
138  Type *EltTy = Init->getType()->getArrayElementType();
139  for (unsigned i = 3, e = GEP->getNumOperands(); i != e; ++i) {
140  ConstantInt *Idx = dyn_cast<ConstantInt>(GEP->getOperand(i));
141  if (!Idx) return nullptr; // Variable index.
142 
143  uint64_t IdxVal = Idx->getZExtValue();
144  if ((unsigned)IdxVal != IdxVal) return nullptr; // Too large array index.
145 
146  if (StructType *STy = dyn_cast<StructType>(EltTy))
147  EltTy = STy->getElementType(IdxVal);
148  else if (ArrayType *ATy = dyn_cast<ArrayType>(EltTy)) {
149  if (IdxVal >= ATy->getNumElements()) return nullptr;
150  EltTy = ATy->getElementType();
151  } else {
152  return nullptr; // Unknown type.
153  }
154 
155  LaterIndices.push_back(IdxVal);
156  }
157 
158  enum { Overdefined = -3, Undefined = -2 };
159 
160  // Variables for our state machines.
161 
162  // FirstTrueElement/SecondTrueElement - Used to emit a comparison of the form
163  // "i == 47 | i == 87", where 47 is the first index the condition is true for,
164  // and 87 is the second (and last) index. FirstTrueElement is -2 when
165  // undefined, otherwise set to the first true element. SecondTrueElement is
166  // -2 when undefined, -3 when overdefined and >= 0 when that index is true.
167  int FirstTrueElement = Undefined, SecondTrueElement = Undefined;
168 
169  // FirstFalseElement/SecondFalseElement - Used to emit a comparison of the
170  // form "i != 47 & i != 87". Same state transitions as for true elements.
171  int FirstFalseElement = Undefined, SecondFalseElement = Undefined;
172 
173  /// TrueRangeEnd/FalseRangeEnd - In conjunction with First*Element, these
174  /// define a state machine that triggers for ranges of values that the index
175  /// is true or false for. This triggers on things like "abbbbc"[i] == 'b'.
176  /// This is -2 when undefined, -3 when overdefined, and otherwise the last
177  /// index in the range (inclusive). We use -2 for undefined here because we
178  /// use relative comparisons and don't want 0-1 to match -1.
179  int TrueRangeEnd = Undefined, FalseRangeEnd = Undefined;
180 
181  // MagicBitvector - This is a magic bitvector where we set a bit if the
182  // comparison is true for element 'i'. If there are 64 elements or less in
183  // the array, this will fully represent all the comparison results.
184  uint64_t MagicBitvector = 0;
185 
186  // Scan the array and see if one of our patterns matches.
187  Constant *CompareRHS = cast<Constant>(ICI.getOperand(1));
188  for (unsigned i = 0, e = ArrayElementCount; i != e; ++i) {
189  Constant *Elt = Init->getAggregateElement(i);
190  if (!Elt) return nullptr;
191 
192  // If this is indexing an array of structures, get the structure element.
193  if (!LaterIndices.empty())
194  Elt = ConstantExpr::getExtractValue(Elt, LaterIndices);
195 
196  // If the element is masked, handle it.
197  if (AndCst) Elt = ConstantExpr::getAnd(Elt, AndCst);
198 
199  // Find out if the comparison would be true or false for the i'th element.
201  CompareRHS, DL, &TLI);
202  // If the result is undef for this element, ignore it.
203  if (isa<UndefValue>(C)) {
204  // Extend range state machines to cover this element in case there is an
205  // undef in the middle of the range.
206  if (TrueRangeEnd == (int)i-1)
207  TrueRangeEnd = i;
208  if (FalseRangeEnd == (int)i-1)
209  FalseRangeEnd = i;
210  continue;
211  }
212 
213  // If we can't compute the result for any of the elements, we have to give
214  // up evaluating the entire conditional.
215  if (!isa<ConstantInt>(C)) return nullptr;
216 
217  // Otherwise, we know if the comparison is true or false for this element,
218  // update our state machines.
219  bool IsTrueForElt = !cast<ConstantInt>(C)->isZero();
220 
221  // State machine for single/double/range index comparison.
222  if (IsTrueForElt) {
223  // Update the TrueElement state machine.
224  if (FirstTrueElement == Undefined)
225  FirstTrueElement = TrueRangeEnd = i; // First true element.
226  else {
227  // Update double-compare state machine.
228  if (SecondTrueElement == Undefined)
229  SecondTrueElement = i;
230  else
231  SecondTrueElement = Overdefined;
232 
233  // Update range state machine.
234  if (TrueRangeEnd == (int)i-1)
235  TrueRangeEnd = i;
236  else
237  TrueRangeEnd = Overdefined;
238  }
239  } else {
240  // Update the FalseElement state machine.
241  if (FirstFalseElement == Undefined)
242  FirstFalseElement = FalseRangeEnd = i; // First false element.
243  else {
244  // Update double-compare state machine.
245  if (SecondFalseElement == Undefined)
246  SecondFalseElement = i;
247  else
248  SecondFalseElement = Overdefined;
249 
250  // Update range state machine.
251  if (FalseRangeEnd == (int)i-1)
252  FalseRangeEnd = i;
253  else
254  FalseRangeEnd = Overdefined;
255  }
256  }
257 
258  // If this element is in range, update our magic bitvector.
259  if (i < 64 && IsTrueForElt)
260  MagicBitvector |= 1ULL << i;
261 
262  // If all of our states become overdefined, bail out early. Since the
263  // predicate is expensive, only check it every 8 elements. This is only
264  // really useful for really huge arrays.
265  if ((i & 8) == 0 && i >= 64 && SecondTrueElement == Overdefined &&
266  SecondFalseElement == Overdefined && TrueRangeEnd == Overdefined &&
267  FalseRangeEnd == Overdefined)
268  return nullptr;
269  }
270 
271  // Now that we've scanned the entire array, emit our new comparison(s). We
272  // order the state machines in complexity of the generated code.
273  Value *Idx = GEP->getOperand(2);
274 
275  // If the index is larger than the pointer size of the target, truncate the
276  // index down like the GEP would do implicitly. We don't have to do this for
277  // an inbounds GEP because the index can't be out of range.
278  if (!GEP->isInBounds()) {
279  Type *IntPtrTy = DL.getIntPtrType(GEP->getType());
280  unsigned PtrSize = IntPtrTy->getIntegerBitWidth();
281  if (Idx->getType()->getPrimitiveSizeInBits().getFixedSize() > PtrSize)
282  Idx = Builder.CreateTrunc(Idx, IntPtrTy);
283  }
284 
285  // If inbounds keyword is not present, Idx * ElementSize can overflow.
286  // Let's assume that ElementSize is 2 and the wanted value is at offset 0.
287  // Then, there are two possible values for Idx to match offset 0:
288  // 0x00..00, 0x80..00.
289  // Emitting 'icmp eq Idx, 0' isn't correct in this case because the
290  // comparison is false if Idx was 0x80..00.
291  // We need to erase the highest countTrailingZeros(ElementSize) bits of Idx.
292  unsigned ElementSize =
293  DL.getTypeAllocSize(Init->getType()->getArrayElementType());
294  auto MaskIdx = [&](Value* Idx){
295  if (!GEP->isInBounds() && countTrailingZeros(ElementSize) != 0) {
296  Value *Mask = ConstantInt::get(Idx->getType(), -1);
297  Mask = Builder.CreateLShr(Mask, countTrailingZeros(ElementSize));
298  Idx = Builder.CreateAnd(Idx, Mask);
299  }
300  return Idx;
301  };
302 
303  // If the comparison is only true for one or two elements, emit direct
304  // comparisons.
305  if (SecondTrueElement != Overdefined) {
306  Idx = MaskIdx(Idx);
307  // None true -> false.
308  if (FirstTrueElement == Undefined)
309  return replaceInstUsesWith(ICI, Builder.getFalse());
310 
311  Value *FirstTrueIdx = ConstantInt::get(Idx->getType(), FirstTrueElement);
312 
313  // True for one element -> 'i == 47'.
314  if (SecondTrueElement == Undefined)
315  return new ICmpInst(ICmpInst::ICMP_EQ, Idx, FirstTrueIdx);
316 
317  // True for two elements -> 'i == 47 | i == 72'.
318  Value *C1 = Builder.CreateICmpEQ(Idx, FirstTrueIdx);
319  Value *SecondTrueIdx = ConstantInt::get(Idx->getType(), SecondTrueElement);
320  Value *C2 = Builder.CreateICmpEQ(Idx, SecondTrueIdx);
321  return BinaryOperator::CreateOr(C1, C2);
322  }
323 
324  // If the comparison is only false for one or two elements, emit direct
325  // comparisons.
326  if (SecondFalseElement != Overdefined) {
327  Idx = MaskIdx(Idx);
328  // None false -> true.
329  if (FirstFalseElement == Undefined)
330  return replaceInstUsesWith(ICI, Builder.getTrue());
331 
332  Value *FirstFalseIdx = ConstantInt::get(Idx->getType(), FirstFalseElement);
333 
334  // False for one element -> 'i != 47'.
335  if (SecondFalseElement == Undefined)
336  return new ICmpInst(ICmpInst::ICMP_NE, Idx, FirstFalseIdx);
337 
338  // False for two elements -> 'i != 47 & i != 72'.
339  Value *C1 = Builder.CreateICmpNE(Idx, FirstFalseIdx);
340  Value *SecondFalseIdx = ConstantInt::get(Idx->getType(),SecondFalseElement);
341  Value *C2 = Builder.CreateICmpNE(Idx, SecondFalseIdx);
342  return BinaryOperator::CreateAnd(C1, C2);
343  }
344 
345  // If the comparison can be replaced with a range comparison for the elements
346  // where it is true, emit the range check.
347  if (TrueRangeEnd != Overdefined) {
348  assert(TrueRangeEnd != FirstTrueElement && "Should emit single compare");
349  Idx = MaskIdx(Idx);
350 
351  // Generate (i-FirstTrue) <u (TrueRangeEnd-FirstTrue+1).
352  if (FirstTrueElement) {
353  Value *Offs = ConstantInt::get(Idx->getType(), -FirstTrueElement);
354  Idx = Builder.CreateAdd(Idx, Offs);
355  }
356 
357  Value *End = ConstantInt::get(Idx->getType(),
358  TrueRangeEnd-FirstTrueElement+1);
359  return new ICmpInst(ICmpInst::ICMP_ULT, Idx, End);
360  }
361 
362  // False range check.
363  if (FalseRangeEnd != Overdefined) {
364  assert(FalseRangeEnd != FirstFalseElement && "Should emit single compare");
365  Idx = MaskIdx(Idx);
366  // Generate (i-FirstFalse) >u (FalseRangeEnd-FirstFalse).
367  if (FirstFalseElement) {
368  Value *Offs = ConstantInt::get(Idx->getType(), -FirstFalseElement);
369  Idx = Builder.CreateAdd(Idx, Offs);
370  }
371 
372  Value *End = ConstantInt::get(Idx->getType(),
373  FalseRangeEnd-FirstFalseElement);
374  return new ICmpInst(ICmpInst::ICMP_UGT, Idx, End);
375  }
376 
377  // If a magic bitvector captures the entire comparison state
378  // of this load, replace it with computation that does:
379  // ((magic_cst >> i) & 1) != 0
380  {
381  Type *Ty = nullptr;
382 
383  // Look for an appropriate type:
384  // - The type of Idx if the magic fits
385  // - The smallest fitting legal type
386  if (ArrayElementCount <= Idx->getType()->getIntegerBitWidth())
387  Ty = Idx->getType();
388  else
389  Ty = DL.getSmallestLegalIntType(Init->getContext(), ArrayElementCount);
390 
391  if (Ty) {
392  Idx = MaskIdx(Idx);
393  Value *V = Builder.CreateIntCast(Idx, Ty, false);
394  V = Builder.CreateLShr(ConstantInt::get(Ty, MagicBitvector), V);
395  V = Builder.CreateAnd(ConstantInt::get(Ty, 1), V);
396  return new ICmpInst(ICmpInst::ICMP_NE, V, ConstantInt::get(Ty, 0));
397  }
398  }
399 
400  return nullptr;
401 }
402 
403 /// Return a value that can be used to compare the *offset* implied by a GEP to
404 /// zero. For example, if we have &A[i], we want to return 'i' for
405 /// "icmp ne i, 0". Note that, in general, indices can be complex, and scales
406 /// are involved. The above expression would also be legal to codegen as
407 /// "icmp ne (i*4), 0" (assuming A is a pointer to i32).
408 /// This latter form is less amenable to optimization though, and we are allowed
409 /// to generate the first by knowing that pointer arithmetic doesn't overflow.
410 ///
411 /// If we can't emit an optimized form for this expression, this returns null.
412 ///
414  const DataLayout &DL) {
416 
417  // Check to see if this gep only has a single variable index. If so, and if
418  // any constant indices are a multiple of its scale, then we can compute this
419  // in terms of the scale of the variable index. For example, if the GEP
420  // implies an offset of "12 + i*4", then we can codegen this as "3 + i",
421  // because the expression will cross zero at the same point.
422  unsigned i, e = GEP->getNumOperands();
423  int64_t Offset = 0;
424  for (i = 1; i != e; ++i, ++GTI) {
425  if (ConstantInt *CI = dyn_cast<ConstantInt>(GEP->getOperand(i))) {
426  // Compute the aggregate offset of constant indices.
427  if (CI->isZero()) continue;
428 
429  // Handle a struct index, which adds its field offset to the pointer.
430  if (StructType *STy = GTI.getStructTypeOrNull()) {
431  Offset += DL.getStructLayout(STy)->getElementOffset(CI->getZExtValue());
432  } else {
433  uint64_t Size = DL.getTypeAllocSize(GTI.getIndexedType());
434  Offset += Size*CI->getSExtValue();
435  }
436  } else {
437  // Found our variable index.
438  break;
439  }
440  }
441 
442  // If there are no variable indices, we must have a constant offset, just
443  // evaluate it the general way.
444  if (i == e) return nullptr;
445 
446  Value *VariableIdx = GEP->getOperand(i);
447  // Determine the scale factor of the variable element. For example, this is
448  // 4 if the variable index is into an array of i32.
449  uint64_t VariableScale = DL.getTypeAllocSize(GTI.getIndexedType());
450 
451  // Verify that there are no other variable indices. If so, emit the hard way.
452  for (++i, ++GTI; i != e; ++i, ++GTI) {
453  ConstantInt *CI = dyn_cast<ConstantInt>(GEP->getOperand(i));
454  if (!CI) return nullptr;
455 
456  // Compute the aggregate offset of constant indices.
457  if (CI->isZero()) continue;
458 
459  // Handle a struct index, which adds its field offset to the pointer.
460  if (StructType *STy = GTI.getStructTypeOrNull()) {
461  Offset += DL.getStructLayout(STy)->getElementOffset(CI->getZExtValue());
462  } else {
463  uint64_t Size = DL.getTypeAllocSize(GTI.getIndexedType());
464  Offset += Size*CI->getSExtValue();
465  }
466  }
467 
468  // Okay, we know we have a single variable index, which must be a
469  // pointer/array/vector index. If there is no offset, life is simple, return
470  // the index.
471  Type *IntPtrTy = DL.getIntPtrType(GEP->getOperand(0)->getType());
472  unsigned IntPtrWidth = IntPtrTy->getIntegerBitWidth();
473  if (Offset == 0) {
474  // Cast to intptrty in case a truncation occurs. If an extension is needed,
475  // we don't need to bother extending: the extension won't affect where the
476  // computation crosses zero.
477  if (VariableIdx->getType()->getPrimitiveSizeInBits().getFixedSize() >
478  IntPtrWidth) {
479  VariableIdx = IC.Builder.CreateTrunc(VariableIdx, IntPtrTy);
480  }
481  return VariableIdx;
482  }
483 
484  // Otherwise, there is an index. The computation we will do will be modulo
485  // the pointer size.
486  Offset = SignExtend64(Offset, IntPtrWidth);
487  VariableScale = SignExtend64(VariableScale, IntPtrWidth);
488 
489  // To do this transformation, any constant index must be a multiple of the
490  // variable scale factor. For example, we can evaluate "12 + 4*i" as "3 + i",
491  // but we can't evaluate "10 + 3*i" in terms of i. Check that the offset is a
492  // multiple of the variable scale.
493  int64_t NewOffs = Offset / (int64_t)VariableScale;
494  if (Offset != NewOffs*(int64_t)VariableScale)
495  return nullptr;
496 
497  // Okay, we can do this evaluation. Start by converting the index to intptr.
498  if (VariableIdx->getType() != IntPtrTy)
499  VariableIdx = IC.Builder.CreateIntCast(VariableIdx, IntPtrTy,
500  true /*Signed*/);
501  Constant *OffsetVal = ConstantInt::get(IntPtrTy, NewOffs);
502  return IC.Builder.CreateAdd(VariableIdx, OffsetVal, "offset");
503 }
504 
505 /// Returns true if we can rewrite Start as a GEP with pointer Base
506 /// and some integer offset. The nodes that need to be re-written
507 /// for this transformation will be added to Explored.
508 static bool canRewriteGEPAsOffset(Type *ElemTy, Value *Start, Value *Base,
509  const DataLayout &DL,
510  SetVector<Value *> &Explored) {
511  SmallVector<Value *, 16> WorkList(1, Start);
512  Explored.insert(Base);
513 
514  // The following traversal gives us an order which can be used
515  // when doing the final transformation. Since in the final
516  // transformation we create the PHI replacement instructions first,
517  // we don't have to get them in any particular order.
518  //
519  // However, for other instructions we will have to traverse the
520  // operands of an instruction first, which means that we have to
521  // do a post-order traversal.
522  while (!WorkList.empty()) {
524 
525  while (!WorkList.empty()) {
526  if (Explored.size() >= 100)
527  return false;
528 
529  Value *V = WorkList.back();
530 
531  if (Explored.contains(V)) {
532  WorkList.pop_back();
533  continue;
534  }
535 
536  if (!isa<IntToPtrInst>(V) && !isa<PtrToIntInst>(V) &&
537  !isa<GetElementPtrInst>(V) && !isa<PHINode>(V))
538  // We've found some value that we can't explore which is different from
539  // the base. Therefore we can't do this transformation.
540  return false;
541 
542  if (isa<IntToPtrInst>(V) || isa<PtrToIntInst>(V)) {
543  auto *CI = cast<CastInst>(V);
544  if (!CI->isNoopCast(DL))
545  return false;
546 
547  if (!Explored.contains(CI->getOperand(0)))
548  WorkList.push_back(CI->getOperand(0));
549  }
550 
551  if (auto *GEP = dyn_cast<GEPOperator>(V)) {
552  // We're limiting the GEP to having one index. This will preserve
553  // the original pointer type. We could handle more cases in the
554  // future.
555  if (GEP->getNumIndices() != 1 || !GEP->isInBounds() ||
556  GEP->getSourceElementType() != ElemTy)
557  return false;
558 
559  if (!Explored.contains(GEP->getOperand(0)))
560  WorkList.push_back(GEP->getOperand(0));
561  }
562 
563  if (WorkList.back() == V) {
564  WorkList.pop_back();
565  // We've finished visiting this node, mark it as such.
566  Explored.insert(V);
567  }
568 
569  if (auto *PN = dyn_cast<PHINode>(V)) {
570  // We cannot transform PHIs on unsplittable basic blocks.
571  if (isa<CatchSwitchInst>(PN->getParent()->getTerminator()))
572  return false;
573  Explored.insert(PN);
574  PHIs.insert(PN);
575  }
576  }
577 
578  // Explore the PHI nodes further.
579  for (auto *PN : PHIs)
580  for (Value *Op : PN->incoming_values())
581  if (!Explored.contains(Op))
582  WorkList.push_back(Op);
583  }
584 
585  // Make sure that we can do this. Since we can't insert GEPs in a basic
586  // block before a PHI node, we can't easily do this transformation if
587  // we have PHI node users of transformed instructions.
588  for (Value *Val : Explored) {
589  for (Value *Use : Val->uses()) {
590 
591  auto *PHI = dyn_cast<PHINode>(Use);
592  auto *Inst = dyn_cast<Instruction>(Val);
593 
594  if (Inst == Base || Inst == PHI || !Inst || !PHI ||
595  !Explored.contains(PHI))
596  continue;
597 
598  if (PHI->getParent() == Inst->getParent())
599  return false;
600  }
601  }
602  return true;
603 }
604 
605 // Sets the appropriate insert point on Builder where we can add
606 // a replacement Instruction for V (if that is possible).
608  bool Before = true) {
609  if (auto *PHI = dyn_cast<PHINode>(V)) {
610  Builder.SetInsertPoint(&*PHI->getParent()->getFirstInsertionPt());
611  return;
612  }
613  if (auto *I = dyn_cast<Instruction>(V)) {
614  if (!Before)
615  I = &*std::next(I->getIterator());
616  Builder.SetInsertPoint(I);
617  return;
618  }
619  if (auto *A = dyn_cast<Argument>(V)) {
620  // Set the insertion point in the entry block.
621  BasicBlock &Entry = A->getParent()->getEntryBlock();
622  Builder.SetInsertPoint(&*Entry.getFirstInsertionPt());
623  return;
624  }
625  // Otherwise, this is a constant and we don't need to set a new
626  // insertion point.
627  assert(isa<Constant>(V) && "Setting insertion point for unknown value!");
628 }
629 
630 /// Returns a re-written value of Start as an indexed GEP using Base as a
631 /// pointer.
632 static Value *rewriteGEPAsOffset(Type *ElemTy, Value *Start, Value *Base,
633  const DataLayout &DL,
634  SetVector<Value *> &Explored) {
635  // Perform all the substitutions. This is a bit tricky because we can
636  // have cycles in our use-def chains.
637  // 1. Create the PHI nodes without any incoming values.
638  // 2. Create all the other values.
639  // 3. Add the edges for the PHI nodes.
640  // 4. Emit GEPs to get the original pointers.
641  // 5. Remove the original instructions.
642  Type *IndexType = IntegerType::get(
643  Base->getContext(), DL.getIndexTypeSizeInBits(Start->getType()));
644 
646  NewInsts[Base] = ConstantInt::getNullValue(IndexType);
647 
648  // Create the new PHI nodes, without adding any incoming values.
649  for (Value *Val : Explored) {
650  if (Val == Base)
651  continue;
652  // Create empty phi nodes. This avoids cyclic dependencies when creating
653  // the remaining instructions.
654  if (auto *PHI = dyn_cast<PHINode>(Val))
655  NewInsts[PHI] = PHINode::Create(IndexType, PHI->getNumIncomingValues(),
656  PHI->getName() + ".idx", PHI);
657  }
658  IRBuilder<> Builder(Base->getContext());
659 
660  // Create all the other instructions.
661  for (Value *Val : Explored) {
662 
663  if (NewInsts.find(Val) != NewInsts.end())
664  continue;
665 
666  if (auto *CI = dyn_cast<CastInst>(Val)) {
667  // Don't get rid of the intermediate variable here; the store can grow
668  // the map which will invalidate the reference to the input value.
669  Value *V = NewInsts[CI->getOperand(0)];
670  NewInsts[CI] = V;
671  continue;
672  }
673  if (auto *GEP = dyn_cast<GEPOperator>(Val)) {
674  Value *Index = NewInsts[GEP->getOperand(1)] ? NewInsts[GEP->getOperand(1)]
675  : GEP->getOperand(1);
677  // Indices might need to be sign extended. GEPs will magically do
678  // this, but we need to do it ourselves here.
679  if (Index->getType()->getScalarSizeInBits() !=
680  NewInsts[GEP->getOperand(0)]->getType()->getScalarSizeInBits()) {
681  Index = Builder.CreateSExtOrTrunc(
682  Index, NewInsts[GEP->getOperand(0)]->getType(),
683  GEP->getOperand(0)->getName() + ".sext");
684  }
685 
686  auto *Op = NewInsts[GEP->getOperand(0)];
687  if (isa<ConstantInt>(Op) && cast<ConstantInt>(Op)->isZero())
688  NewInsts[GEP] = Index;
689  else
690  NewInsts[GEP] = Builder.CreateNSWAdd(
691  Op, Index, GEP->getOperand(0)->getName() + ".add");
692  continue;
693  }
694  if (isa<PHINode>(Val))
695  continue;
696 
697  llvm_unreachable("Unexpected instruction type");
698  }
699 
700  // Add the incoming values to the PHI nodes.
701  for (Value *Val : Explored) {
702  if (Val == Base)
703  continue;
704  // All the instructions have been created, we can now add edges to the
705  // phi nodes.
706  if (auto *PHI = dyn_cast<PHINode>(Val)) {
707  PHINode *NewPhi = static_cast<PHINode *>(NewInsts[PHI]);
708  for (unsigned I = 0, E = PHI->getNumIncomingValues(); I < E; ++I) {
709  Value *NewIncoming = PHI->getIncomingValue(I);
710 
711  if (NewInsts.find(NewIncoming) != NewInsts.end())
712  NewIncoming = NewInsts[NewIncoming];
713 
714  NewPhi->addIncoming(NewIncoming, PHI->getIncomingBlock(I));
715  }
716  }
717  }
718 
719  PointerType *PtrTy =
720  ElemTy->getPointerTo(Start->getType()->getPointerAddressSpace());
721  for (Value *Val : Explored) {
722  if (Val == Base)
723  continue;
724 
725  // Depending on the type, for external users we have to emit
726  // a GEP or a GEP + ptrtoint.
727  setInsertionPoint(Builder, Val, false);
728 
729  // Cast base to the expected type.
730  Value *NewVal = Builder.CreateBitOrPointerCast(
731  Base, PtrTy, Start->getName() + "to.ptr");
732  NewVal = Builder.CreateInBoundsGEP(
733  ElemTy, NewVal, makeArrayRef(NewInsts[Val]), Val->getName() + ".ptr");
734  NewVal = Builder.CreateBitOrPointerCast(
735  NewVal, Val->getType(), Val->getName() + ".conv");
736  Val->replaceAllUsesWith(NewVal);
737  }
738 
739  return NewInsts[Start];
740 }
741 
742 /// Looks through GEPs, IntToPtrInsts and PtrToIntInsts in order to express
743 /// the input Value as a constant indexed GEP. Returns a pair containing
744 /// the GEPs Pointer and Index.
745 static std::pair<Value *, Value *>
747  Type *IndexType = IntegerType::get(V->getContext(),
748  DL.getIndexTypeSizeInBits(V->getType()));
749 
751  while (true) {
752  if (GEPOperator *GEP = dyn_cast<GEPOperator>(V)) {
753  // We accept only inbouds GEPs here to exclude the possibility of
754  // overflow.
755  if (!GEP->isInBounds())
756  break;
757  if (GEP->hasAllConstantIndices() && GEP->getNumIndices() == 1 &&
758  GEP->getSourceElementType() == ElemTy) {
759  V = GEP->getOperand(0);
760  Constant *GEPIndex = static_cast<Constant *>(GEP->getOperand(1));
762  Index, ConstantExpr::getSExtOrTrunc(GEPIndex, IndexType));
763  continue;
764  }
765  break;
766  }
767  if (auto *CI = dyn_cast<IntToPtrInst>(V)) {
768  if (!CI->isNoopCast(DL))
769  break;
770  V = CI->getOperand(0);
771  continue;
772  }
773  if (auto *CI = dyn_cast<PtrToIntInst>(V)) {
774  if (!CI->isNoopCast(DL))
775  break;
776  V = CI->getOperand(0);
777  continue;
778  }
779  break;
780  }
781  return {V, Index};
782 }
783 
784 /// Converts (CMP GEPLHS, RHS) if this change would make RHS a constant.
785 /// We can look through PHIs, GEPs and casts in order to determine a common base
786 /// between GEPLHS and RHS.
789  const DataLayout &DL) {
790  // FIXME: Support vector of pointers.
791  if (GEPLHS->getType()->isVectorTy())
792  return nullptr;
793 
794  if (!GEPLHS->hasAllConstantIndices())
795  return nullptr;
796 
797  Type *ElemTy = GEPLHS->getSourceElementType();
798  Value *PtrBase, *Index;
799  std::tie(PtrBase, Index) = getAsConstantIndexedAddress(ElemTy, GEPLHS, DL);
800 
801  // The set of nodes that will take part in this transformation.
802  SetVector<Value *> Nodes;
803 
804  if (!canRewriteGEPAsOffset(ElemTy, RHS, PtrBase, DL, Nodes))
805  return nullptr;
806 
807  // We know we can re-write this as
808  // ((gep Ptr, OFFSET1) cmp (gep Ptr, OFFSET2)
809  // Since we've only looked through inbouds GEPs we know that we
810  // can't have overflow on either side. We can therefore re-write
811  // this as:
812  // OFFSET1 cmp OFFSET2
813  Value *NewRHS = rewriteGEPAsOffset(ElemTy, RHS, PtrBase, DL, Nodes);
814 
815  // RewriteGEPAsOffset has replaced RHS and all of its uses with a re-written
816  // GEP having PtrBase as the pointer base, and has returned in NewRHS the
817  // offset. Since Index is the offset of LHS to the base pointer, we will now
818  // compare the offsets instead of comparing the pointers.
819  return new ICmpInst(ICmpInst::getSignedPredicate(Cond), Index, NewRHS);
820 }
821 
822 /// Fold comparisons between a GEP instruction and something else. At this point
823 /// we know that the GEP is on the LHS of the comparison.
826  Instruction &I) {
827  // Don't transform signed compares of GEPs into index compares. Even if the
828  // GEP is inbounds, the final add of the base pointer can have signed overflow
829  // and would change the result of the icmp.
830  // e.g. "&foo[0] <s &foo[1]" can't be folded to "true" because "foo" could be
831  // the maximum signed value for the pointer type.
833  return nullptr;
834 
835  // Look through bitcasts and addrspacecasts. We do not however want to remove
836  // 0 GEPs.
837  if (!isa<GetElementPtrInst>(RHS))
839 
840  Value *PtrBase = GEPLHS->getOperand(0);
841  // FIXME: Support vector pointer GEPs.
842  if (PtrBase == RHS && GEPLHS->isInBounds() &&
843  !GEPLHS->getType()->isVectorTy()) {
844  // ((gep Ptr, OFFSET) cmp Ptr) ---> (OFFSET cmp 0).
845  // This transformation (ignoring the base and scales) is valid because we
846  // know pointers can't overflow since the gep is inbounds. See if we can
847  // output an optimized form.
848  Value *Offset = evaluateGEPOffsetExpression(GEPLHS, *this, DL);
849 
850  // If not, synthesize the offset the hard way.
851  if (!Offset)
852  Offset = EmitGEPOffset(GEPLHS);
853  return new ICmpInst(ICmpInst::getSignedPredicate(Cond), Offset,
854  Constant::getNullValue(Offset->getType()));
855  }
856 
857  if (GEPLHS->isInBounds() && ICmpInst::isEquality(Cond) &&
858  isa<Constant>(RHS) && cast<Constant>(RHS)->isNullValue() &&
859  !NullPointerIsDefined(I.getFunction(),
861  // For most address spaces, an allocation can't be placed at null, but null
862  // itself is treated as a 0 size allocation in the in bounds rules. Thus,
863  // the only valid inbounds address derived from null, is null itself.
864  // Thus, we have four cases to consider:
865  // 1) Base == nullptr, Offset == 0 -> inbounds, null
866  // 2) Base == nullptr, Offset != 0 -> poison as the result is out of bounds
867  // 3) Base != nullptr, Offset == (-base) -> poison (crossing allocations)
868  // 4) Base != nullptr, Offset != (-base) -> nonnull (and possibly poison)
869  //
870  // (Note if we're indexing a type of size 0, that simply collapses into one
871  // of the buckets above.)
872  //
873  // In general, we're allowed to make values less poison (i.e. remove
874  // sources of full UB), so in this case, we just select between the two
875  // non-poison cases (1 and 4 above).
876  //
877  // For vectors, we apply the same reasoning on a per-lane basis.
878  auto *Base = GEPLHS->getPointerOperand();
879  if (GEPLHS->getType()->isVectorTy() && Base->getType()->isPointerTy()) {
880  auto EC = cast<VectorType>(GEPLHS->getType())->getElementCount();
881  Base = Builder.CreateVectorSplat(EC, Base);
882  }
883  return new ICmpInst(Cond, Base,
885  cast<Constant>(RHS), Base->getType()));
886  } else if (GEPOperator *GEPRHS = dyn_cast<GEPOperator>(RHS)) {
887  // If the base pointers are different, but the indices are the same, just
888  // compare the base pointer.
889  if (PtrBase != GEPRHS->getOperand(0)) {
890  bool IndicesTheSame =
891  GEPLHS->getNumOperands() == GEPRHS->getNumOperands() &&
892  GEPLHS->getPointerOperand()->getType() ==
893  GEPRHS->getPointerOperand()->getType() &&
894  GEPLHS->getSourceElementType() == GEPRHS->getSourceElementType();
895  if (IndicesTheSame)
896  for (unsigned i = 1, e = GEPLHS->getNumOperands(); i != e; ++i)
897  if (GEPLHS->getOperand(i) != GEPRHS->getOperand(i)) {
898  IndicesTheSame = false;
899  break;
900  }
901 
902  // If all indices are the same, just compare the base pointers.
903  Type *BaseType = GEPLHS->getOperand(0)->getType();
904  if (IndicesTheSame && CmpInst::makeCmpResultType(BaseType) == I.getType())
905  return new ICmpInst(Cond, GEPLHS->getOperand(0), GEPRHS->getOperand(0));
906 
907  // If we're comparing GEPs with two base pointers that only differ in type
908  // and both GEPs have only constant indices or just one use, then fold
909  // the compare with the adjusted indices.
910  // FIXME: Support vector of pointers.
911  if (GEPLHS->isInBounds() && GEPRHS->isInBounds() &&
912  (GEPLHS->hasAllConstantIndices() || GEPLHS->hasOneUse()) &&
913  (GEPRHS->hasAllConstantIndices() || GEPRHS->hasOneUse()) &&
914  PtrBase->stripPointerCasts() ==
915  GEPRHS->getOperand(0)->stripPointerCasts() &&
916  !GEPLHS->getType()->isVectorTy()) {
917  Value *LOffset = EmitGEPOffset(GEPLHS);
918  Value *ROffset = EmitGEPOffset(GEPRHS);
919 
920  // If we looked through an addrspacecast between different sized address
921  // spaces, the LHS and RHS pointers are different sized
922  // integers. Truncate to the smaller one.
923  Type *LHSIndexTy = LOffset->getType();
924  Type *RHSIndexTy = ROffset->getType();
925  if (LHSIndexTy != RHSIndexTy) {
926  if (LHSIndexTy->getPrimitiveSizeInBits().getFixedSize() <
927  RHSIndexTy->getPrimitiveSizeInBits().getFixedSize()) {
928  ROffset = Builder.CreateTrunc(ROffset, LHSIndexTy);
929  } else
930  LOffset = Builder.CreateTrunc(LOffset, RHSIndexTy);
931  }
932 
933  Value *Cmp = Builder.CreateICmp(ICmpInst::getSignedPredicate(Cond),
934  LOffset, ROffset);
935  return replaceInstUsesWith(I, Cmp);
936  }
937 
938  // Otherwise, the base pointers are different and the indices are
939  // different. Try convert this to an indexed compare by looking through
940  // PHIs/casts.
941  return transformToIndexedCompare(GEPLHS, RHS, Cond, DL);
942  }
943 
944  // If one of the GEPs has all zero indices, recurse.
945  // FIXME: Handle vector of pointers.
946  if (!GEPLHS->getType()->isVectorTy() && GEPLHS->hasAllZeroIndices())
947  return foldGEPICmp(GEPRHS, GEPLHS->getOperand(0),
949 
950  // If the other GEP has all zero indices, recurse.
951  // FIXME: Handle vector of pointers.
952  if (!GEPRHS->getType()->isVectorTy() && GEPRHS->hasAllZeroIndices())
953  return foldGEPICmp(GEPLHS, GEPRHS->getOperand(0), Cond, I);
954 
955  bool GEPsInBounds = GEPLHS->isInBounds() && GEPRHS->isInBounds();
956  if (GEPLHS->getNumOperands() == GEPRHS->getNumOperands() &&
957  GEPLHS->getSourceElementType() == GEPRHS->getSourceElementType()) {
958  // If the GEPs only differ by one index, compare it.
959  unsigned NumDifferences = 0; // Keep track of # differences.
960  unsigned DiffOperand = 0; // The operand that differs.
961  for (unsigned i = 1, e = GEPRHS->getNumOperands(); i != e; ++i)
962  if (GEPLHS->getOperand(i) != GEPRHS->getOperand(i)) {
963  Type *LHSType = GEPLHS->getOperand(i)->getType();
964  Type *RHSType = GEPRHS->getOperand(i)->getType();
965  // FIXME: Better support for vector of pointers.
966  if (LHSType->getPrimitiveSizeInBits() !=
967  RHSType->getPrimitiveSizeInBits() ||
968  (GEPLHS->getType()->isVectorTy() &&
969  (!LHSType->isVectorTy() || !RHSType->isVectorTy()))) {
970  // Irreconcilable differences.
971  NumDifferences = 2;
972  break;
973  }
974 
975  if (NumDifferences++) break;
976  DiffOperand = i;
977  }
978 
979  if (NumDifferences == 0) // SAME GEP?
980  return replaceInstUsesWith(I, // No comparison is needed here.
982 
983  else if (NumDifferences == 1 && GEPsInBounds) {
984  Value *LHSV = GEPLHS->getOperand(DiffOperand);
985  Value *RHSV = GEPRHS->getOperand(DiffOperand);
986  // Make sure we do a signed comparison here.
987  return new ICmpInst(ICmpInst::getSignedPredicate(Cond), LHSV, RHSV);
988  }
989  }
990 
991  // Only lower this if the icmp is the only user of the GEP or if we expect
992  // the result to fold to a constant!
993  if (GEPsInBounds && (isa<ConstantExpr>(GEPLHS) || GEPLHS->hasOneUse()) &&
994  (isa<ConstantExpr>(GEPRHS) || GEPRHS->hasOneUse())) {
995  // ((gep Ptr, OFFSET1) cmp (gep Ptr, OFFSET2) ---> (OFFSET1 cmp OFFSET2)
996  Value *L = EmitGEPOffset(GEPLHS);
997  Value *R = EmitGEPOffset(GEPRHS);
998  return new ICmpInst(ICmpInst::getSignedPredicate(Cond), L, R);
999  }
1000  }
1001 
1002  // Try convert this to an indexed compare by looking through PHIs/casts as a
1003  // last resort.
1004  return transformToIndexedCompare(GEPLHS, RHS, Cond, DL);
1005 }
1006 
1008  const AllocaInst *Alloca) {
1009  assert(ICI.isEquality() && "Cannot fold non-equality comparison.");
1010 
1011  // It would be tempting to fold away comparisons between allocas and any
1012  // pointer not based on that alloca (e.g. an argument). However, even
1013  // though such pointers cannot alias, they can still compare equal.
1014  //
1015  // But LLVM doesn't specify where allocas get their memory, so if the alloca
1016  // doesn't escape we can argue that it's impossible to guess its value, and we
1017  // can therefore act as if any such guesses are wrong.
1018  //
1019  // The code below checks that the alloca doesn't escape, and that it's only
1020  // used in a comparison once (the current instruction). The
1021  // single-comparison-use condition ensures that we're trivially folding all
1022  // comparisons against the alloca consistently, and avoids the risk of
1023  // erroneously folding a comparison of the pointer with itself.
1024 
1025  unsigned MaxIter = 32; // Break cycles and bound to constant-time.
1026 
1028  for (const Use &U : Alloca->uses()) {
1029  if (Worklist.size() >= MaxIter)
1030  return nullptr;
1031  Worklist.push_back(&U);
1032  }
1033 
1034  unsigned NumCmps = 0;
1035  while (!Worklist.empty()) {
1036  assert(Worklist.size() <= MaxIter);
1037  const Use *U = Worklist.pop_back_val();
1038  const Value *V = U->getUser();
1039  --MaxIter;
1040 
1041  if (isa<BitCastInst>(V) || isa<GetElementPtrInst>(V) || isa<PHINode>(V) ||
1042  isa<SelectInst>(V)) {
1043  // Track the uses.
1044  } else if (isa<LoadInst>(V)) {
1045  // Loading from the pointer doesn't escape it.
1046  continue;
1047  } else if (const auto *SI = dyn_cast<StoreInst>(V)) {
1048  // Storing *to* the pointer is fine, but storing the pointer escapes it.
1049  if (SI->getValueOperand() == U->get())
1050  return nullptr;
1051  continue;
1052  } else if (isa<ICmpInst>(V)) {
1053  if (NumCmps++)
1054  return nullptr; // Found more than one cmp.
1055  continue;
1056  } else if (const auto *Intrin = dyn_cast<IntrinsicInst>(V)) {
1057  switch (Intrin->getIntrinsicID()) {
1058  // These intrinsics don't escape or compare the pointer. Memset is safe
1059  // because we don't allow ptrtoint. Memcpy and memmove are safe because
1060  // we don't allow stores, so src cannot point to V.
1061  case Intrinsic::lifetime_start: case Intrinsic::lifetime_end:
1062  case Intrinsic::memcpy: case Intrinsic::memmove: case Intrinsic::memset:
1063  continue;
1064  default:
1065  return nullptr;
1066  }
1067  } else {
1068  return nullptr;
1069  }
1070  for (const Use &U : V->uses()) {
1071  if (Worklist.size() >= MaxIter)
1072  return nullptr;
1073  Worklist.push_back(&U);
1074  }
1075  }
1076 
1077  auto *Res = ConstantInt::get(ICI.getType(),
1079  return replaceInstUsesWith(ICI, Res);
1080 }
1081 
1082 /// Fold "icmp pred (X+C), X".
1084  ICmpInst::Predicate Pred) {
1085  // From this point on, we know that (X+C <= X) --> (X+C < X) because C != 0,
1086  // so the values can never be equal. Similarly for all other "or equals"
1087  // operators.
1088  assert(!!C && "C should not be zero!");
1089 
1090  // (X+1) <u X --> X >u (MAXUINT-1) --> X == 255
1091  // (X+2) <u X --> X >u (MAXUINT-2) --> X > 253
1092  // (X+MAXUINT) <u X --> X >u (MAXUINT-MAXUINT) --> X != 0
1093  if (Pred == ICmpInst::ICMP_ULT || Pred == ICmpInst::ICMP_ULE) {
1094  Constant *R = ConstantInt::get(X->getType(),
1095  APInt::getMaxValue(C.getBitWidth()) - C);
1096  return new ICmpInst(ICmpInst::ICMP_UGT, X, R);
1097  }
1098 
1099  // (X+1) >u X --> X <u (0-1) --> X != 255
1100  // (X+2) >u X --> X <u (0-2) --> X <u 254
1101  // (X+MAXUINT) >u X --> X <u (0-MAXUINT) --> X <u 1 --> X == 0
1102  if (Pred == ICmpInst::ICMP_UGT || Pred == ICmpInst::ICMP_UGE)
1103  return new ICmpInst(ICmpInst::ICMP_ULT, X,
1104  ConstantInt::get(X->getType(), -C));
1105 
1106  APInt SMax = APInt::getSignedMaxValue(C.getBitWidth());
1107 
1108  // (X+ 1) <s X --> X >s (MAXSINT-1) --> X == 127
1109  // (X+ 2) <s X --> X >s (MAXSINT-2) --> X >s 125
1110  // (X+MAXSINT) <s X --> X >s (MAXSINT-MAXSINT) --> X >s 0
1111  // (X+MINSINT) <s X --> X >s (MAXSINT-MINSINT) --> X >s -1
1112  // (X+ -2) <s X --> X >s (MAXSINT- -2) --> X >s 126
1113  // (X+ -1) <s X --> X >s (MAXSINT- -1) --> X != 127
1114  if (Pred == ICmpInst::ICMP_SLT || Pred == ICmpInst::ICMP_SLE)
1115  return new ICmpInst(ICmpInst::ICMP_SGT, X,
1116  ConstantInt::get(X->getType(), SMax - C));
1117 
1118  // (X+ 1) >s X --> X <s (MAXSINT-(1-1)) --> X != 127
1119  // (X+ 2) >s X --> X <s (MAXSINT-(2-1)) --> X <s 126
1120  // (X+MAXSINT) >s X --> X <s (MAXSINT-(MAXSINT-1)) --> X <s 1
1121  // (X+MINSINT) >s X --> X <s (MAXSINT-(MINSINT-1)) --> X <s -2
1122  // (X+ -2) >s X --> X <s (MAXSINT-(-2-1)) --> X <s -126
1123  // (X+ -1) >s X --> X <s (MAXSINT-(-1-1)) --> X == -128
1124 
1125  assert(Pred == ICmpInst::ICMP_SGT || Pred == ICmpInst::ICMP_SGE);
1126  return new ICmpInst(ICmpInst::ICMP_SLT, X,
1127  ConstantInt::get(X->getType(), SMax - (C - 1)));
1128 }
1129 
1130 /// Handle "(icmp eq/ne (ashr/lshr AP2, A), AP1)" ->
1131 /// (icmp eq/ne A, Log2(AP2/AP1)) ->
1132 /// (icmp eq/ne A, Log2(AP2) - Log2(AP1)).
1134  const APInt &AP1,
1135  const APInt &AP2) {
1136  assert(I.isEquality() && "Cannot fold icmp gt/lt");
1137 
1138  auto getICmp = [&I](CmpInst::Predicate Pred, Value *LHS, Value *RHS) {
1139  if (I.getPredicate() == I.ICMP_NE)
1140  Pred = CmpInst::getInversePredicate(Pred);
1141  return new ICmpInst(Pred, LHS, RHS);
1142  };
1143 
1144  // Don't bother doing any work for cases which InstSimplify handles.
1145  if (AP2.isZero())
1146  return nullptr;
1147 
1148  bool IsAShr = isa<AShrOperator>(I.getOperand(0));
1149  if (IsAShr) {
1150  if (AP2.isAllOnes())
1151  return nullptr;
1152  if (AP2.isNegative() != AP1.isNegative())
1153  return nullptr;
1154  if (AP2.sgt(AP1))
1155  return nullptr;
1156  }
1157 
1158  if (!AP1)
1159  // 'A' must be large enough to shift out the highest set bit.
1160  return getICmp(I.ICMP_UGT, A,
1161  ConstantInt::get(A->getType(), AP2.logBase2()));
1162 
1163  if (AP1 == AP2)
1164  return getICmp(I.ICMP_EQ, A, ConstantInt::getNullValue(A->getType()));
1165 
1166  int Shift;
1167  if (IsAShr && AP1.isNegative())
1168  Shift = AP1.countLeadingOnes() - AP2.countLeadingOnes();
1169  else
1170  Shift = AP1.countLeadingZeros() - AP2.countLeadingZeros();
1171 
1172  if (Shift > 0) {
1173  if (IsAShr && AP1 == AP2.ashr(Shift)) {
1174  // There are multiple solutions if we are comparing against -1 and the LHS
1175  // of the ashr is not a power of two.
1176  if (AP1.isAllOnes() && !AP2.isPowerOf2())
1177  return getICmp(I.ICMP_UGE, A, ConstantInt::get(A->getType(), Shift));
1178  return getICmp(I.ICMP_EQ, A, ConstantInt::get(A->getType(), Shift));
1179  } else if (AP1 == AP2.lshr(Shift)) {
1180  return getICmp(I.ICMP_EQ, A, ConstantInt::get(A->getType(), Shift));
1181  }
1182  }
1183 
1184  // Shifting const2 will never be equal to const1.
1185  // FIXME: This should always be handled by InstSimplify?
1186  auto *TorF = ConstantInt::get(I.getType(), I.getPredicate() == I.ICMP_NE);
1187  return replaceInstUsesWith(I, TorF);
1188 }
1189 
1190 /// Handle "(icmp eq/ne (shl AP2, A), AP1)" ->
1191 /// (icmp eq/ne A, TrailingZeros(AP1) - TrailingZeros(AP2)).
1193  const APInt &AP1,
1194  const APInt &AP2) {
1195  assert(I.isEquality() && "Cannot fold icmp gt/lt");
1196 
1197  auto getICmp = [&I](CmpInst::Predicate Pred, Value *LHS, Value *RHS) {
1198  if (I.getPredicate() == I.ICMP_NE)
1199  Pred = CmpInst::getInversePredicate(Pred);
1200  return new ICmpInst(Pred, LHS, RHS);
1201  };
1202 
1203  // Don't bother doing any work for cases which InstSimplify handles.
1204  if (AP2.isZero())
1205  return nullptr;
1206 
1207  unsigned AP2TrailingZeros = AP2.countTrailingZeros();
1208 
1209  if (!AP1 && AP2TrailingZeros != 0)
1210  return getICmp(
1211  I.ICMP_UGE, A,
1212  ConstantInt::get(A->getType(), AP2.getBitWidth() - AP2TrailingZeros));
1213 
1214  if (AP1 == AP2)
1215  return getICmp(I.ICMP_EQ, A, ConstantInt::getNullValue(A->getType()));
1216 
1217  // Get the distance between the lowest bits that are set.
1218  int Shift = AP1.countTrailingZeros() - AP2TrailingZeros;
1219 
1220  if (Shift > 0 && AP2.shl(Shift) == AP1)
1221  return getICmp(I.ICMP_EQ, A, ConstantInt::get(A->getType(), Shift));
1222 
1223  // Shifting const2 will never be equal to const1.
1224  // FIXME: This should always be handled by InstSimplify?
1225  auto *TorF = ConstantInt::get(I.getType(), I.getPredicate() == I.ICMP_NE);
1226  return replaceInstUsesWith(I, TorF);
1227 }
1228 
1229 /// The caller has matched a pattern of the form:
1230 /// I = icmp ugt (add (add A, B), CI2), CI1
1231 /// If this is of the form:
1232 /// sum = a + b
1233 /// if (sum+128 >u 255)
1234 /// Then replace it with llvm.sadd.with.overflow.i8.
1235 ///
1237  ConstantInt *CI2, ConstantInt *CI1,
1238  InstCombinerImpl &IC) {
1239  // The transformation we're trying to do here is to transform this into an
1240  // llvm.sadd.with.overflow. To do this, we have to replace the original add
1241  // with a narrower add, and discard the add-with-constant that is part of the
1242  // range check (if we can't eliminate it, this isn't profitable).
1243 
1244  // In order to eliminate the add-with-constant, the compare can be its only
1245  // use.
1246  Instruction *AddWithCst = cast<Instruction>(I.getOperand(0));
1247  if (!AddWithCst->hasOneUse())
1248  return nullptr;
1249 
1250  // If CI2 is 2^7, 2^15, 2^31, then it might be an sadd.with.overflow.
1251  if (!CI2->getValue().isPowerOf2())
1252  return nullptr;
1253  unsigned NewWidth = CI2->getValue().countTrailingZeros();
1254  if (NewWidth != 7 && NewWidth != 15 && NewWidth != 31)
1255  return nullptr;
1256 
1257  // The width of the new add formed is 1 more than the bias.
1258  ++NewWidth;
1259 
1260  // Check to see that CI1 is an all-ones value with NewWidth bits.
1261  if (CI1->getBitWidth() == NewWidth ||
1262  CI1->getValue() != APInt::getLowBitsSet(CI1->getBitWidth(), NewWidth))
1263  return nullptr;
1264 
1265  // This is only really a signed overflow check if the inputs have been
1266  // sign-extended; check for that condition. For example, if CI2 is 2^31 and
1267  // the operands of the add are 64 bits wide, we need at least 33 sign bits.
1268  if (IC.ComputeMaxSignificantBits(A, 0, &I) > NewWidth ||
1269  IC.ComputeMaxSignificantBits(B, 0, &I) > NewWidth)
1270  return nullptr;
1271 
1272  // In order to replace the original add with a narrower
1273  // llvm.sadd.with.overflow, the only uses allowed are the add-with-constant
1274  // and truncates that discard the high bits of the add. Verify that this is
1275  // the case.
1276  Instruction *OrigAdd = cast<Instruction>(AddWithCst->getOperand(0));
1277  for (User *U : OrigAdd->users()) {
1278  if (U == AddWithCst)
1279  continue;
1280 
1281  // Only accept truncates for now. We would really like a nice recursive
1282  // predicate like SimplifyDemandedBits, but which goes downwards the use-def
1283  // chain to see which bits of a value are actually demanded. If the
1284  // original add had another add which was then immediately truncated, we
1285  // could still do the transformation.
1286  TruncInst *TI = dyn_cast<TruncInst>(U);
1287  if (!TI || TI->getType()->getPrimitiveSizeInBits() > NewWidth)
1288  return nullptr;
1289  }
1290 
1291  // If the pattern matches, truncate the inputs to the narrower type and
1292  // use the sadd_with_overflow intrinsic to efficiently compute both the
1293  // result and the overflow bit.
1294  Type *NewType = IntegerType::get(OrigAdd->getContext(), NewWidth);
1296  I.getModule(), Intrinsic::sadd_with_overflow, NewType);
1297 
1299 
1300  // Put the new code above the original add, in case there are any uses of the
1301  // add between the add and the compare.
1302  Builder.SetInsertPoint(OrigAdd);
1303 
1304  Value *TruncA = Builder.CreateTrunc(A, NewType, A->getName() + ".trunc");
1305  Value *TruncB = Builder.CreateTrunc(B, NewType, B->getName() + ".trunc");
1306  CallInst *Call = Builder.CreateCall(F, {TruncA, TruncB}, "sadd");
1307  Value *Add = Builder.CreateExtractValue(Call, 0, "sadd.result");
1308  Value *ZExt = Builder.CreateZExt(Add, OrigAdd->getType());
1309 
1310  // The inner add was the result of the narrow add, zero extended to the
1311  // wider type. Replace it with the result computed by the intrinsic.
1312  IC.replaceInstUsesWith(*OrigAdd, ZExt);
1313  IC.eraseInstFromFunction(*OrigAdd);
1314 
1315  // The original icmp gets replaced with the overflow value.
1316  return ExtractValueInst::Create(Call, 1, "sadd.overflow");
1317 }
1318 
1319 /// If we have:
1320 /// icmp eq/ne (urem/srem %x, %y), 0
1321 /// iff %y is a power-of-two, we can replace this with a bit test:
1322 /// icmp eq/ne (and %x, (add %y, -1)), 0
1324  // This fold is only valid for equality predicates.
1325  if (!I.isEquality())
1326  return nullptr;
1327  ICmpInst::Predicate Pred;
1328  Value *X, *Y, *Zero;
1329  if (!match(&I, m_ICmp(Pred, m_OneUse(m_IRem(m_Value(X), m_Value(Y))),
1330  m_CombineAnd(m_Zero(), m_Value(Zero)))))
1331  return nullptr;
1332  if (!isKnownToBeAPowerOfTwo(Y, /*OrZero*/ true, 0, &I))
1333  return nullptr;
1334  // This may increase instruction count, we don't enforce that Y is a constant.
1335  Value *Mask = Builder.CreateAdd(Y, Constant::getAllOnesValue(Y->getType()));
1336  Value *Masked = Builder.CreateAnd(X, Mask);
1337  return ICmpInst::Create(Instruction::ICmp, Pred, Masked, Zero);
1338 }
1339 
1340 /// Fold equality-comparison between zero and any (maybe truncated) right-shift
1341 /// by one-less-than-bitwidth into a sign test on the original value.
1343  Instruction *Val;
1344  ICmpInst::Predicate Pred;
1345  if (!I.isEquality() || !match(&I, m_ICmp(Pred, m_Instruction(Val), m_Zero())))
1346  return nullptr;
1347 
1348  Value *X;
1349  Type *XTy;
1350 
1351  Constant *C;
1352  if (match(Val, m_TruncOrSelf(m_Shr(m_Value(X), m_Constant(C))))) {
1353  XTy = X->getType();
1354  unsigned XBitWidth = XTy->getScalarSizeInBits();
1355  if (!match(C, m_SpecificInt_ICMP(ICmpInst::Predicate::ICMP_EQ,
1356  APInt(XBitWidth, XBitWidth - 1))))
1357  return nullptr;
1358  } else if (isa<BinaryOperator>(Val) &&
1359  (X = reassociateShiftAmtsOfTwoSameDirectionShifts(
1360  cast<BinaryOperator>(Val), SQ.getWithInstruction(Val),
1361  /*AnalyzeForSignBitExtraction=*/true))) {
1362  XTy = X->getType();
1363  } else
1364  return nullptr;
1365 
1366  return ICmpInst::Create(Instruction::ICmp,
1370 }
1371 
1372 // Handle icmp pred X, 0
1374  CmpInst::Predicate Pred = Cmp.getPredicate();
1375  if (!match(Cmp.getOperand(1), m_Zero()))
1376  return nullptr;
1377 
1378  // (icmp sgt smin(PosA, B) 0) -> (icmp sgt B 0)
1379  if (Pred == ICmpInst::ICMP_SGT) {
1380  Value *A, *B;
1381  if (match(Cmp.getOperand(0), m_SMin(m_Value(A), m_Value(B)))) {
1382  if (isKnownPositive(A, DL, 0, &AC, &Cmp, &DT))
1383  return new ICmpInst(Pred, B, Cmp.getOperand(1));
1384  if (isKnownPositive(B, DL, 0, &AC, &Cmp, &DT))
1385  return new ICmpInst(Pred, A, Cmp.getOperand(1));
1386  }
1387  }
1388 
1389  if (Instruction *New = foldIRemByPowerOfTwoToBitTest(Cmp))
1390  return New;
1391 
1392  // Given:
1393  // icmp eq/ne (urem %x, %y), 0
1394  // Iff %x has 0 or 1 bits set, and %y has at least 2 bits set, omit 'urem':
1395  // icmp eq/ne %x, 0
1396  Value *X, *Y;
1397  if (match(Cmp.getOperand(0), m_URem(m_Value(X), m_Value(Y))) &&
1398  ICmpInst::isEquality(Pred)) {
1399  KnownBits XKnown = computeKnownBits(X, 0, &Cmp);
1400  KnownBits YKnown = computeKnownBits(Y, 0, &Cmp);
1401  if (XKnown.countMaxPopulation() == 1 && YKnown.countMinPopulation() >= 2)
1402  return new ICmpInst(Pred, X, Cmp.getOperand(1));
1403  }
1404 
1405  return nullptr;
1406 }
1407 
1408 /// Fold icmp Pred X, C.
1409 /// TODO: This code structure does not make sense. The saturating add fold
1410 /// should be moved to some other helper and extended as noted below (it is also
1411 /// possible that code has been made unnecessary - do we canonicalize IR to
1412 /// overflow/saturating intrinsics or not?).
1414  // Match the following pattern, which is a common idiom when writing
1415  // overflow-safe integer arithmetic functions. The source performs an addition
1416  // in wider type and explicitly checks for overflow using comparisons against
1417  // INT_MIN and INT_MAX. Simplify by using the sadd_with_overflow intrinsic.
1418  //
1419  // TODO: This could probably be generalized to handle other overflow-safe
1420  // operations if we worked out the formulas to compute the appropriate magic
1421  // constants.
1422  //
1423  // sum = a + b
1424  // if (sum+128 >u 255) ... -> llvm.sadd.with.overflow.i8
1425  CmpInst::Predicate Pred = Cmp.getPredicate();
1426  Value *Op0 = Cmp.getOperand(0), *Op1 = Cmp.getOperand(1);
1427  Value *A, *B;
1428  ConstantInt *CI, *CI2; // I = icmp ugt (add (add A, B), CI2), CI
1429  if (Pred == ICmpInst::ICMP_UGT && match(Op1, m_ConstantInt(CI)) &&
1430  match(Op0, m_Add(m_Add(m_Value(A), m_Value(B)), m_ConstantInt(CI2))))
1431  if (Instruction *Res = processUGT_ADDCST_ADD(Cmp, A, B, CI2, CI, *this))
1432  return Res;
1433 
1434  // icmp(phi(C1, C2, ...), C) -> phi(icmp(C1, C), icmp(C2, C), ...).
1435  Constant *C = dyn_cast<Constant>(Op1);
1436  if (!C || C->canTrap())
1437  return nullptr;
1438 
1439  if (auto *Phi = dyn_cast<PHINode>(Op0))
1440  if (all_of(Phi->operands(), [](Value *V) { return isa<Constant>(V); })) {
1441  Type *Ty = Cmp.getType();
1442  Builder.SetInsertPoint(Phi);
1443  PHINode *NewPhi =
1444  Builder.CreatePHI(Ty, Phi->getNumOperands());
1445  for (BasicBlock *Predecessor : predecessors(Phi->getParent())) {
1446  auto *Input =
1447  cast<Constant>(Phi->getIncomingValueForBlock(Predecessor));
1448  auto *BoolInput = ConstantExpr::getCompare(Pred, Input, C);
1449  NewPhi->addIncoming(BoolInput, Predecessor);
1450  }
1451  NewPhi->takeName(&Cmp);
1452  return replaceInstUsesWith(Cmp, NewPhi);
1453  }
1454 
1455  return nullptr;
1456 }
1457 
1458 /// Canonicalize icmp instructions based on dominating conditions.
1460  // This is a cheap/incomplete check for dominance - just match a single
1461  // predecessor with a conditional branch.
1462  BasicBlock *CmpBB = Cmp.getParent();
1463  BasicBlock *DomBB = CmpBB->getSinglePredecessor();
1464  if (!DomBB)
1465  return nullptr;
1466 
1467  Value *DomCond;
1468  BasicBlock *TrueBB, *FalseBB;
1469  if (!match(DomBB->getTerminator(), m_Br(m_Value(DomCond), TrueBB, FalseBB)))
1470  return nullptr;
1471 
1472  assert((TrueBB == CmpBB || FalseBB == CmpBB) &&
1473  "Predecessor block does not point to successor?");
1474 
1475  // The branch should get simplified. Don't bother simplifying this condition.
1476  if (TrueBB == FalseBB)
1477  return nullptr;
1478 
1479  // Try to simplify this compare to T/F based on the dominating condition.
1480  Optional<bool> Imp = isImpliedCondition(DomCond, &Cmp, DL, TrueBB == CmpBB);
1481  if (Imp)
1482  return replaceInstUsesWith(Cmp, ConstantInt::get(Cmp.getType(), *Imp));
1483 
1484  CmpInst::Predicate Pred = Cmp.getPredicate();
1485  Value *X = Cmp.getOperand(0), *Y = Cmp.getOperand(1);
1486  ICmpInst::Predicate DomPred;
1487  const APInt *C, *DomC;
1488  if (match(DomCond, m_ICmp(DomPred, m_Specific(X), m_APInt(DomC))) &&
1489  match(Y, m_APInt(C))) {
1490  // We have 2 compares of a variable with constants. Calculate the constant
1491  // ranges of those compares to see if we can transform the 2nd compare:
1492  // DomBB:
1493  // DomCond = icmp DomPred X, DomC
1494  // br DomCond, CmpBB, FalseBB
1495  // CmpBB:
1496  // Cmp = icmp Pred X, C
1498  ConstantRange DominatingCR =
1499  (CmpBB == TrueBB) ? ConstantRange::makeExactICmpRegion(DomPred, *DomC)
1501  CmpInst::getInversePredicate(DomPred), *DomC);
1502  ConstantRange Intersection = DominatingCR.intersectWith(CR);
1503  ConstantRange Difference = DominatingCR.difference(CR);
1504  if (Intersection.isEmptySet())
1505  return replaceInstUsesWith(Cmp, Builder.getFalse());
1506  if (Difference.isEmptySet())
1507  return replaceInstUsesWith(Cmp, Builder.getTrue());
1508 
1509  // Canonicalizing a sign bit comparison that gets used in a branch,
1510  // pessimizes codegen by generating branch on zero instruction instead
1511  // of a test and branch. So we avoid canonicalizing in such situations
1512  // because test and branch instruction has better branch displacement
1513  // than compare and branch instruction.
1514  bool UnusedBit;
1515  bool IsSignBit = isSignBitCheck(Pred, *C, UnusedBit);
1516  if (Cmp.isEquality() || (IsSignBit && hasBranchUse(Cmp)))
1517  return nullptr;
1518 
1519  // Avoid an infinite loop with min/max canonicalization.
1520  // TODO: This will be unnecessary if we canonicalize to min/max intrinsics.
1521  if (Cmp.hasOneUse() &&
1522  match(Cmp.user_back(), m_MaxOrMin(m_Value(), m_Value())))
1523  return nullptr;
1524 
1525  if (const APInt *EqC = Intersection.getSingleElement())
1526  return new ICmpInst(ICmpInst::ICMP_EQ, X, Builder.getInt(*EqC));
1527  if (const APInt *NeC = Difference.getSingleElement())
1528  return new ICmpInst(ICmpInst::ICMP_NE, X, Builder.getInt(*NeC));
1529  }
1530 
1531  return nullptr;
1532 }
1533 
1534 /// Fold icmp (trunc X, Y), C.
1536  TruncInst *Trunc,
1537  const APInt &C) {
1538  ICmpInst::Predicate Pred = Cmp.getPredicate();
1539  Value *X = Trunc->getOperand(0);
1540  if (C.isOne() && C.getBitWidth() > 1) {
1541  // icmp slt trunc(signum(V)) 1 --> icmp slt V, 1
1542  Value *V = nullptr;
1543  if (Pred == ICmpInst::ICMP_SLT && match(X, m_Signum(m_Value(V))))
1544  return new ICmpInst(ICmpInst::ICMP_SLT, V,
1545  ConstantInt::get(V->getType(), 1));
1546  }
1547 
1548  unsigned DstBits = Trunc->getType()->getScalarSizeInBits(),
1549  SrcBits = X->getType()->getScalarSizeInBits();
1550  if (Cmp.isEquality() && Trunc->hasOneUse()) {
1551  // Simplify icmp eq (trunc x to i8), 42 -> icmp eq x, 42|highbits if all
1552  // of the high bits truncated out of x are known.
1553  KnownBits Known = computeKnownBits(X, 0, &Cmp);
1554 
1555  // If all the high bits are known, we can do this xform.
1556  if ((Known.Zero | Known.One).countLeadingOnes() >= SrcBits - DstBits) {
1557  // Pull in the high bits from known-ones set.
1558  APInt NewRHS = C.zext(SrcBits);
1559  NewRHS |= Known.One & APInt::getHighBitsSet(SrcBits, SrcBits - DstBits);
1560  return new ICmpInst(Pred, X, ConstantInt::get(X->getType(), NewRHS));
1561  }
1562  }
1563 
1564  // Look through truncated right-shift of the sign-bit for a sign-bit check:
1565  // trunc iN (ShOp >> ShAmtC) to i[N - ShAmtC] < 0 --> ShOp < 0
1566  // trunc iN (ShOp >> ShAmtC) to i[N - ShAmtC] > -1 --> ShOp > -1
1567  Value *ShOp;
1568  const APInt *ShAmtC;
1569  bool TrueIfSigned;
1570  if (isSignBitCheck(Pred, C, TrueIfSigned) &&
1571  match(X, m_Shr(m_Value(ShOp), m_APInt(ShAmtC))) &&
1572  DstBits == SrcBits - ShAmtC->getZExtValue()) {
1573  return TrueIfSigned
1574  ? new ICmpInst(ICmpInst::ICMP_SLT, ShOp,
1575  ConstantInt::getNullValue(X->getType()))
1576  : new ICmpInst(ICmpInst::ICMP_SGT, ShOp,
1577  ConstantInt::getAllOnesValue(X->getType()));
1578  }
1579 
1580  return nullptr;
1581 }
1582 
1583 /// Fold icmp (xor X, Y), C.
1585  BinaryOperator *Xor,
1586  const APInt &C) {
1587  Value *X = Xor->getOperand(0);
1588  Value *Y = Xor->getOperand(1);
1589  const APInt *XorC;
1590  if (!match(Y, m_APInt(XorC)))
1591  return nullptr;
1592 
1593  // If this is a comparison that tests the signbit (X < 0) or (x > -1),
1594  // fold the xor.
1595  ICmpInst::Predicate Pred = Cmp.getPredicate();
1596  bool TrueIfSigned = false;
1597  if (isSignBitCheck(Cmp.getPredicate(), C, TrueIfSigned)) {
1598 
1599  // If the sign bit of the XorCst is not set, there is no change to
1600  // the operation, just stop using the Xor.
1601  if (!XorC->isNegative())
1602  return replaceOperand(Cmp, 0, X);
1603 
1604  // Emit the opposite comparison.
1605  if (TrueIfSigned)
1606  return new ICmpInst(ICmpInst::ICMP_SGT, X,
1607  ConstantInt::getAllOnesValue(X->getType()));
1608  else
1609  return new ICmpInst(ICmpInst::ICMP_SLT, X,
1610  ConstantInt::getNullValue(X->getType()));
1611  }
1612 
1613  if (Xor->hasOneUse()) {
1614  // (icmp u/s (xor X SignMask), C) -> (icmp s/u X, (xor C SignMask))
1615  if (!Cmp.isEquality() && XorC->isSignMask()) {
1616  Pred = Cmp.getFlippedSignednessPredicate();
1617  return new ICmpInst(Pred, X, ConstantInt::get(X->getType(), C ^ *XorC));
1618  }
1619 
1620  // (icmp u/s (xor X ~SignMask), C) -> (icmp s/u X, (xor C ~SignMask))
1621  if (!Cmp.isEquality() && XorC->isMaxSignedValue()) {
1622  Pred = Cmp.getFlippedSignednessPredicate();
1623  Pred = Cmp.getSwappedPredicate(Pred);
1624  return new ICmpInst(Pred, X, ConstantInt::get(X->getType(), C ^ *XorC));
1625  }
1626  }
1627 
1628  // Mask constant magic can eliminate an 'xor' with unsigned compares.
1629  if (Pred == ICmpInst::ICMP_UGT) {
1630  // (xor X, ~C) >u C --> X <u ~C (when C+1 is a power of 2)
1631  if (*XorC == ~C && (C + 1).isPowerOf2())
1632  return new ICmpInst(ICmpInst::ICMP_ULT, X, Y);
1633  // (xor X, C) >u C --> X >u C (when C+1 is a power of 2)
1634  if (*XorC == C && (C + 1).isPowerOf2())
1635  return new ICmpInst(ICmpInst::ICMP_UGT, X, Y);
1636  }
1637  if (Pred == ICmpInst::ICMP_ULT) {
1638  // (xor X, -C) <u C --> X >u ~C (when C is a power of 2)
1639  if (*XorC == -C && C.isPowerOf2())
1640  return new ICmpInst(ICmpInst::ICMP_UGT, X,
1641  ConstantInt::get(X->getType(), ~C));
1642  // (xor X, C) <u C --> X >u ~C (when -C is a power of 2)
1643  if (*XorC == C && (-C).isPowerOf2())
1644  return new ICmpInst(ICmpInst::ICMP_UGT, X,
1645  ConstantInt::get(X->getType(), ~C));
1646  }
1647  return nullptr;
1648 }
1649 
1650 /// Fold icmp (and (sh X, Y), C2), C1.
1652  BinaryOperator *And,
1653  const APInt &C1,
1654  const APInt &C2) {
1655  BinaryOperator *Shift = dyn_cast<BinaryOperator>(And->getOperand(0));
1656  if (!Shift || !Shift->isShift())
1657  return nullptr;
1658 
1659  // If this is: (X >> C3) & C2 != C1 (where any shift and any compare could
1660  // exist), turn it into (X & (C2 << C3)) != (C1 << C3). This happens a LOT in
1661  // code produced by the clang front-end, for bitfield access.
1662  // This seemingly simple opportunity to fold away a shift turns out to be
1663  // rather complicated. See PR17827 for details.
1664  unsigned ShiftOpcode = Shift->getOpcode();
1665  bool IsShl = ShiftOpcode == Instruction::Shl;
1666  const APInt *C3;
1667  if (match(Shift->getOperand(1), m_APInt(C3))) {
1668  APInt NewAndCst, NewCmpCst;
1669  bool AnyCmpCstBitsShiftedOut;
1670  if (ShiftOpcode == Instruction::Shl) {
1671  // For a left shift, we can fold if the comparison is not signed. We can
1672  // also fold a signed comparison if the mask value and comparison value
1673  // are not negative. These constraints may not be obvious, but we can
1674  // prove that they are correct using an SMT solver.
1675  if (Cmp.isSigned() && (C2.isNegative() || C1.isNegative()))
1676  return nullptr;
1677 
1678  NewCmpCst = C1.lshr(*C3);
1679  NewAndCst = C2.lshr(*C3);
1680  AnyCmpCstBitsShiftedOut = NewCmpCst.shl(*C3) != C1;
1681  } else if (ShiftOpcode == Instruction::LShr) {
1682  // For a logical right shift, we can fold if the comparison is not signed.
1683  // We can also fold a signed comparison if the shifted mask value and the
1684  // shifted comparison value are not negative. These constraints may not be
1685  // obvious, but we can prove that they are correct using an SMT solver.
1686  NewCmpCst = C1.shl(*C3);
1687  NewAndCst = C2.shl(*C3);
1688  AnyCmpCstBitsShiftedOut = NewCmpCst.lshr(*C3) != C1;
1689  if (Cmp.isSigned() && (NewAndCst.isNegative() || NewCmpCst.isNegative()))
1690  return nullptr;
1691  } else {
1692  // For an arithmetic shift, check that both constants don't use (in a
1693  // signed sense) the top bits being shifted out.
1694  assert(ShiftOpcode == Instruction::AShr && "Unknown shift opcode");
1695  NewCmpCst = C1.shl(*C3);
1696  NewAndCst = C2.shl(*C3);
1697  AnyCmpCstBitsShiftedOut = NewCmpCst.ashr(*C3) != C1;
1698  if (NewAndCst.ashr(*C3) != C2)
1699  return nullptr;
1700  }
1701 
1702  if (AnyCmpCstBitsShiftedOut) {
1703  // If we shifted bits out, the fold is not going to work out. As a
1704  // special case, check to see if this means that the result is always
1705  // true or false now.
1706  if (Cmp.getPredicate() == ICmpInst::ICMP_EQ)
1707  return replaceInstUsesWith(Cmp, ConstantInt::getFalse(Cmp.getType()));
1708  if (Cmp.getPredicate() == ICmpInst::ICMP_NE)
1709  return replaceInstUsesWith(Cmp, ConstantInt::getTrue(Cmp.getType()));
1710  } else {
1711  Value *NewAnd = Builder.CreateAnd(
1712  Shift->getOperand(0), ConstantInt::get(And->getType(), NewAndCst));
1713  return new ICmpInst(Cmp.getPredicate(),
1714  NewAnd, ConstantInt::get(And->getType(), NewCmpCst));
1715  }
1716  }
1717 
1718  // Turn ((X >> Y) & C2) == 0 into (X & (C2 << Y)) == 0. The latter is
1719  // preferable because it allows the C2 << Y expression to be hoisted out of a
1720  // loop if Y is invariant and X is not.
1721  if (Shift->hasOneUse() && C1.isZero() && Cmp.isEquality() &&
1722  !Shift->isArithmeticShift() && !isa<Constant>(Shift->getOperand(0))) {
1723  // Compute C2 << Y.
1724  Value *NewShift =
1725  IsShl ? Builder.CreateLShr(And->getOperand(1), Shift->getOperand(1))
1726  : Builder.CreateShl(And->getOperand(1), Shift->getOperand(1));
1727 
1728  // Compute X & (C2 << Y).
1729  Value *NewAnd = Builder.CreateAnd(Shift->getOperand(0), NewShift);
1730  return replaceOperand(Cmp, 0, NewAnd);
1731  }
1732 
1733  return nullptr;
1734 }
1735 
1736 /// Fold icmp (and X, C2), C1.
1738  BinaryOperator *And,
1739  const APInt &C1) {
1740  bool isICMP_NE = Cmp.getPredicate() == ICmpInst::ICMP_NE;
1741 
1742  // For vectors: icmp ne (and X, 1), 0 --> trunc X to N x i1
1743  // TODO: We canonicalize to the longer form for scalars because we have
1744  // better analysis/folds for icmp, and codegen may be better with icmp.
1745  if (isICMP_NE && Cmp.getType()->isVectorTy() && C1.isZero() &&
1746  match(And->getOperand(1), m_One()))
1747  return new TruncInst(And->getOperand(0), Cmp.getType());
1748 
1749  const APInt *C2;
1750  Value *X;
1751  if (!match(And, m_And(m_Value(X), m_APInt(C2))))
1752  return nullptr;
1753 
1754  // Don't perform the following transforms if the AND has multiple uses
1755  if (!And->hasOneUse())
1756  return nullptr;
1757 
1758  if (Cmp.isEquality() && C1.isZero()) {
1759  // Restrict this fold to single-use 'and' (PR10267).
1760  // Replace (and X, (1 << size(X)-1) != 0) with X s< 0
1761  if (C2->isSignMask()) {
1762  Constant *Zero = Constant::getNullValue(X->getType());
1763  auto NewPred = isICMP_NE ? ICmpInst::ICMP_SLT : ICmpInst::ICMP_SGE;
1764  return new ICmpInst(NewPred, X, Zero);
1765  }
1766 
1767  // Restrict this fold only for single-use 'and' (PR10267).
1768  // ((%x & C) == 0) --> %x u< (-C) iff (-C) is power of two.
1769  if ((~(*C2) + 1).isPowerOf2()) {
1770  Constant *NegBOC =
1771  ConstantExpr::getNeg(cast<Constant>(And->getOperand(1)));
1772  auto NewPred = isICMP_NE ? ICmpInst::ICMP_UGE : ICmpInst::ICMP_ULT;
1773  return new ICmpInst(NewPred, X, NegBOC);
1774  }
1775  }
1776 
1777  // If the LHS is an 'and' of a truncate and we can widen the and/compare to
1778  // the input width without changing the value produced, eliminate the cast:
1779  //
1780  // icmp (and (trunc W), C2), C1 -> icmp (and W, C2'), C1'
1781  //
1782  // We can do this transformation if the constants do not have their sign bits
1783  // set or if it is an equality comparison. Extending a relational comparison
1784  // when we're checking the sign bit would not work.
1785  Value *W;
1786  if (match(And->getOperand(0), m_OneUse(m_Trunc(m_Value(W)))) &&
1787  (Cmp.isEquality() || (!C1.isNegative() && !C2->isNegative()))) {
1788  // TODO: Is this a good transform for vectors? Wider types may reduce
1789  // throughput. Should this transform be limited (even for scalars) by using
1790  // shouldChangeType()?
1791  if (!Cmp.getType()->isVectorTy()) {
1792  Type *WideType = W->getType();
1793  unsigned WideScalarBits = WideType->getScalarSizeInBits();
1794  Constant *ZextC1 = ConstantInt::get(WideType, C1.zext(WideScalarBits));
1795  Constant *ZextC2 = ConstantInt::get(WideType, C2->zext(WideScalarBits));
1796  Value *NewAnd = Builder.CreateAnd(W, ZextC2, And->getName());
1797  return new ICmpInst(Cmp.getPredicate(), NewAnd, ZextC1);
1798  }
1799  }
1800 
1801  if (Instruction *I = foldICmpAndShift(Cmp, And, C1, *C2))
1802  return I;
1803 
1804  // (icmp pred (and (or (lshr A, B), A), 1), 0) -->
1805  // (icmp pred (and A, (or (shl 1, B), 1), 0))
1806  //
1807  // iff pred isn't signed
1808  if (!Cmp.isSigned() && C1.isZero() && And->getOperand(0)->hasOneUse() &&
1809  match(And->getOperand(1), m_One())) {
1810  Constant *One = cast<Constant>(And->getOperand(1));
1811  Value *Or = And->getOperand(0);
1812  Value *A, *B, *LShr;
1813  if (match(Or, m_Or(m_Value(LShr), m_Value(A))) &&
1814  match(LShr, m_LShr(m_Specific(A), m_Value(B)))) {
1815  unsigned UsesRemoved = 0;
1816  if (And->hasOneUse())
1817  ++UsesRemoved;
1818  if (Or->hasOneUse())
1819  ++UsesRemoved;
1820  if (LShr->hasOneUse())
1821  ++UsesRemoved;
1822 
1823  // Compute A & ((1 << B) | 1)
1824  Value *NewOr = nullptr;
1825  if (auto *C = dyn_cast<Constant>(B)) {
1826  if (UsesRemoved >= 1)
1827  NewOr = ConstantExpr::getOr(ConstantExpr::getNUWShl(One, C), One);
1828  } else {
1829  if (UsesRemoved >= 3)
1830  NewOr = Builder.CreateOr(Builder.CreateShl(One, B, LShr->getName(),
1831  /*HasNUW=*/true),
1832  One, Or->getName());
1833  }
1834  if (NewOr) {
1835  Value *NewAnd = Builder.CreateAnd(A, NewOr, And->getName());
1836  return replaceOperand(Cmp, 0, NewAnd);
1837  }
1838  }
1839  }
1840 
1841  return nullptr;
1842 }
1843 
1844 /// Fold icmp (and X, Y), C.
1846  BinaryOperator *And,
1847  const APInt &C) {
1848  if (Instruction *I = foldICmpAndConstConst(Cmp, And, C))
1849  return I;
1850 
1851  const ICmpInst::Predicate Pred = Cmp.getPredicate();
1852  bool TrueIfNeg;
1853  if (isSignBitCheck(Pred, C, TrueIfNeg)) {
1854  // ((X - 1) & ~X) < 0 --> X == 0
1855  // ((X - 1) & ~X) >= 0 --> X != 0
1856  Value *X;
1857  if (match(And->getOperand(0), m_Add(m_Value(X), m_AllOnes())) &&
1858  match(And->getOperand(1), m_Not(m_Specific(X)))) {
1859  auto NewPred = TrueIfNeg ? CmpInst::ICMP_EQ : CmpInst::ICMP_NE;
1860  return new ICmpInst(NewPred, X, ConstantInt::getNullValue(X->getType()));
1861  }
1862  }
1863 
1864  // TODO: These all require that Y is constant too, so refactor with the above.
1865 
1866  // Try to optimize things like "A[i] & 42 == 0" to index computations.
1867  Value *X = And->getOperand(0);
1868  Value *Y = And->getOperand(1);
1869  if (auto *C2 = dyn_cast<ConstantInt>(Y))
1870  if (auto *LI = dyn_cast<LoadInst>(X))
1871  if (auto *GEP = dyn_cast<GetElementPtrInst>(LI->getOperand(0)))
1872  if (auto *GV = dyn_cast<GlobalVariable>(GEP->getOperand(0)))
1873  if (Instruction *Res =
1874  foldCmpLoadFromIndexedGlobal(LI, GEP, GV, Cmp, C2))
1875  return Res;
1876 
1877  if (!Cmp.isEquality())
1878  return nullptr;
1879 
1880  // X & -C == -C -> X > u ~C
1881  // X & -C != -C -> X <= u ~C
1882  // iff C is a power of 2
1883  if (Cmp.getOperand(1) == Y && C.isNegatedPowerOf2()) {
1884  auto NewPred =
1886  return new ICmpInst(NewPred, X, SubOne(cast<Constant>(Cmp.getOperand(1))));
1887  }
1888 
1889  return nullptr;
1890 }
1891 
1892 /// Fold icmp (or X, Y), C.
1894  BinaryOperator *Or,
1895  const APInt &C) {
1896  ICmpInst::Predicate Pred = Cmp.getPredicate();
1897  if (C.isOne()) {
1898  // icmp slt signum(V) 1 --> icmp slt V, 1
1899  Value *V = nullptr;
1900  if (Pred == ICmpInst::ICMP_SLT && match(Or, m_Signum(m_Value(V))))
1901  return new ICmpInst(ICmpInst::ICMP_SLT, V,
1902  ConstantInt::get(V->getType(), 1));
1903  }
1904 
1905  Value *OrOp0 = Or->getOperand(0), *OrOp1 = Or->getOperand(1);
1906  const APInt *MaskC;
1907  if (match(OrOp1, m_APInt(MaskC)) && Cmp.isEquality()) {
1908  if (*MaskC == C && (C + 1).isPowerOf2()) {
1909  // X | C == C --> X <=u C
1910  // X | C != C --> X >u C
1911  // iff C+1 is a power of 2 (C is a bitmask of the low bits)
1913  return new ICmpInst(Pred, OrOp0, OrOp1);
1914  }
1915 
1916  // More general: canonicalize 'equality with set bits mask' to
1917  // 'equality with clear bits mask'.
1918  // (X | MaskC) == C --> (X & ~MaskC) == C ^ MaskC
1919  // (X | MaskC) != C --> (X & ~MaskC) != C ^ MaskC
1920  if (Or->hasOneUse()) {
1921  Value *And = Builder.CreateAnd(OrOp0, ~(*MaskC));
1922  Constant *NewC = ConstantInt::get(Or->getType(), C ^ (*MaskC));
1923  return new ICmpInst(Pred, And, NewC);
1924  }
1925  }
1926 
1927  // (X | (X-1)) s< 0 --> X s< 1
1928  // (X | (X-1)) s> -1 --> X s> 0
1929  Value *X;
1930  bool TrueIfSigned;
1931  if (isSignBitCheck(Pred, C, TrueIfSigned) &&
1933  auto NewPred = TrueIfSigned ? ICmpInst::ICMP_SLT : ICmpInst::ICMP_SGT;
1934  Constant *NewC = ConstantInt::get(X->getType(), TrueIfSigned ? 1 : 0);
1935  return new ICmpInst(NewPred, X, NewC);
1936  }
1937 
1938  if (!Cmp.isEquality() || !C.isZero() || !Or->hasOneUse())
1939  return nullptr;
1940 
1941  Value *P, *Q;
1942  if (match(Or, m_Or(m_PtrToInt(m_Value(P)), m_PtrToInt(m_Value(Q))))) {
1943  // Simplify icmp eq (or (ptrtoint P), (ptrtoint Q)), 0
1944  // -> and (icmp eq P, null), (icmp eq Q, null).
1945  Value *CmpP =
1946  Builder.CreateICmp(Pred, P, ConstantInt::getNullValue(P->getType()));
1947  Value *CmpQ =
1948  Builder.CreateICmp(Pred, Q, ConstantInt::getNullValue(Q->getType()));
1949  auto BOpc = Pred == CmpInst::ICMP_EQ ? Instruction::And : Instruction::Or;
1950  return BinaryOperator::Create(BOpc, CmpP, CmpQ);
1951  }
1952 
1953  // Are we using xors to bitwise check for a pair of (in)equalities? Convert to
1954  // a shorter form that has more potential to be folded even further.
1955  Value *X1, *X2, *X3, *X4;
1956  if (match(OrOp0, m_OneUse(m_Xor(m_Value(X1), m_Value(X2)))) &&
1957  match(OrOp1, m_OneUse(m_Xor(m_Value(X3), m_Value(X4))))) {
1958  // ((X1 ^ X2) || (X3 ^ X4)) == 0 --> (X1 == X2) && (X3 == X4)
1959  // ((X1 ^ X2) || (X3 ^ X4)) != 0 --> (X1 != X2) || (X3 != X4)
1960  Value *Cmp12 = Builder.CreateICmp(Pred, X1, X2);
1961  Value *Cmp34 = Builder.CreateICmp(Pred, X3, X4);
1962  auto BOpc = Pred == CmpInst::ICMP_EQ ? Instruction::And : Instruction::Or;
1963  return BinaryOperator::Create(BOpc, Cmp12, Cmp34);
1964  }
1965 
1966  return nullptr;
1967 }
1968 
1969 /// Fold icmp (mul X, Y), C.
1971  BinaryOperator *Mul,
1972  const APInt &C) {
1973  const APInt *MulC;
1974  if (!match(Mul->getOperand(1), m_APInt(MulC)))
1975  return nullptr;
1976 
1977  // If this is a test of the sign bit and the multiply is sign-preserving with
1978  // a constant operand, use the multiply LHS operand instead.
1979  ICmpInst::Predicate Pred = Cmp.getPredicate();
1980  if (isSignTest(Pred, C) && Mul->hasNoSignedWrap()) {
1981  if (MulC->isNegative())
1982  Pred = ICmpInst::getSwappedPredicate(Pred);
1983  return new ICmpInst(Pred, Mul->getOperand(0),
1985  }
1986 
1987  // If the multiply does not wrap, try to divide the compare constant by the
1988  // multiplication factor.
1989  if (Cmp.isEquality() && !MulC->isZero()) {
1990  // (mul nsw X, MulC) == C --> X == C /s MulC
1991  if (Mul->hasNoSignedWrap() && C.srem(*MulC).isZero()) {
1992  Constant *NewC = ConstantInt::get(Mul->getType(), C.sdiv(*MulC));
1993  return new ICmpInst(Pred, Mul->getOperand(0), NewC);
1994  }
1995  // (mul nuw X, MulC) == C --> X == C /u MulC
1996  if (Mul->hasNoUnsignedWrap() && C.urem(*MulC).isZero()) {
1997  Constant *NewC = ConstantInt::get(Mul->getType(), C.udiv(*MulC));
1998  return new ICmpInst(Pred, Mul->getOperand(0), NewC);
1999  }
2000  }
2001 
2002  return nullptr;
2003 }
2004 
2005 /// Fold icmp (shl 1, Y), C.
2007  const APInt &C) {
2008  Value *Y;
2009  if (!match(Shl, m_Shl(m_One(), m_Value(Y))))
2010  return nullptr;
2011 
2012  Type *ShiftType = Shl->getType();
2013  unsigned TypeBits = C.getBitWidth();
2014  bool CIsPowerOf2 = C.isPowerOf2();
2015  ICmpInst::Predicate Pred = Cmp.getPredicate();
2016  if (Cmp.isUnsigned()) {
2017  // (1 << Y) pred C -> Y pred Log2(C)
2018  if (!CIsPowerOf2) {
2019  // (1 << Y) < 30 -> Y <= 4
2020  // (1 << Y) <= 30 -> Y <= 4
2021  // (1 << Y) >= 30 -> Y > 4
2022  // (1 << Y) > 30 -> Y > 4
2023  if (Pred == ICmpInst::ICMP_ULT)
2024  Pred = ICmpInst::ICMP_ULE;
2025  else if (Pred == ICmpInst::ICMP_UGE)
2026  Pred = ICmpInst::ICMP_UGT;
2027  }
2028 
2029  // (1 << Y) >= 2147483648 -> Y >= 31 -> Y == 31
2030  // (1 << Y) < 2147483648 -> Y < 31 -> Y != 31
2031  unsigned CLog2 = C.logBase2();
2032  if (CLog2 == TypeBits - 1) {
2033  if (Pred == ICmpInst::ICMP_UGE)
2034  Pred = ICmpInst::ICMP_EQ;
2035  else if (Pred == ICmpInst::ICMP_ULT)
2036  Pred = ICmpInst::ICMP_NE;
2037  }
2038  return new ICmpInst(Pred, Y, ConstantInt::get(ShiftType, CLog2));
2039  } else if (Cmp.isSigned()) {
2040  Constant *BitWidthMinusOne = ConstantInt::get(ShiftType, TypeBits - 1);
2041  if (C.isAllOnes()) {
2042  // (1 << Y) <= -1 -> Y == 31
2043  if (Pred == ICmpInst::ICMP_SLE)
2044  return new ICmpInst(ICmpInst::ICMP_EQ, Y, BitWidthMinusOne);
2045 
2046  // (1 << Y) > -1 -> Y != 31
2047  if (Pred == ICmpInst::ICMP_SGT)
2048  return new ICmpInst(ICmpInst::ICMP_NE, Y, BitWidthMinusOne);
2049  } else if (!C) {
2050  // (1 << Y) < 0 -> Y == 31
2051  // (1 << Y) <= 0 -> Y == 31
2052  if (Pred == ICmpInst::ICMP_SLT || Pred == ICmpInst::ICMP_SLE)
2053  return new ICmpInst(ICmpInst::ICMP_EQ, Y, BitWidthMinusOne);
2054 
2055  // (1 << Y) >= 0 -> Y != 31
2056  // (1 << Y) > 0 -> Y != 31
2057  if (Pred == ICmpInst::ICMP_SGT || Pred == ICmpInst::ICMP_SGE)
2058  return new ICmpInst(ICmpInst::ICMP_NE, Y, BitWidthMinusOne);
2059  }
2060  } else if (Cmp.isEquality() && CIsPowerOf2) {
2061  return new ICmpInst(Pred, Y, ConstantInt::get(ShiftType, C.logBase2()));
2062  }
2063 
2064  return nullptr;
2065 }
2066 
2067 /// Fold icmp (shl X, Y), C.
2069  BinaryOperator *Shl,
2070  const APInt &C) {
2071  const APInt *ShiftVal;
2072  if (Cmp.isEquality() && match(Shl->getOperand(0), m_APInt(ShiftVal)))
2073  return foldICmpShlConstConst(Cmp, Shl->getOperand(1), C, *ShiftVal);
2074 
2075  const APInt *ShiftAmt;
2076  if (!match(Shl->getOperand(1), m_APInt(ShiftAmt)))
2077  return foldICmpShlOne(Cmp, Shl, C);
2078 
2079  // Check that the shift amount is in range. If not, don't perform undefined
2080  // shifts. When the shift is visited, it will be simplified.
2081  unsigned TypeBits = C.getBitWidth();
2082  if (ShiftAmt->uge(TypeBits))
2083  return nullptr;
2084 
2085  ICmpInst::Predicate Pred = Cmp.getPredicate();
2086  Value *X = Shl->getOperand(0);
2087  Type *ShType = Shl->getType();
2088 
2089  // NSW guarantees that we are only shifting out sign bits from the high bits,
2090  // so we can ASHR the compare constant without needing a mask and eliminate
2091  // the shift.
2092  if (Shl->hasNoSignedWrap()) {
2093  if (Pred == ICmpInst::ICMP_SGT) {
2094  // icmp Pred (shl nsw X, ShiftAmt), C --> icmp Pred X, (C >>s ShiftAmt)
2095  APInt ShiftedC = C.ashr(*ShiftAmt);
2096  return new ICmpInst(Pred, X, ConstantInt::get(ShType, ShiftedC));
2097  }
2098  if ((Pred == ICmpInst::ICMP_EQ || Pred == ICmpInst::ICMP_NE) &&
2099  C.ashr(*ShiftAmt).shl(*ShiftAmt) == C) {
2100  APInt ShiftedC = C.ashr(*ShiftAmt);
2101  return new ICmpInst(Pred, X, ConstantInt::get(ShType, ShiftedC));
2102  }
2103  if (Pred == ICmpInst::ICMP_SLT) {
2104  // SLE is the same as above, but SLE is canonicalized to SLT, so convert:
2105  // (X << S) <=s C is equiv to X <=s (C >> S) for all C
2106  // (X << S) <s (C + 1) is equiv to X <s (C >> S) + 1 if C <s SMAX
2107  // (X << S) <s C is equiv to X <s ((C - 1) >> S) + 1 if C >s SMIN
2108  assert(!C.isMinSignedValue() && "Unexpected icmp slt");
2109  APInt ShiftedC = (C - 1).ashr(*ShiftAmt) + 1;
2110  return new ICmpInst(Pred, X, ConstantInt::get(ShType, ShiftedC));
2111  }
2112  // If this is a signed comparison to 0 and the shift is sign preserving,
2113  // use the shift LHS operand instead; isSignTest may change 'Pred', so only
2114  // do that if we're sure to not continue on in this function.
2115  if (isSignTest(Pred, C))
2116  return new ICmpInst(Pred, X, Constant::getNullValue(ShType));
2117  }
2118 
2119  // NUW guarantees that we are only shifting out zero bits from the high bits,
2120  // so we can LSHR the compare constant without needing a mask and eliminate
2121  // the shift.
2122  if (Shl->hasNoUnsignedWrap()) {
2123  if (Pred == ICmpInst::ICMP_UGT) {
2124  // icmp Pred (shl nuw X, ShiftAmt), C --> icmp Pred X, (C >>u ShiftAmt)
2125  APInt ShiftedC = C.lshr(*ShiftAmt);
2126  return new ICmpInst(Pred, X, ConstantInt::get(ShType, ShiftedC));
2127  }
2128  if ((Pred == ICmpInst::ICMP_EQ || Pred == ICmpInst::ICMP_NE) &&
2129  C.lshr(*ShiftAmt).shl(*ShiftAmt) == C) {
2130  APInt ShiftedC = C.lshr(*ShiftAmt);
2131  return new ICmpInst(Pred, X, ConstantInt::get(ShType, ShiftedC));
2132  }
2133  if (Pred == ICmpInst::ICMP_ULT) {
2134  // ULE is the same as above, but ULE is canonicalized to ULT, so convert:
2135  // (X << S) <=u C is equiv to X <=u (C >> S) for all C
2136  // (X << S) <u (C + 1) is equiv to X <u (C >> S) + 1 if C <u ~0u
2137  // (X << S) <u C is equiv to X <u ((C - 1) >> S) + 1 if C >u 0
2138  assert(C.ugt(0) && "ult 0 should have been eliminated");
2139  APInt ShiftedC = (C - 1).lshr(*ShiftAmt) + 1;
2140  return new ICmpInst(Pred, X, ConstantInt::get(ShType, ShiftedC));
2141  }
2142  }
2143 
2144  if (Cmp.isEquality() && Shl->hasOneUse()) {
2145  // Strength-reduce the shift into an 'and'.
2147  ShType,
2148  APInt::getLowBitsSet(TypeBits, TypeBits - ShiftAmt->getZExtValue()));
2149  Value *And = Builder.CreateAnd(X, Mask, Shl->getName() + ".mask");
2150  Constant *LShrC = ConstantInt::get(ShType, C.lshr(*ShiftAmt));
2151  return new ICmpInst(Pred, And, LShrC);
2152  }
2153 
2154  // Otherwise, if this is a comparison of the sign bit, simplify to and/test.
2155  bool TrueIfSigned = false;
2156  if (Shl->hasOneUse() && isSignBitCheck(Pred, C, TrueIfSigned)) {
2157  // (X << 31) <s 0 --> (X & 1) != 0
2159  ShType,
2160  APInt::getOneBitSet(TypeBits, TypeBits - ShiftAmt->getZExtValue() - 1));
2161  Value *And = Builder.CreateAnd(X, Mask, Shl->getName() + ".mask");
2162  return new ICmpInst(TrueIfSigned ? ICmpInst::ICMP_NE : ICmpInst::ICMP_EQ,
2163  And, Constant::getNullValue(ShType));
2164  }
2165 
2166  // Simplify 'shl' inequality test into 'and' equality test.
2167  if (Cmp.isUnsigned() && Shl->hasOneUse()) {
2168  // (X l<< C2) u<=/u> C1 iff C1+1 is power of two -> X & (~C1 l>> C2) ==/!= 0
2169  if ((C + 1).isPowerOf2() &&
2170  (Pred == ICmpInst::ICMP_ULE || Pred == ICmpInst::ICMP_UGT)) {
2171  Value *And = Builder.CreateAnd(X, (~C).lshr(ShiftAmt->getZExtValue()));
2172  return new ICmpInst(Pred == ICmpInst::ICMP_ULE ? ICmpInst::ICMP_EQ
2174  And, Constant::getNullValue(ShType));
2175  }
2176  // (X l<< C2) u</u>= C1 iff C1 is power of two -> X & (-C1 l>> C2) ==/!= 0
2177  if (C.isPowerOf2() &&
2178  (Pred == ICmpInst::ICMP_ULT || Pred == ICmpInst::ICMP_UGE)) {
2179  Value *And =
2180  Builder.CreateAnd(X, (~(C - 1)).lshr(ShiftAmt->getZExtValue()));
2181  return new ICmpInst(Pred == ICmpInst::ICMP_ULT ? ICmpInst::ICMP_EQ
2183  And, Constant::getNullValue(ShType));
2184  }
2185  }
2186 
2187  // Transform (icmp pred iM (shl iM %v, N), C)
2188  // -> (icmp pred i(M-N) (trunc %v iM to i(M-N)), (trunc (C>>N))
2189  // Transform the shl to a trunc if (trunc (C>>N)) has no loss and M-N.
2190  // This enables us to get rid of the shift in favor of a trunc that may be
2191  // free on the target. It has the additional benefit of comparing to a
2192  // smaller constant that may be more target-friendly.
2193  unsigned Amt = ShiftAmt->getLimitedValue(TypeBits - 1);
2194  if (Shl->hasOneUse() && Amt != 0 && C.countTrailingZeros() >= Amt &&
2195  DL.isLegalInteger(TypeBits - Amt)) {
2196  Type *TruncTy = IntegerType::get(Cmp.getContext(), TypeBits - Amt);
2197  if (auto *ShVTy = dyn_cast<VectorType>(ShType))
2198  TruncTy = VectorType::get(TruncTy, ShVTy->getElementCount());
2199  Constant *NewC =
2200  ConstantInt::get(TruncTy, C.ashr(*ShiftAmt).trunc(TypeBits - Amt));
2201  return new ICmpInst(Pred, Builder.CreateTrunc(X, TruncTy), NewC);
2202  }
2203 
2204  return nullptr;
2205 }
2206 
2207 /// Fold icmp ({al}shr X, Y), C.
2209  BinaryOperator *Shr,
2210  const APInt &C) {
2211  // An exact shr only shifts out zero bits, so:
2212  // icmp eq/ne (shr X, Y), 0 --> icmp eq/ne X, 0
2213  Value *X = Shr->getOperand(0);
2214  CmpInst::Predicate Pred = Cmp.getPredicate();
2215  if (Cmp.isEquality() && Shr->isExact() && C.isZero())
2216  return new ICmpInst(Pred, X, Cmp.getOperand(1));
2217 
2218  bool IsAShr = Shr->getOpcode() == Instruction::AShr;
2219  const APInt *ShiftValC;
2220  if (match(Shr->getOperand(0), m_APInt(ShiftValC))) {
2221  if (Cmp.isEquality())
2222  return foldICmpShrConstConst(Cmp, Shr->getOperand(1), C, *ShiftValC);
2223 
2224  // If the shifted constant is a power-of-2, test the shift amount directly:
2225  // (ShiftValC >> X) >u C --> X <u (LZ(C) - LZ(ShiftValC))
2226  // TODO: Handle ult.
2227  if (!IsAShr && Pred == CmpInst::ICMP_UGT && ShiftValC->isPowerOf2()) {
2228  assert(ShiftValC->ugt(C) && "Expected simplify of compare");
2229  unsigned CmpLZ = C.countLeadingZeros();
2230  unsigned ShiftLZ = ShiftValC->countLeadingZeros();
2231  Constant *NewC = ConstantInt::get(Shr->getType(), CmpLZ - ShiftLZ);
2232  return new ICmpInst(ICmpInst::ICMP_ULT, Shr->User::getOperand(1), NewC);
2233  }
2234  }
2235 
2236  const APInt *ShiftAmtC;
2237  if (!match(Shr->getOperand(1), m_APInt(ShiftAmtC)))
2238  return nullptr;
2239 
2240  // Check that the shift amount is in range. If not, don't perform undefined
2241  // shifts. When the shift is visited it will be simplified.
2242  unsigned TypeBits = C.getBitWidth();
2243  unsigned ShAmtVal = ShiftAmtC->getLimitedValue(TypeBits);
2244  if (ShAmtVal >= TypeBits || ShAmtVal == 0)
2245  return nullptr;
2246 
2247  bool IsExact = Shr->isExact();
2248  Type *ShrTy = Shr->getType();
2249  // TODO: If we could guarantee that InstSimplify would handle all of the
2250  // constant-value-based preconditions in the folds below, then we could assert
2251  // those conditions rather than checking them. This is difficult because of
2252  // undef/poison (PR34838).
2253  if (IsAShr) {
2254  if (IsExact || Pred == CmpInst::ICMP_SLT || Pred == CmpInst::ICMP_ULT) {
2255  // When ShAmtC can be shifted losslessly:
2256  // icmp PRED (ashr exact X, ShAmtC), C --> icmp PRED X, (C << ShAmtC)
2257  // icmp slt/ult (ashr X, ShAmtC), C --> icmp slt/ult X, (C << ShAmtC)
2258  APInt ShiftedC = C.shl(ShAmtVal);
2259  if (ShiftedC.ashr(ShAmtVal) == C)
2260  return new ICmpInst(Pred, X, ConstantInt::get(ShrTy, ShiftedC));
2261  }
2262  if (Pred == CmpInst::ICMP_SGT) {
2263  // icmp sgt (ashr X, ShAmtC), C --> icmp sgt X, ((C + 1) << ShAmtC) - 1
2264  APInt ShiftedC = (C + 1).shl(ShAmtVal) - 1;
2265  if (!C.isMaxSignedValue() && !(C + 1).shl(ShAmtVal).isMinSignedValue() &&
2266  (ShiftedC + 1).ashr(ShAmtVal) == (C + 1))
2267  return new ICmpInst(Pred, X, ConstantInt::get(ShrTy, ShiftedC));
2268  }
2269  if (Pred == CmpInst::ICMP_UGT) {
2270  // icmp ugt (ashr X, ShAmtC), C --> icmp ugt X, ((C + 1) << ShAmtC) - 1
2271  // 'C + 1 << ShAmtC' can overflow as a signed number, so the 2nd
2272  // clause accounts for that pattern.
2273  APInt ShiftedC = (C + 1).shl(ShAmtVal) - 1;
2274  if ((ShiftedC + 1).ashr(ShAmtVal) == (C + 1) ||
2275  (C + 1).shl(ShAmtVal).isMinSignedValue())
2276  return new ICmpInst(Pred, X, ConstantInt::get(ShrTy, ShiftedC));
2277  }
2278 
2279  // If the compare constant has significant bits above the lowest sign-bit,
2280  // then convert an unsigned cmp to a test of the sign-bit:
2281  // (ashr X, ShiftC) u> C --> X s< 0
2282  // (ashr X, ShiftC) u< C --> X s> -1
2283  if (C.getBitWidth() > 2 && C.getNumSignBits() <= ShAmtVal) {
2284  if (Pred == CmpInst::ICMP_UGT) {
2285  return new ICmpInst(CmpInst::ICMP_SLT, X,
2286  ConstantInt::getNullValue(ShrTy));
2287  }
2288  if (Pred == CmpInst::ICMP_ULT) {
2289  return new ICmpInst(CmpInst::ICMP_SGT, X,
2291  }
2292  }
2293  } else {
2294  if (Pred == CmpInst::ICMP_ULT || (Pred == CmpInst::ICMP_UGT && IsExact)) {
2295  // icmp ult (lshr X, ShAmtC), C --> icmp ult X, (C << ShAmtC)
2296  // icmp ugt (lshr exact X, ShAmtC), C --> icmp ugt X, (C << ShAmtC)
2297  APInt ShiftedC = C.shl(ShAmtVal);
2298  if (ShiftedC.lshr(ShAmtVal) == C)
2299  return new ICmpInst(Pred, X, ConstantInt::get(ShrTy, ShiftedC));
2300  }
2301  if (Pred == CmpInst::ICMP_UGT) {
2302  // icmp ugt (lshr X, ShAmtC), C --> icmp ugt X, ((C + 1) << ShAmtC) - 1
2303  APInt ShiftedC = (C + 1).shl(ShAmtVal) - 1;
2304  if ((ShiftedC + 1).lshr(ShAmtVal) == (C + 1))
2305  return new ICmpInst(Pred, X, ConstantInt::get(ShrTy, ShiftedC));
2306  }
2307  }
2308 
2309  if (!Cmp.isEquality())
2310  return nullptr;
2311 
2312  // Handle equality comparisons of shift-by-constant.
2313 
2314  // If the comparison constant changes with the shift, the comparison cannot
2315  // succeed (bits of the comparison constant cannot match the shifted value).
2316  // This should be known by InstSimplify and already be folded to true/false.
2317  assert(((IsAShr && C.shl(ShAmtVal).ashr(ShAmtVal) == C) ||
2318  (!IsAShr && C.shl(ShAmtVal).lshr(ShAmtVal) == C)) &&
2319  "Expected icmp+shr simplify did not occur.");
2320 
2321  // If the bits shifted out are known zero, compare the unshifted value:
2322  // (X & 4) >> 1 == 2 --> (X & 4) == 4.
2323  if (Shr->isExact())
2324  return new ICmpInst(Pred, X, ConstantInt::get(ShrTy, C << ShAmtVal));
2325 
2326  if (C.isZero()) {
2327  // == 0 is u< 1.
2328  if (Pred == CmpInst::ICMP_EQ)
2329  return new ICmpInst(CmpInst::ICMP_ULT, X,
2330  ConstantInt::get(ShrTy, (C + 1).shl(ShAmtVal)));
2331  else
2332  return new ICmpInst(CmpInst::ICMP_UGT, X,
2333  ConstantInt::get(ShrTy, (C + 1).shl(ShAmtVal) - 1));
2334  }
2335 
2336  if (Shr->hasOneUse()) {
2337  // Canonicalize the shift into an 'and':
2338  // icmp eq/ne (shr X, ShAmt), C --> icmp eq/ne (and X, HiMask), (C << ShAmt)
2339  APInt Val(APInt::getHighBitsSet(TypeBits, TypeBits - ShAmtVal));
2340  Constant *Mask = ConstantInt::get(ShrTy, Val);
2341  Value *And = Builder.CreateAnd(X, Mask, Shr->getName() + ".mask");
2342  return new ICmpInst(Pred, And, ConstantInt::get(ShrTy, C << ShAmtVal));
2343  }
2344 
2345  return nullptr;
2346 }
2347 
2349  BinaryOperator *SRem,
2350  const APInt &C) {
2351  // Match an 'is positive' or 'is negative' comparison of remainder by a
2352  // constant power-of-2 value:
2353  // (X % pow2C) sgt/slt 0
2354  const ICmpInst::Predicate Pred = Cmp.getPredicate();
2355  if (Pred != ICmpInst::ICMP_SGT && Pred != ICmpInst::ICMP_SLT &&
2356  Pred != ICmpInst::ICMP_EQ && Pred != ICmpInst::ICMP_NE)
2357  return nullptr;
2358 
2359  // TODO: The one-use check is standard because we do not typically want to
2360  // create longer instruction sequences, but this might be a special-case
2361  // because srem is not good for analysis or codegen.
2362  if (!SRem->hasOneUse())
2363  return nullptr;
2364 
2365  const APInt *DivisorC;
2366  if (!match(SRem->getOperand(1), m_Power2(DivisorC)))
2367  return nullptr;
2368 
2369  // For cmp_sgt/cmp_slt only zero valued C is handled.
2370  // For cmp_eq/cmp_ne only positive valued C is handled.
2371  if (((Pred == ICmpInst::ICMP_SGT || Pred == ICmpInst::ICMP_SLT) &&
2372  !C.isZero()) ||
2373  ((Pred == ICmpInst::ICMP_EQ || Pred == ICmpInst::ICMP_NE) &&
2374  !C.isStrictlyPositive()))
2375  return nullptr;
2376 
2377  // Mask off the sign bit and the modulo bits (low-bits).
2378  Type *Ty = SRem->getType();
2379  APInt SignMask = APInt::getSignMask(Ty->getScalarSizeInBits());
2380  Constant *MaskC = ConstantInt::get(Ty, SignMask | (*DivisorC - 1));
2381  Value *And = Builder.CreateAnd(SRem->getOperand(0), MaskC);
2382 
2383  if (Pred == ICmpInst::ICMP_EQ || Pred == ICmpInst::ICMP_NE)
2384  return new ICmpInst(Pred, And, ConstantInt::get(Ty, C));
2385 
2386  // For 'is positive?' check that the sign-bit is clear and at least 1 masked
2387  // bit is set. Example:
2388  // (i8 X % 32) s> 0 --> (X & 159) s> 0
2389  if (Pred == ICmpInst::ICMP_SGT)
2391 
2392  // For 'is negative?' check that the sign-bit is set and at least 1 masked
2393  // bit is set. Example:
2394  // (i16 X % 4) s< 0 --> (X & 32771) u> 32768
2395  return new ICmpInst(ICmpInst::ICMP_UGT, And, ConstantInt::get(Ty, SignMask));
2396 }
2397 
2398 /// Fold icmp (udiv X, Y), C.
2400  BinaryOperator *UDiv,
2401  const APInt &C) {
2402  ICmpInst::Predicate Pred = Cmp.getPredicate();
2403  Value *X = UDiv->getOperand(0);
2404  Value *Y = UDiv->getOperand(1);
2405  Type *Ty = UDiv->getType();
2406 
2407  const APInt *C2;
2408  if (!match(X, m_APInt(C2)))
2409  return nullptr;
2410 
2411  assert(*C2 != 0 && "udiv 0, X should have been simplified already.");
2412 
2413  // (icmp ugt (udiv C2, Y), C) -> (icmp ule Y, C2/(C+1))
2414  if (Pred == ICmpInst::ICMP_UGT) {
2415  assert(!C.isMaxValue() &&
2416  "icmp ugt X, UINT_MAX should have been simplified already.");
2417  return new ICmpInst(ICmpInst::ICMP_ULE, Y,
2418  ConstantInt::get(Ty, C2->udiv(C + 1)));
2419  }
2420 
2421  // (icmp ult (udiv C2, Y), C) -> (icmp ugt Y, C2/C)
2422  if (Pred == ICmpInst::ICMP_ULT) {
2423  assert(C != 0 && "icmp ult X, 0 should have been simplified already.");
2424  return new ICmpInst(ICmpInst::ICMP_UGT, Y,
2425  ConstantInt::get(Ty, C2->udiv(C)));
2426  }
2427 
2428  return nullptr;
2429 }
2430 
2431 /// Fold icmp ({su}div X, Y), C.
2433  BinaryOperator *Div,
2434  const APInt &C) {
2435  ICmpInst::Predicate Pred = Cmp.getPredicate();
2436  Value *X = Div->getOperand(0);
2437  Value *Y = Div->getOperand(1);
2438  Type *Ty = Div->getType();
2439  bool DivIsSigned = Div->getOpcode() == Instruction::SDiv;
2440 
2441  // If unsigned division and the compare constant is bigger than
2442  // UMAX/2 (negative), there's only one pair of values that satisfies an
2443  // equality check, so eliminate the division:
2444  // (X u/ Y) == C --> (X == C) && (Y == 1)
2445  // (X u/ Y) != C --> (X != C) || (Y != 1)
2446  // Similarly, if signed division and the compare constant is exactly SMIN:
2447  // (X s/ Y) == SMIN --> (X == SMIN) && (Y == 1)
2448  // (X s/ Y) != SMIN --> (X != SMIN) || (Y != 1)
2449  if (Cmp.isEquality() && Div->hasOneUse() && C.isSignBitSet() &&
2450  (!DivIsSigned || C.isMinSignedValue())) {
2451  Value *XBig = Builder.CreateICmp(Pred, X, ConstantInt::get(Ty, C));
2452  Value *YOne = Builder.CreateICmp(Pred, Y, ConstantInt::get(Ty, 1));
2453  auto Logic = Pred == ICmpInst::ICMP_EQ ? Instruction::And : Instruction::Or;
2454  return BinaryOperator::Create(Logic, XBig, YOne);
2455  }
2456 
2457  // Fold: icmp pred ([us]div X, C2), C -> range test
2458  // Fold this div into the comparison, producing a range check.
2459  // Determine, based on the divide type, what the range is being
2460  // checked. If there is an overflow on the low or high side, remember
2461  // it, otherwise compute the range [low, hi) bounding the new value.
2462  // See: InsertRangeTest above for the kinds of replacements possible.
2463  const APInt *C2;
2464  if (!match(Y, m_APInt(C2)))
2465  return nullptr;
2466 
2467  // FIXME: If the operand types don't match the type of the divide
2468  // then don't attempt this transform. The code below doesn't have the
2469  // logic to deal with a signed divide and an unsigned compare (and
2470  // vice versa). This is because (x /s C2) <s C produces different
2471  // results than (x /s C2) <u C or (x /u C2) <s C or even
2472  // (x /u C2) <u C. Simply casting the operands and result won't
2473  // work. :( The if statement below tests that condition and bails
2474  // if it finds it.
2475  if (!Cmp.isEquality() && DivIsSigned != Cmp.isSigned())
2476  return nullptr;
2477 
2478  // The ProdOV computation fails on divide by 0 and divide by -1. Cases with
2479  // INT_MIN will also fail if the divisor is 1. Although folds of all these
2480  // division-by-constant cases should be present, we can not assert that they
2481  // have happened before we reach this icmp instruction.
2482  if (C2->isZero() || C2->isOne() || (DivIsSigned && C2->isAllOnes()))
2483  return nullptr;
2484 
2485  // Compute Prod = C * C2. We are essentially solving an equation of
2486  // form X / C2 = C. We solve for X by multiplying C2 and C.
2487  // By solving for X, we can turn this into a range check instead of computing
2488  // a divide.
2489  APInt Prod = C * *C2;
2490 
2491  // Determine if the product overflows by seeing if the product is not equal to
2492  // the divide. Make sure we do the same kind of divide as in the LHS
2493  // instruction that we're folding.
2494  bool ProdOV = (DivIsSigned ? Prod.sdiv(*C2) : Prod.udiv(*C2)) != C;
2495 
2496  // If the division is known to be exact, then there is no remainder from the
2497  // divide, so the covered range size is unit, otherwise it is the divisor.
2498  APInt RangeSize = Div->isExact() ? APInt(C2->getBitWidth(), 1) : *C2;
2499 
2500  // Figure out the interval that is being checked. For example, a comparison
2501  // like "X /u 5 == 0" is really checking that X is in the interval [0, 5).
2502  // Compute this interval based on the constants involved and the signedness of
2503  // the compare/divide. This computes a half-open interval, keeping track of
2504  // whether either value in the interval overflows. After analysis each
2505  // overflow variable is set to 0 if it's corresponding bound variable is valid
2506  // -1 if overflowed off the bottom end, or +1 if overflowed off the top end.
2507  int LoOverflow = 0, HiOverflow = 0;
2508  APInt LoBound, HiBound;
2509 
2510  if (!DivIsSigned) { // udiv
2511  // e.g. X/5 op 3 --> [15, 20)
2512  LoBound = Prod;
2513  HiOverflow = LoOverflow = ProdOV;
2514  if (!HiOverflow) {
2515  // If this is not an exact divide, then many values in the range collapse
2516  // to the same result value.
2517  HiOverflow = addWithOverflow(HiBound, LoBound, RangeSize, false);
2518  }
2519  } else if (C2->isStrictlyPositive()) { // Divisor is > 0.
2520  if (C.isZero()) { // (X / pos) op 0
2521  // Can't overflow. e.g. X/2 op 0 --> [-1, 2)
2522  LoBound = -(RangeSize - 1);
2523  HiBound = RangeSize;
2524  } else if (C.isStrictlyPositive()) { // (X / pos) op pos
2525  LoBound = Prod; // e.g. X/5 op 3 --> [15, 20)
2526  HiOverflow = LoOverflow = ProdOV;
2527  if (!HiOverflow)
2528  HiOverflow = addWithOverflow(HiBound, Prod, RangeSize, true);
2529  } else { // (X / pos) op neg
2530  // e.g. X/5 op -3 --> [-15-4, -15+1) --> [-19, -14)
2531  HiBound = Prod + 1;
2532  LoOverflow = HiOverflow = ProdOV ? -1 : 0;
2533  if (!LoOverflow) {
2534  APInt DivNeg = -RangeSize;
2535  LoOverflow = addWithOverflow(LoBound, HiBound, DivNeg, true) ? -1 : 0;
2536  }
2537  }
2538  } else if (C2->isNegative()) { // Divisor is < 0.
2539  if (Div->isExact())
2540  RangeSize.negate();
2541  if (C.isZero()) { // (X / neg) op 0
2542  // e.g. X/-5 op 0 --> [-4, 5)
2543  LoBound = RangeSize + 1;
2544  HiBound = -RangeSize;
2545  if (HiBound == *C2) { // -INTMIN = INTMIN
2546  HiOverflow = 1; // [INTMIN+1, overflow)
2547  HiBound = APInt(); // e.g. X/INTMIN = 0 --> X > INTMIN
2548  }
2549  } else if (C.isStrictlyPositive()) { // (X / neg) op pos
2550  // e.g. X/-5 op 3 --> [-19, -14)
2551  HiBound = Prod + 1;
2552  HiOverflow = LoOverflow = ProdOV ? -1 : 0;
2553  if (!LoOverflow)
2554  LoOverflow =
2555  addWithOverflow(LoBound, HiBound, RangeSize, true) ? -1 : 0;
2556  } else { // (X / neg) op neg
2557  LoBound = Prod; // e.g. X/-5 op -3 --> [15, 20)
2558  LoOverflow = HiOverflow = ProdOV;
2559  if (!HiOverflow)
2560  HiOverflow = subWithOverflow(HiBound, Prod, RangeSize, true);
2561  }
2562 
2563  // Dividing by a negative swaps the condition. LT <-> GT
2564  Pred = ICmpInst::getSwappedPredicate(Pred);
2565  }
2566 
2567  switch (Pred) {
2568  default:
2569  llvm_unreachable("Unhandled icmp predicate!");
2570  case ICmpInst::ICMP_EQ:
2571  if (LoOverflow && HiOverflow)
2572  return replaceInstUsesWith(Cmp, Builder.getFalse());
2573  if (HiOverflow)
2574  return new ICmpInst(DivIsSigned ? ICmpInst::ICMP_SGE : ICmpInst::ICMP_UGE,
2575  X, ConstantInt::get(Ty, LoBound));
2576  if (LoOverflow)
2577  return new ICmpInst(DivIsSigned ? ICmpInst::ICMP_SLT : ICmpInst::ICMP_ULT,
2578  X, ConstantInt::get(Ty, HiBound));
2579  return replaceInstUsesWith(
2580  Cmp, insertRangeTest(X, LoBound, HiBound, DivIsSigned, true));
2581  case ICmpInst::ICMP_NE:
2582  if (LoOverflow && HiOverflow)
2583  return replaceInstUsesWith(Cmp, Builder.getTrue());
2584  if (HiOverflow)
2585  return new ICmpInst(DivIsSigned ? ICmpInst::ICMP_SLT : ICmpInst::ICMP_ULT,
2586  X, ConstantInt::get(Ty, LoBound));
2587  if (LoOverflow)
2588  return new ICmpInst(DivIsSigned ? ICmpInst::ICMP_SGE : ICmpInst::ICMP_UGE,
2589  X, ConstantInt::get(Ty, HiBound));
2590  return replaceInstUsesWith(
2591  Cmp, insertRangeTest(X, LoBound, HiBound, DivIsSigned, false));
2592  case ICmpInst::ICMP_ULT:
2593  case ICmpInst::ICMP_SLT:
2594  if (LoOverflow == +1) // Low bound is greater than input range.
2595  return replaceInstUsesWith(Cmp, Builder.getTrue());
2596  if (LoOverflow == -1) // Low bound is less than input range.
2597  return replaceInstUsesWith(Cmp, Builder.getFalse());
2598  return new ICmpInst(Pred, X, ConstantInt::get(Ty, LoBound));
2599  case ICmpInst::ICMP_UGT:
2600  case ICmpInst::ICMP_SGT:
2601  if (HiOverflow == +1) // High bound greater than input range.
2602  return replaceInstUsesWith(Cmp, Builder.getFalse());
2603  if (HiOverflow == -1) // High bound less than input range.
2604  return replaceInstUsesWith(Cmp, Builder.getTrue());
2605  if (Pred == ICmpInst::ICMP_UGT)
2606  return new ICmpInst(ICmpInst::ICMP_UGE, X, ConstantInt::get(Ty, HiBound));
2607  return new ICmpInst(ICmpInst::ICMP_SGE, X, ConstantInt::get(Ty, HiBound));
2608  }
2609 
2610  return nullptr;
2611 }
2612 
2613 /// Fold icmp (sub X, Y), C.
2615  BinaryOperator *Sub,
2616  const APInt &C) {
2617  Value *X = Sub->getOperand(0), *Y = Sub->getOperand(1);
2618  ICmpInst::Predicate Pred = Cmp.getPredicate();
2619  Type *Ty = Sub->getType();
2620 
2621  // (SubC - Y) == C) --> Y == (SubC - C)
2622  // (SubC - Y) != C) --> Y != (SubC - C)
2623  Constant *SubC;
2624  if (Cmp.isEquality() && match(X, m_ImmConstant(SubC))) {
2625  return new ICmpInst(Pred, Y,
2627  }
2628 
2629  // (icmp P (sub nuw|nsw C2, Y), C) -> (icmp swap(P) Y, C2-C)
2630  const APInt *C2;
2631  APInt SubResult;
2632  ICmpInst::Predicate SwappedPred = Cmp.getSwappedPredicate();
2633  bool HasNSW = Sub->hasNoSignedWrap();
2634  bool HasNUW = Sub->hasNoUnsignedWrap();
2635  if (match(X, m_APInt(C2)) &&
2636  ((Cmp.isUnsigned() && HasNUW) || (Cmp.isSigned() && HasNSW)) &&
2637  !subWithOverflow(SubResult, *C2, C, Cmp.isSigned()))
2638  return new ICmpInst(SwappedPred, Y, ConstantInt::get(Ty, SubResult));
2639 
2640  // X - Y == 0 --> X == Y.
2641  // X - Y != 0 --> X != Y.
2642  // TODO: We allow this with multiple uses as long as the other uses are not
2643  // in phis. The phi use check is guarding against a codegen regression
2644  // for a loop test. If the backend could undo this (and possibly
2645  // subsequent transforms), we would not need this hack.
2646  if (Cmp.isEquality() && C.isZero() &&
2647  none_of((Sub->users()), [](const User *U) { return isa<PHINode>(U); }))
2648  return new ICmpInst(Pred, X, Y);
2649 
2650  // The following transforms are only worth it if the only user of the subtract
2651  // is the icmp.
2652  // TODO: This is an artificial restriction for all of the transforms below
2653  // that only need a single replacement icmp. Can these use the phi test
2654  // like the transform above here?
2655  if (!Sub->hasOneUse())
2656  return nullptr;
2657 
2658  if (Sub->hasNoSignedWrap()) {
2659  // (icmp sgt (sub nsw X, Y), -1) -> (icmp sge X, Y)
2660  if (Pred == ICmpInst::ICMP_SGT && C.isAllOnes())
2661  return new ICmpInst(ICmpInst::ICMP_SGE, X, Y);
2662 
2663  // (icmp sgt (sub nsw X, Y), 0) -> (icmp sgt X, Y)
2664  if (Pred == ICmpInst::ICMP_SGT && C.isZero())
2665  return new ICmpInst(ICmpInst::ICMP_SGT, X, Y);
2666 
2667  // (icmp slt (sub nsw X, Y), 0) -> (icmp slt X, Y)
2668  if (Pred == ICmpInst::ICMP_SLT && C.isZero())
2669  return new ICmpInst(ICmpInst::ICMP_SLT, X, Y);
2670 
2671  // (icmp slt (sub nsw X, Y), 1) -> (icmp sle X, Y)
2672  if (Pred == ICmpInst::ICMP_SLT && C.isOne())
2673  return new ICmpInst(ICmpInst::ICMP_SLE, X, Y);
2674  }
2675 
2676  if (!match(X, m_APInt(C2)))
2677  return nullptr;
2678 
2679  // C2 - Y <u C -> (Y | (C - 1)) == C2
2680  // iff (C2 & (C - 1)) == C - 1 and C is a power of 2
2681  if (Pred == ICmpInst::ICMP_ULT && C.isPowerOf2() &&
2682  (*C2 & (C - 1)) == (C - 1))
2683  return new ICmpInst(ICmpInst::ICMP_EQ, Builder.CreateOr(Y, C - 1), X);
2684 
2685  // C2 - Y >u C -> (Y | C) != C2
2686  // iff C2 & C == C and C + 1 is a power of 2
2687  if (Pred == ICmpInst::ICMP_UGT && (C + 1).isPowerOf2() && (*C2 & C) == C)
2688  return new ICmpInst(ICmpInst::ICMP_NE, Builder.CreateOr(Y, C), X);
2689 
2690  // We have handled special cases that reduce.
2691  // Canonicalize any remaining sub to add as:
2692  // (C2 - Y) > C --> (Y + ~C2) < ~C
2693  Value *Add = Builder.CreateAdd(Y, ConstantInt::get(Ty, ~(*C2)), "notsub",
2694  HasNUW, HasNSW);
2695  return new ICmpInst(SwappedPred, Add, ConstantInt::get(Ty, ~C));
2696 }
2697 
2698 /// Fold icmp (add X, Y), C.
2700  BinaryOperator *Add,
2701  const APInt &C) {
2702  Value *Y = Add->getOperand(1);
2703  const APInt *C2;
2704  if (Cmp.isEquality() || !match(Y, m_APInt(C2)))
2705  return nullptr;
2706 
2707  // Fold icmp pred (add X, C2), C.
2708  Value *X = Add->getOperand(0);
2709  Type *Ty = Add->getType();
2710  const CmpInst::Predicate Pred = Cmp.getPredicate();
2711 
2712  // If the add does not wrap, we can always adjust the compare by subtracting
2713  // the constants. Equality comparisons are handled elsewhere. SGE/SLE/UGE/ULE
2714  // are canonicalized to SGT/SLT/UGT/ULT.
2715  if ((Add->hasNoSignedWrap() &&
2716  (Pred == ICmpInst::ICMP_SGT || Pred == ICmpInst::ICMP_SLT)) ||
2717  (Add->hasNoUnsignedWrap() &&
2718  (Pred == ICmpInst::ICMP_UGT || Pred == ICmpInst::ICMP_ULT))) {
2719  bool Overflow;
2720  APInt NewC =
2721  Cmp.isSigned() ? C.ssub_ov(*C2, Overflow) : C.usub_ov(*C2, Overflow);
2722  // If there is overflow, the result must be true or false.
2723  // TODO: Can we assert there is no overflow because InstSimplify always
2724  // handles those cases?
2725  if (!Overflow)
2726  // icmp Pred (add nsw X, C2), C --> icmp Pred X, (C - C2)
2727  return new ICmpInst(Pred, X, ConstantInt::get(Ty, NewC));
2728  }
2729 
2730  auto CR = ConstantRange::makeExactICmpRegion(Pred, C).subtract(*C2);
2731  const APInt &Upper = CR.getUpper();
2732  const APInt &Lower = CR.getLower();
2733  if (Cmp.isSigned()) {
2734  if (Lower.isSignMask())
2735  return new ICmpInst(ICmpInst::ICMP_SLT, X, ConstantInt::get(Ty, Upper));
2736  if (Upper.isSignMask())
2737  return new ICmpInst(ICmpInst::ICMP_SGE, X, ConstantInt::get(Ty, Lower));
2738  } else {
2739  if (Lower.isMinValue())
2740  return new ICmpInst(ICmpInst::ICMP_ULT, X, ConstantInt::get(Ty, Upper));
2741  if (Upper.isMinValue())
2742  return new ICmpInst(ICmpInst::ICMP_UGE, X, ConstantInt::get(Ty, Lower));
2743  }
2744 
2745  // This set of folds is intentionally placed after folds that use no-wrapping
2746  // flags because those folds are likely better for later analysis/codegen.
2749 
2750  // Fold compare with offset to opposite sign compare if it eliminates offset:
2751  // (X + C2) >u C --> X <s -C2 (if C == C2 + SMAX)
2752  if (Pred == CmpInst::ICMP_UGT && C == *C2 + SMax)
2753  return new ICmpInst(ICmpInst::ICMP_SLT, X, ConstantInt::get(Ty, -(*C2)));
2754 
2755  // (X + C2) <u C --> X >s ~C2 (if C == C2 + SMIN)
2756  if (Pred == CmpInst::ICMP_ULT && C == *C2 + SMin)
2757  return new ICmpInst(ICmpInst::ICMP_SGT, X, ConstantInt::get(Ty, ~(*C2)));
2758 
2759  // (X + C2) >s C --> X <u (SMAX - C) (if C == C2 - 1)
2760  if (Pred == CmpInst::ICMP_SGT && C == *C2 - 1)
2761  return new ICmpInst(ICmpInst::ICMP_ULT, X, ConstantInt::get(Ty, SMax - C));
2762 
2763  // (X + C2) <s C --> X >u (C ^ SMAX) (if C == C2)
2764  if (Pred == CmpInst::ICMP_SLT && C == *C2)
2765  return new ICmpInst(ICmpInst::ICMP_UGT, X, ConstantInt::get(Ty, C ^ SMax));
2766 
2767  if (!Add->hasOneUse())
2768  return nullptr;
2769 
2770  // X+C <u C2 -> (X & -C2) == C
2771  // iff C & (C2-1) == 0
2772  // C2 is a power of 2
2773  if (Pred == ICmpInst::ICMP_ULT && C.isPowerOf2() && (*C2 & (C - 1)) == 0)
2774  return new ICmpInst(ICmpInst::ICMP_EQ, Builder.CreateAnd(X, -C),
2775  ConstantExpr::getNeg(cast<Constant>(Y)));
2776 
2777  // X+C >u C2 -> (X & ~C2) != C
2778  // iff C & C2 == 0
2779  // C2+1 is a power of 2
2780  if (Pred == ICmpInst::ICMP_UGT && (C + 1).isPowerOf2() && (*C2 & C) == 0)
2781  return new ICmpInst(ICmpInst::ICMP_NE, Builder.CreateAnd(X, ~C),
2782  ConstantExpr::getNeg(cast<Constant>(Y)));
2783 
2784  // The range test idiom can use either ult or ugt. Arbitrarily canonicalize
2785  // to the ult form.
2786  // X+C2 >u C -> X+(C2-C-1) <u ~C
2787  if (Pred == ICmpInst::ICMP_UGT)
2788  return new ICmpInst(ICmpInst::ICMP_ULT,
2789  Builder.CreateAdd(X, ConstantInt::get(Ty, *C2 - C - 1)),
2790  ConstantInt::get(Ty, ~C));
2791 
2792  return nullptr;
2793 }
2794 
2796  Value *&RHS, ConstantInt *&Less,
2797  ConstantInt *&Equal,
2798  ConstantInt *&Greater) {
2799  // TODO: Generalize this to work with other comparison idioms or ensure
2800  // they get canonicalized into this form.
2801 
2802  // select i1 (a == b),
2803  // i32 Equal,
2804  // i32 (select i1 (a < b), i32 Less, i32 Greater)
2805  // where Equal, Less and Greater are placeholders for any three constants.
2806  ICmpInst::Predicate PredA;
2807  if (!match(SI->getCondition(), m_ICmp(PredA, m_Value(LHS), m_Value(RHS))) ||
2808  !ICmpInst::isEquality(PredA))
2809  return false;
2810  Value *EqualVal = SI->getTrueValue();
2811  Value *UnequalVal = SI->getFalseValue();
2812  // We still can get non-canonical predicate here, so canonicalize.
2813  if (PredA == ICmpInst::ICMP_NE)
2814  std::swap(EqualVal, UnequalVal);
2815  if (!match(EqualVal, m_ConstantInt(Equal)))
2816  return false;
2817  ICmpInst::Predicate PredB;
2818  Value *LHS2, *RHS2;
2819  if (!match(UnequalVal, m_Select(m_ICmp(PredB, m_Value(LHS2), m_Value(RHS2)),
2820  m_ConstantInt(Less), m_ConstantInt(Greater))))
2821  return false;
2822  // We can get predicate mismatch here, so canonicalize if possible:
2823  // First, ensure that 'LHS' match.
2824  if (LHS2 != LHS) {
2825  // x sgt y <--> y slt x
2826  std::swap(LHS2, RHS2);
2827  PredB = ICmpInst::getSwappedPredicate(PredB);
2828  }
2829  if (LHS2 != LHS)
2830  return false;
2831  // We also need to canonicalize 'RHS'.
2832  if (PredB == ICmpInst::ICMP_SGT && isa<Constant>(RHS2)) {
2833  // x sgt C-1 <--> x sge C <--> not(x slt C)
2834  auto FlippedStrictness =
2836  PredB, cast<Constant>(RHS2));
2837  if (!FlippedStrictness)
2838  return false;
2839  assert(FlippedStrictness->first == ICmpInst::ICMP_SGE &&
2840  "basic correctness failure");
2841  RHS2 = FlippedStrictness->second;
2842  // And kind-of perform the result swap.
2843  std::swap(Less, Greater);
2844  PredB = ICmpInst::ICMP_SLT;
2845  }
2846  return PredB == ICmpInst::ICMP_SLT && RHS == RHS2;
2847 }
2848 
2850  SelectInst *Select,
2851  ConstantInt *C) {
2852 
2853  assert(C && "Cmp RHS should be a constant int!");
2854  // If we're testing a constant value against the result of a three way
2855  // comparison, the result can be expressed directly in terms of the
2856  // original values being compared. Note: We could possibly be more
2857  // aggressive here and remove the hasOneUse test. The original select is
2858  // really likely to simplify or sink when we remove a test of the result.
2859  Value *OrigLHS, *OrigRHS;
2860  ConstantInt *C1LessThan, *C2Equal, *C3GreaterThan;
2861  if (Cmp.hasOneUse() &&
2862  matchThreeWayIntCompare(Select, OrigLHS, OrigRHS, C1LessThan, C2Equal,
2863  C3GreaterThan)) {
2864  assert(C1LessThan && C2Equal && C3GreaterThan);
2865 
2866  bool TrueWhenLessThan =
2867  ConstantExpr::getCompare(Cmp.getPredicate(), C1LessThan, C)
2868  ->isAllOnesValue();
2869  bool TrueWhenEqual =
2870  ConstantExpr::getCompare(Cmp.getPredicate(), C2Equal, C)
2871  ->isAllOnesValue();
2872  bool TrueWhenGreaterThan =
2873  ConstantExpr::getCompare(Cmp.getPredicate(), C3GreaterThan, C)
2874  ->isAllOnesValue();
2875 
2876  // This generates the new instruction that will replace the original Cmp
2877  // Instruction. Instead of enumerating the various combinations when
2878  // TrueWhenLessThan, TrueWhenEqual and TrueWhenGreaterThan are true versus
2879  // false, we rely on chaining of ORs and future passes of InstCombine to
2880  // simplify the OR further (i.e. a s< b || a == b becomes a s<= b).
2881 
2882  // When none of the three constants satisfy the predicate for the RHS (C),
2883  // the entire original Cmp can be simplified to a false.
2884  Value *Cond = Builder.getFalse();
2885  if (TrueWhenLessThan)
2886  Cond = Builder.CreateOr(Cond, Builder.CreateICmp(ICmpInst::ICMP_SLT,
2887  OrigLHS, OrigRHS));
2888  if (TrueWhenEqual)
2889  Cond = Builder.CreateOr(Cond, Builder.CreateICmp(ICmpInst::ICMP_EQ,
2890  OrigLHS, OrigRHS));
2891  if (TrueWhenGreaterThan)
2892  Cond = Builder.CreateOr(Cond, Builder.CreateICmp(ICmpInst::ICMP_SGT,
2893  OrigLHS, OrigRHS));
2894 
2895  return replaceInstUsesWith(Cmp, Cond);
2896  }
2897  return nullptr;
2898 }
2899 
2901  auto *Bitcast = dyn_cast<BitCastInst>(Cmp.getOperand(0));
2902  if (!Bitcast)
2903  return nullptr;
2904 
2905  ICmpInst::Predicate Pred = Cmp.getPredicate();
2906  Value *Op1 = Cmp.getOperand(1);
2907  Value *BCSrcOp = Bitcast->getOperand(0);
2908  Type *SrcType = Bitcast->getSrcTy();
2909  Type *DstType = Bitcast->getType();
2910 
2911  // Make sure the bitcast doesn't change between scalar and vector and
2912  // doesn't change the number of vector elements.
2913  if (SrcType->isVectorTy() == DstType->isVectorTy() &&
2914  SrcType->getScalarSizeInBits() == DstType->getScalarSizeInBits()) {
2915  // Zero-equality and sign-bit checks are preserved through sitofp + bitcast.
2916  Value *X;
2917  if (match(BCSrcOp, m_SIToFP(m_Value(X)))) {
2918  // icmp eq (bitcast (sitofp X)), 0 --> icmp eq X, 0
2919  // icmp ne (bitcast (sitofp X)), 0 --> icmp ne X, 0
2920  // icmp slt (bitcast (sitofp X)), 0 --> icmp slt X, 0
2921  // icmp sgt (bitcast (sitofp X)), 0 --> icmp sgt X, 0
2922  if ((Pred == ICmpInst::ICMP_EQ || Pred == ICmpInst::ICMP_SLT ||
2923  Pred == ICmpInst::ICMP_NE || Pred == ICmpInst::ICMP_SGT) &&
2924  match(Op1, m_Zero()))
2925  return new ICmpInst(Pred, X, ConstantInt::getNullValue(X->getType()));
2926 
2927  // icmp slt (bitcast (sitofp X)), 1 --> icmp slt X, 1
2928  if (Pred == ICmpInst::ICMP_SLT && match(Op1, m_One()))
2929  return new ICmpInst(Pred, X, ConstantInt::get(X->getType(), 1));
2930 
2931  // icmp sgt (bitcast (sitofp X)), -1 --> icmp sgt X, -1
2932  if (Pred == ICmpInst::ICMP_SGT && match(Op1, m_AllOnes()))
2933  return new ICmpInst(Pred, X,
2934  ConstantInt::getAllOnesValue(X->getType()));
2935  }
2936 
2937  // Zero-equality checks are preserved through unsigned floating-point casts:
2938  // icmp eq (bitcast (uitofp X)), 0 --> icmp eq X, 0
2939  // icmp ne (bitcast (uitofp X)), 0 --> icmp ne X, 0
2940  if (match(BCSrcOp, m_UIToFP(m_Value(X))))
2941  if (Cmp.isEquality() && match(Op1, m_Zero()))
2942  return new ICmpInst(Pred, X, ConstantInt::getNullValue(X->getType()));
2943 
2944  // If this is a sign-bit test of a bitcast of a casted FP value, eliminate
2945  // the FP extend/truncate because that cast does not change the sign-bit.
2946  // This is true for all standard IEEE-754 types and the X86 80-bit type.
2947  // The sign-bit is always the most significant bit in those types.
2948  const APInt *C;
2949  bool TrueIfSigned;
2950  if (match(Op1, m_APInt(C)) && Bitcast->hasOneUse() &&
2951  InstCombiner::isSignBitCheck(Pred, *C, TrueIfSigned)) {
2952  if (match(BCSrcOp, m_FPExt(m_Value(X))) ||
2953  match(BCSrcOp, m_FPTrunc(m_Value(X)))) {
2954  // (bitcast (fpext/fptrunc X)) to iX) < 0 --> (bitcast X to iY) < 0
2955  // (bitcast (fpext/fptrunc X)) to iX) > -1 --> (bitcast X to iY) > -1
2956  Type *XType = X->getType();
2957 
2958  // We can't currently handle Power style floating point operations here.
2959  if (!(XType->isPPC_FP128Ty() || SrcType->isPPC_FP128Ty())) {
2960  Type *NewType = Builder.getIntNTy(XType->getScalarSizeInBits());
2961  if (auto *XVTy = dyn_cast<VectorType>(XType))
2962  NewType = VectorType::get(NewType, XVTy->getElementCount());
2963  Value *NewBitcast = Builder.CreateBitCast(X, NewType);
2964  if (TrueIfSigned)
2965  return new ICmpInst(ICmpInst::ICMP_SLT, NewBitcast,
2966  ConstantInt::getNullValue(NewType));
2967  else
2968  return new ICmpInst(ICmpInst::ICMP_SGT, NewBitcast,
2969  ConstantInt::getAllOnesValue(NewType));
2970  }
2971  }
2972  }
2973  }
2974 
2975  // Test to see if the operands of the icmp are casted versions of other
2976  // values. If the ptr->ptr cast can be stripped off both arguments, do so.
2977  if (DstType->isPointerTy() && (isa<Constant>(Op1) || isa<BitCastInst>(Op1))) {
2978  // If operand #1 is a bitcast instruction, it must also be a ptr->ptr cast
2979  // so eliminate it as well.
2980  if (auto *BC2 = dyn_cast<BitCastInst>(Op1))
2981  Op1 = BC2->getOperand(0);
2982 
2983  Op1 = Builder.CreateBitCast(Op1, SrcType);
2984  return new ICmpInst(Pred, BCSrcOp, Op1);
2985  }
2986 
2987  const APInt *C;
2988  if (!match(Cmp.getOperand(1), m_APInt(C)) || !DstType->isIntegerTy() ||
2989  !SrcType->isIntOrIntVectorTy())
2990  return nullptr;
2991 
2992  // If this is checking if all elements of a vector compare are set or not,
2993  // invert the casted vector equality compare and test if all compare
2994  // elements are clear or not. Compare against zero is generally easier for
2995  // analysis and codegen.
2996  // icmp eq/ne (bitcast (not X) to iN), -1 --> icmp eq/ne (bitcast X to iN), 0
2997  // Example: are all elements equal? --> are zero elements not equal?
2998  // TODO: Try harder to reduce compare of 2 freely invertible operands?
2999  if (Cmp.isEquality() && C->isAllOnes() && Bitcast->hasOneUse() &&
3000  isFreeToInvert(BCSrcOp, BCSrcOp->hasOneUse())) {
3001  Value *Cast = Builder.CreateBitCast(Builder.CreateNot(BCSrcOp), DstType);
3002  return new ICmpInst(Pred, Cast, ConstantInt::getNullValue(DstType));
3003  }
3004 
3005  // If this is checking if all elements of an extended vector are clear or not,
3006  // compare in a narrow type to eliminate the extend:
3007  // icmp eq/ne (bitcast (ext X) to iN), 0 --> icmp eq/ne (bitcast X to iM), 0
3008  Value *X;
3009  if (Cmp.isEquality() && C->isZero() && Bitcast->hasOneUse() &&
3010  match(BCSrcOp, m_ZExtOrSExt(m_Value(X)))) {
3011  if (auto *VecTy = dyn_cast<FixedVectorType>(X->getType())) {
3012  Type *NewType = Builder.getIntNTy(VecTy->getPrimitiveSizeInBits());
3013  Value *NewCast = Builder.CreateBitCast(X, NewType);
3014  return new ICmpInst(Pred, NewCast, ConstantInt::getNullValue(NewType));
3015  }
3016  }
3017 
3018  // Folding: icmp <pred> iN X, C
3019  // where X = bitcast <M x iK> (shufflevector <M x iK> %vec, undef, SC)) to iN
3020  // and C is a splat of a K-bit pattern
3021  // and SC is a constant vector = <C', C', C', ..., C'>
3022  // Into:
3023  // %E = extractelement <M x iK> %vec, i32 C'
3024  // icmp <pred> iK %E, trunc(C)
3025  Value *Vec;
3027  if (match(BCSrcOp, m_Shuffle(m_Value(Vec), m_Undef(), m_Mask(Mask)))) {
3028  // Check whether every element of Mask is the same constant
3029  if (is_splat(Mask)) {
3030  auto *VecTy = cast<VectorType>(SrcType);
3031  auto *EltTy = cast<IntegerType>(VecTy->getElementType());
3032  if (C->isSplat(EltTy->getBitWidth())) {
3033  // Fold the icmp based on the value of C
3034  // If C is M copies of an iK sized bit pattern,
3035  // then:
3036  // => %E = extractelement <N x iK> %vec, i32 Elem
3037  // icmp <pred> iK %SplatVal, <pattern>
3038  Value *Elem = Builder.getInt32(Mask[0]);
3039  Value *Extract = Builder.CreateExtractElement(Vec, Elem);
3040  Value *NewC = ConstantInt::get(EltTy, C->trunc(EltTy->getBitWidth()));
3041  return new ICmpInst(Pred, Extract, NewC);
3042  }
3043  }
3044  }
3045  return nullptr;
3046 }
3047 
3048 /// Try to fold integer comparisons with a constant operand: icmp Pred X, C
3049 /// where X is some kind of instruction.
3051  const APInt *C;
3052 
3053  if (match(Cmp.getOperand(1), m_APInt(C))) {
3054  if (auto *BO = dyn_cast<BinaryOperator>(Cmp.getOperand(0)))
3055  if (Instruction *I = foldICmpBinOpWithConstant(Cmp, BO, *C))
3056  return I;
3057 
3058  if (auto *SI = dyn_cast<SelectInst>(Cmp.getOperand(0)))
3059  // For now, we only support constant integers while folding the
3060  // ICMP(SELECT)) pattern. We can extend this to support vector of integers
3061  // similar to the cases handled by binary ops above.
3062  if (auto *ConstRHS = dyn_cast<ConstantInt>(Cmp.getOperand(1)))
3063  if (Instruction *I = foldICmpSelectConstant(Cmp, SI, ConstRHS))
3064  return I;
3065 
3066  if (auto *TI = dyn_cast<TruncInst>(Cmp.getOperand(0)))
3067  if (Instruction *I = foldICmpTruncConstant(Cmp, TI, *C))
3068  return I;
3069 
3070  if (auto *II = dyn_cast<IntrinsicInst>(Cmp.getOperand(0)))
3071  if (Instruction *I = foldICmpIntrinsicWithConstant(Cmp, II, *C))
3072  return I;
3073  }
3074 
3075  if (match(Cmp.getOperand(1), m_APIntAllowUndef(C)))
3076  return foldICmpInstWithConstantAllowUndef(Cmp, *C);
3077 
3078  return nullptr;
3079 }
3080 
3081 /// Fold an icmp equality instruction with binary operator LHS and constant RHS:
3082 /// icmp eq/ne BO, C.
3084  ICmpInst &Cmp, BinaryOperator *BO, const APInt &C) {
3085  // TODO: Some of these folds could work with arbitrary constants, but this
3086  // function is limited to scalar and vector splat constants.
3087  if (!Cmp.isEquality())
3088  return nullptr;
3089 
3090  ICmpInst::Predicate Pred = Cmp.getPredicate();
3091  bool isICMP_NE = Pred == ICmpInst::ICMP_NE;
3092  Constant *RHS = cast<Constant>(Cmp.getOperand(1));
3093  Value *BOp0 = BO->getOperand(0), *BOp1 = BO->getOperand(1);
3094 
3095  switch (BO->getOpcode()) {
3096  case Instruction::SRem:
3097  // If we have a signed (X % (2^c)) == 0, turn it into an unsigned one.
3098  if (C.isZero() && BO->hasOneUse()) {
3099  const APInt *BOC;
3100  if (match(BOp1, m_APInt(BOC)) && BOC->sgt(1) && BOC->isPowerOf2()) {
3101  Value *NewRem = Builder.CreateURem(BOp0, BOp1, BO->getName());
3102  return new ICmpInst(Pred, NewRem,
3104  }
3105  }
3106  break;
3107  case Instruction::Add: {
3108  // Replace ((add A, B) != C) with (A != C-B) if B & C are constants.
3109  if (Constant *BOC = dyn_cast<Constant>(BOp1)) {
3110  if (BO->hasOneUse())
3111  return new ICmpInst(Pred, BOp0, ConstantExpr::getSub(RHS, BOC));
3112  } else if (C.isZero()) {
3113  // Replace ((add A, B) != 0) with (A != -B) if A or B is
3114  // efficiently invertible, or if the add has just this one use.
3115  if (Value *NegVal = dyn_castNegVal(BOp1))
3116  return new ICmpInst(Pred, BOp0, NegVal);
3117  if (Value *NegVal = dyn_castNegVal(BOp0))
3118  return new ICmpInst(Pred, NegVal, BOp1);
3119  if (BO->hasOneUse()) {
3120  Value *Neg = Builder.CreateNeg(BOp1);
3121  Neg->takeName(BO);
3122  return new ICmpInst(Pred, BOp0, Neg);
3123  }
3124  }
3125  break;
3126  }
3127  case Instruction::Xor:
3128  if (BO->hasOneUse()) {
3129  if (Constant *BOC = dyn_cast<Constant>(BOp1)) {
3130  // For the xor case, we can xor two constants together, eliminating
3131  // the explicit xor.
3132  return new ICmpInst(Pred, BOp0, ConstantExpr::getXor(RHS, BOC));
3133  } else if (C.isZero()) {
3134  // Replace ((xor A, B) != 0) with (A != B)
3135  return new ICmpInst(Pred, BOp0, BOp1);
3136  }
3137  }
3138  break;
3139  case Instruction::Or: {
3140  const APInt *BOC;
3141  if (match(BOp1, m_APInt(BOC)) && BO->hasOneUse() && RHS->isAllOnesValue()) {
3142  // Comparing if all bits outside of a constant mask are set?
3143  // Replace (X | C) == -1 with (X & ~C) == ~C.
3144  // This removes the -1 constant.
3145  Constant *NotBOC = ConstantExpr::getNot(cast<Constant>(BOp1));
3146  Value *And = Builder.CreateAnd(BOp0, NotBOC);
3147  return new ICmpInst(Pred, And, NotBOC);
3148  }
3149  break;
3150  }
3151  case Instruction::And: {
3152  const APInt *BOC;
3153  if (match(BOp1, m_APInt(BOC))) {
3154  // If we have ((X & C) == C), turn it into ((X & C) != 0).
3155  if (C == *BOC && C.isPowerOf2())
3156  return new ICmpInst(isICMP_NE ? ICmpInst::ICMP_EQ : ICmpInst::ICMP_NE,
3158  }
3159  break;
3160  }
3161  case Instruction::UDiv:
3162  if (C.isZero()) {
3163  // (icmp eq/ne (udiv A, B), 0) -> (icmp ugt/ule i32 B, A)
3164  auto NewPred = isICMP_NE ? ICmpInst::ICMP_ULE : ICmpInst::ICMP_UGT;
3165  return new ICmpInst(NewPred, BOp1, BOp0);
3166  }
3167  break;
3168  default:
3169  break;
3170  }
3171  return nullptr;
3172 }
3173 
3174 /// Fold an equality icmp with LLVM intrinsic and constant operand.
3176  ICmpInst &Cmp, IntrinsicInst *II, const APInt &C) {
3177  Type *Ty = II->getType();
3178  unsigned BitWidth = C.getBitWidth();
3179  const ICmpInst::Predicate Pred = Cmp.getPredicate();
3180 
3181  switch (II->getIntrinsicID()) {
3182  case Intrinsic::abs:
3183  // abs(A) == 0 -> A == 0
3184  // abs(A) == INT_MIN -> A == INT_MIN
3185  if (C.isZero() || C.isMinSignedValue())
3186  return new ICmpInst(Pred, II->getArgOperand(0), ConstantInt::get(Ty, C));
3187  break;
3188 
3189  case Intrinsic::bswap:
3190  // bswap(A) == C -> A == bswap(C)
3191  return new ICmpInst(Pred, II->getArgOperand(0),
3192  ConstantInt::get(Ty, C.byteSwap()));
3193 
3194  case Intrinsic::ctlz:
3195  case Intrinsic::cttz: {
3196  // ctz(A) == bitwidth(A) -> A == 0 and likewise for !=
3197  if (C == BitWidth)
3198  return new ICmpInst(Pred, II->getArgOperand(0),
3200 
3201  // ctz(A) == C -> A & Mask1 == Mask2, where Mask2 only has bit C set
3202  // and Mask1 has bits 0..C+1 set. Similar for ctl, but for high bits.
3203  // Limit to one use to ensure we don't increase instruction count.
3204  unsigned Num = C.getLimitedValue(BitWidth);
3205  if (Num != BitWidth && II->hasOneUse()) {
3206  bool IsTrailing = II->getIntrinsicID() == Intrinsic::cttz;
3207  APInt Mask1 = IsTrailing ? APInt::getLowBitsSet(BitWidth, Num + 1)
3208  : APInt::getHighBitsSet(BitWidth, Num + 1);
3209  APInt Mask2 = IsTrailing
3211  : APInt::getOneBitSet(BitWidth, BitWidth - Num - 1);
3212  return new ICmpInst(Pred, Builder.CreateAnd(II->getArgOperand(0), Mask1),
3213  ConstantInt::get(Ty, Mask2));
3214  }
3215  break;
3216  }
3217 
3218  case Intrinsic::ctpop: {
3219  // popcount(A) == 0 -> A == 0 and likewise for !=
3220  // popcount(A) == bitwidth(A) -> A == -1 and likewise for !=
3221  bool IsZero = C.isZero();
3222  if (IsZero || C == BitWidth)
3223  return new ICmpInst(Pred, II->getArgOperand(0),
3224  IsZero ? Constant::getNullValue(Ty)
3226 
3227  break;
3228  }
3229 
3230  case Intrinsic::fshl:
3231  case Intrinsic::fshr:
3232  if (II->getArgOperand(0) == II->getArgOperand(1)) {
3233  const APInt *RotAmtC;
3234  // ror(X, RotAmtC) == C --> X == rol(C, RotAmtC)
3235  // rol(X, RotAmtC) == C --> X == ror(C, RotAmtC)
3236  if (match(II->getArgOperand(2), m_APInt(RotAmtC)))
3237  return new ICmpInst(Pred, II->getArgOperand(0),
3238  II->getIntrinsicID() == Intrinsic::fshl
3239  ? ConstantInt::get(Ty, C.rotr(*RotAmtC))
3240  : ConstantInt::get(Ty, C.rotl(*RotAmtC)));
3241  }
3242  break;
3243 
3244  case Intrinsic::uadd_sat: {
3245  // uadd.sat(a, b) == 0 -> (a | b) == 0
3246  if (C.isZero()) {
3247  Value *Or = Builder.CreateOr(II->getArgOperand(0), II->getArgOperand(1));
3248  return new ICmpInst(Pred, Or, Constant::getNullValue(Ty));
3249  }
3250  break;
3251  }
3252 
3253  case Intrinsic::usub_sat: {
3254  // usub.sat(a, b) == 0 -> a <= b
3255  if (C.isZero()) {
3256  ICmpInst::Predicate NewPred =
3258  return new ICmpInst(NewPred, II->getArgOperand(0), II->getArgOperand(1));
3259  }
3260  break;
3261  }
3262  default:
3263  break;
3264  }
3265 
3266  return nullptr;
3267 }
3268 
3269 /// Fold an icmp with LLVM intrinsics
3271  assert(Cmp.isEquality());
3272 
3273  ICmpInst::Predicate Pred = Cmp.getPredicate();
3274  Value *Op0 = Cmp.getOperand(0);
3275  Value *Op1 = Cmp.getOperand(1);
3276  const auto *IIOp0 = dyn_cast<IntrinsicInst>(Op0);
3277  const auto *IIOp1 = dyn_cast<IntrinsicInst>(Op1);
3278  if (!IIOp0 || !IIOp1 || IIOp0->getIntrinsicID() != IIOp1->getIntrinsicID())
3279  return nullptr;
3280 
3281  switch (IIOp0->getIntrinsicID()) {
3282  case Intrinsic::bswap:
3283  case Intrinsic::bitreverse:
3284  // If both operands are byte-swapped or bit-reversed, just compare the
3285  // original values.
3286  return new ICmpInst(Pred, IIOp0->getOperand(0), IIOp1->getOperand(0));
3287  case Intrinsic::fshl:
3288  case Intrinsic::fshr:
3289  // If both operands are rotated by same amount, just compare the
3290  // original values.
3291  if (IIOp0->getOperand(0) != IIOp0->getOperand(1))
3292  break;
3293  if (IIOp1->getOperand(0) != IIOp1->getOperand(1))
3294  break;
3295  if (IIOp0->getOperand(2) != IIOp1->getOperand(2))
3296  break;
3297  return new ICmpInst(Pred, IIOp0->getOperand(0), IIOp1->getOperand(0));
3298  default:
3299  break;
3300  }
3301 
3302  return nullptr;
3303 }
3304 
3305 /// Try to fold integer comparisons with a constant operand: icmp Pred X, C
3306 /// where X is some kind of instruction and C is AllowUndef.
3307 /// TODO: Move more folds which allow undef to this function.
3308 Instruction *
3310  const APInt &C) {
3311  const ICmpInst::Predicate Pred = Cmp.getPredicate();
3312  if (auto *II = dyn_cast<IntrinsicInst>(Cmp.getOperand(0))) {
3313  switch (II->getIntrinsicID()) {
3314  default:
3315  break;
3316  case Intrinsic::fshl:
3317  case Intrinsic::fshr:
3318  if (Cmp.isEquality() && II->getArgOperand(0) == II->getArgOperand(1)) {
3319  // (rot X, ?) == 0/-1 --> X == 0/-1
3320  if (C.isZero() || C.isAllOnes())
3321  return new ICmpInst(Pred, II->getArgOperand(0), Cmp.getOperand(1));
3322  }
3323  break;
3324  }
3325  }
3326 
3327  return nullptr;
3328 }
3329 
3330 /// Fold an icmp with BinaryOp and constant operand: icmp Pred BO, C.
3332  BinaryOperator *BO,
3333  const APInt &C) {
3334  switch (BO->getOpcode()) {
3335  case Instruction::Xor:
3336  if (Instruction *I = foldICmpXorConstant(Cmp, BO, C))
3337  return I;
3338  break;
3339  case Instruction::And:
3340  if (Instruction *I = foldICmpAndConstant(Cmp, BO, C))
3341  return I;
3342  break;
3343  case Instruction::Or:
3344  if (Instruction *I = foldICmpOrConstant(Cmp, BO, C))
3345  return I;
3346  break;
3347  case Instruction::Mul:
3348  if (Instruction *I = foldICmpMulConstant(Cmp, BO, C))
3349  return I;
3350  break;
3351  case Instruction::Shl:
3352  if (Instruction *I = foldICmpShlConstant(Cmp, BO, C))
3353  return I;
3354  break;
3355  case Instruction::LShr:
3356  case Instruction::AShr:
3357  if (Instruction *I = foldICmpShrConstant(Cmp, BO, C))
3358  return I;
3359  break;
3360  case Instruction::SRem:
3361  if (Instruction *I = foldICmpSRemConstant(Cmp, BO, C))
3362  return I;
3363  break;
3364  case Instruction::UDiv:
3365  if (Instruction *I = foldICmpUDivConstant(Cmp, BO, C))
3366  return I;
3368  case Instruction::SDiv:
3369  if (Instruction *I = foldICmpDivConstant(Cmp, BO, C))
3370  return I;
3371  break;
3372  case Instruction::Sub:
3373  if (Instruction *I = foldICmpSubConstant(Cmp, BO, C))
3374  return I;
3375  break;
3376  case Instruction::Add:
3377  if (Instruction *I = foldICmpAddConstant(Cmp, BO, C))
3378  return I;
3379  break;
3380  default:
3381  break;
3382  }
3383 
3384  // TODO: These folds could be refactored to be part of the above calls.
3385  return foldICmpBinOpEqualityWithConstant(Cmp, BO, C);
3386 }
3387 
3388 /// Fold an icmp with LLVM intrinsic and constant operand: icmp Pred II, C.
3390  IntrinsicInst *II,
3391  const APInt &C) {
3392  if (Cmp.isEquality())
3393  return foldICmpEqIntrinsicWithConstant(Cmp, II, C);
3394 
3395  Type *Ty = II->getType();
3396  unsigned BitWidth = C.getBitWidth();
3397  ICmpInst::Predicate Pred = Cmp.getPredicate();
3398  switch (II->getIntrinsicID()) {
3399  case Intrinsic::ctpop: {
3400  // (ctpop X > BitWidth - 1) --> X == -1
3401  Value *X = II->getArgOperand(0);
3402  if (C == BitWidth - 1 && Pred == ICmpInst::ICMP_UGT)
3403  return CmpInst::Create(Instruction::ICmp, ICmpInst::ICMP_EQ, X,
3405  // (ctpop X < BitWidth) --> X != -1
3406  if (C == BitWidth && Pred == ICmpInst::ICMP_ULT)
3407  return CmpInst::Create(Instruction::ICmp, ICmpInst::ICMP_NE, X,
3409  break;
3410  }
3411  case Intrinsic::ctlz: {
3412  // ctlz(0bXXXXXXXX) > 3 -> 0bXXXXXXXX < 0b00010000
3413  if (Pred == ICmpInst::ICMP_UGT && C.ult(BitWidth)) {
3414  unsigned Num = C.getLimitedValue();
3415  APInt Limit = APInt::getOneBitSet(BitWidth, BitWidth - Num - 1);
3416  return CmpInst::Create(Instruction::ICmp, ICmpInst::ICMP_ULT,
3417  II->getArgOperand(0), ConstantInt::get(Ty, Limit));
3418  }
3419 
3420  // ctlz(0bXXXXXXXX) < 3 -> 0bXXXXXXXX > 0b00011111
3421  if (Pred == ICmpInst::ICMP_ULT && C.uge(1) && C.ule(BitWidth)) {
3422  unsigned Num = C.getLimitedValue();
3423  APInt Limit = APInt::getLowBitsSet(BitWidth, BitWidth - Num);
3424  return CmpInst::Create(Instruction::ICmp, ICmpInst::ICMP_UGT,
3425  II->getArgOperand(0), ConstantInt::get(Ty, Limit));
3426  }
3427  break;
3428  }
3429  case Intrinsic::cttz: {
3430  // Limit to one use to ensure we don't increase instruction count.
3431  if (!II->hasOneUse())
3432  return nullptr;
3433 
3434  // cttz(0bXXXXXXXX) > 3 -> 0bXXXXXXXX & 0b00001111 == 0
3435  if (Pred == ICmpInst::ICMP_UGT && C.ult(BitWidth)) {
3436  APInt Mask = APInt::getLowBitsSet(BitWidth, C.getLimitedValue() + 1);
3437  return CmpInst::Create(Instruction::ICmp, ICmpInst::ICMP_EQ,
3438  Builder.CreateAnd(II->getArgOperand(0), Mask),
3440  }
3441 
3442  // cttz(0bXXXXXXXX) < 3 -> 0bXXXXXXXX & 0b00000111 != 0
3443  if (Pred == ICmpInst::ICMP_ULT && C.uge(1) && C.ule(BitWidth)) {
3444  APInt Mask = APInt::getLowBitsSet(BitWidth, C.getLimitedValue());
3445  return CmpInst::Create(Instruction::ICmp, ICmpInst::ICMP_NE,
3446  Builder.CreateAnd(II->getArgOperand(0), Mask),
3448  }
3449  break;
3450  }
3451  default:
3452  break;
3453  }
3454 
3455  return nullptr;
3456 }
3457 
3458 /// Handle icmp with constant (but not simple integer constant) RHS.
3460  Value *Op0 = I.getOperand(0), *Op1 = I.getOperand(1);
3461  Constant *RHSC = dyn_cast<Constant>(Op1);
3462  Instruction *LHSI = dyn_cast<Instruction>(Op0);
3463  if (!RHSC || !LHSI)
3464  return nullptr;
3465 
3466  switch (LHSI->getOpcode()) {
3467  case Instruction::GetElementPtr:
3468  // icmp pred GEP (P, int 0, int 0, int 0), null -> icmp pred P, null
3469  if (RHSC->isNullValue() &&
3470  cast<GetElementPtrInst>(LHSI)->hasAllZeroIndices())
3471  return new ICmpInst(
3472  I.getPredicate(), LHSI->getOperand(0),
3474  break;
3475  case Instruction::PHI:
3476  // Only fold icmp into the PHI if the phi and icmp are in the same
3477  // block. If in the same block, we're encouraging jump threading. If
3478  // not, we are just pessimizing the code by making an i1 phi.
3479  if (LHSI->getParent() == I.getParent())
3480  if (Instruction *NV = foldOpIntoPhi(I, cast<PHINode>(LHSI)))
3481  return NV;
3482  break;
3483  case Instruction::IntToPtr:
3484  // icmp pred inttoptr(X), null -> icmp pred X, 0
3485  if (RHSC->isNullValue() &&
3486  DL.getIntPtrType(RHSC->getType()) == LHSI->getOperand(0)->getType())
3487  return new ICmpInst(
3488  I.getPredicate(), LHSI->getOperand(0),
3490  break;
3491 
3492  case Instruction::Load:
3493  // Try to optimize things like "A[i] > 4" to index computations.
3494  if (GetElementPtrInst *GEP =
3495  dyn_cast<GetElementPtrInst>(LHSI->getOperand(0)))
3496  if (GlobalVariable *GV = dyn_cast<GlobalVariable>(GEP->getOperand(0)))
3497  if (Instruction *Res =
3498  foldCmpLoadFromIndexedGlobal(cast<LoadInst>(LHSI), GEP, GV, I))
3499  return Res;
3500  break;
3501  }
3502 
3503  return nullptr;
3504 }
3505 
3507  SelectInst *SI, Value *RHS,
3508  const ICmpInst &I) {
3509  // Try to fold the comparison into the select arms, which will cause the
3510  // select to be converted into a logical and/or.
3511  auto SimplifyOp = [&](Value *Op, bool SelectCondIsTrue) -> Value * {
3512  if (Value *Res = simplifyICmpInst(Pred, Op, RHS, SQ))
3513  return Res;
3514  if (Optional<bool> Impl = isImpliedCondition(SI->getCondition(), Pred, Op,
3515  RHS, DL, SelectCondIsTrue))
3516  return ConstantInt::get(I.getType(), *Impl);
3517  return nullptr;
3518  };
3519 
3520  ConstantInt *CI = nullptr;
3521  Value *Op1 = SimplifyOp(SI->getOperand(1), true);
3522  if (Op1)
3523  CI = dyn_cast<ConstantInt>(Op1);
3524 
3525  Value *Op2 = SimplifyOp(SI->getOperand(2), false);
3526  if (Op2)
3527  CI = dyn_cast<ConstantInt>(Op2);
3528 
3529  // We only want to perform this transformation if it will not lead to
3530  // additional code. This is true if either both sides of the select
3531  // fold to a constant (in which case the icmp is replaced with a select
3532  // which will usually simplify) or this is the only user of the
3533  // select (in which case we are trading a select+icmp for a simpler
3534  // select+icmp) or all uses of the select can be replaced based on
3535  // dominance information ("Global cases").
3536  bool Transform = false;
3537  if (Op1 && Op2)
3538  Transform = true;
3539  else if (Op1 || Op2) {
3540  // Local case
3541  if (SI->hasOneUse())
3542  Transform = true;
3543  // Global cases
3544  else if (CI && !CI->isZero())
3545  // When Op1 is constant try replacing select with second operand.
3546  // Otherwise Op2 is constant and try replacing select with first
3547  // operand.
3548  Transform = replacedSelectWithOperand(SI, &I, Op1 ? 2 : 1);
3549  }
3550  if (Transform) {
3551  if (!Op1)
3552  Op1 = Builder.CreateICmp(Pred, SI->getOperand(1), RHS, I.getName());
3553  if (!Op2)
3554  Op2 = Builder.CreateICmp(Pred, SI->getOperand(2), RHS, I.getName());
3555  return SelectInst::Create(SI->getOperand(0), Op1, Op2);
3556  }
3557 
3558  return nullptr;
3559 }
3560 
3561 /// Some comparisons can be simplified.
3562 /// In this case, we are looking for comparisons that look like
3563 /// a check for a lossy truncation.
3564 /// Folds:
3565 /// icmp SrcPred (x & Mask), x to icmp DstPred x, Mask
3566 /// Where Mask is some pattern that produces all-ones in low bits:
3567 /// (-1 >> y)
3568 /// ((-1 << y) >> y) <- non-canonical, has extra uses
3569 /// ~(-1 << y)
3570 /// ((1 << y) + (-1)) <- non-canonical, has extra uses
3571 /// The Mask can be a constant, too.
3572 /// For some predicates, the operands are commutative.
3573 /// For others, x can only be on a specific side.
3576  ICmpInst::Predicate SrcPred;
3577  Value *X, *M, *Y;
3578  auto m_VariableMask = m_CombineOr(
3580  m_Add(m_Shl(m_One(), m_Value()), m_AllOnes())),
3583  auto m_Mask = m_CombineOr(m_VariableMask, m_LowBitMask());
3584  if (!match(&I, m_c_ICmp(SrcPred,
3586  m_Deferred(X))))
3587  return nullptr;
3588 
3589  ICmpInst::Predicate DstPred;
3590  switch (SrcPred) {
3591  case ICmpInst::Predicate::ICMP_EQ:
3592  // x & (-1 >> y) == x -> x u<= (-1 >> y)
3593  DstPred = ICmpInst::Predicate::ICMP_ULE;
3594  break;
3595  case ICmpInst::Predicate::ICMP_NE:
3596  // x & (-1 >> y) != x -> x u> (-1 >> y)
3597  DstPred = ICmpInst::Predicate::ICMP_UGT;
3598  break;
3599  case ICmpInst::Predicate::ICMP_ULT:
3600  // x & (-1 >> y) u< x -> x u> (-1 >> y)
3601  // x u> x & (-1 >> y) -> x u> (-1 >> y)
3602  DstPred = ICmpInst::Predicate::ICMP_UGT;
3603  break;
3604  case ICmpInst::Predicate::ICMP_UGE:
3605  // x & (-1 >> y) u>= x -> x u<= (-1 >> y)
3606  // x u<= x & (-1 >> y) -> x u<= (-1 >> y)
3607  DstPred = ICmpInst::Predicate::ICMP_ULE;
3608  break;
3609  case ICmpInst::Predicate::ICMP_SLT:
3610  // x & (-1 >> y) s< x -> x s> (-1 >> y)
3611  // x s> x & (-1 >> y) -> x s> (-1 >> y)
3612  if (!match(M, m_Constant())) // Can not do this fold with non-constant.
3613  return nullptr;
3614  if (!match(M, m_NonNegative())) // Must not have any -1 vector elements.
3615  return nullptr;
3616  DstPred = ICmpInst::Predicate::ICMP_SGT;
3617  break;
3618  case ICmpInst::Predicate::ICMP_SGE:
3619  // x & (-1 >> y) s>= x -> x s<= (-1 >> y)
3620  // x s<= x & (-1 >> y) -> x s<= (-1 >> y)
3621  if (!match(M, m_Constant())) // Can not do this fold with non-constant.
3622  return nullptr;
3623  if (!match(M, m_NonNegative())) // Must not have any -1 vector elements.
3624  return nullptr;
3625  DstPred = ICmpInst::Predicate::ICMP_SLE;
3626  break;
3627  case ICmpInst::Predicate::ICMP_SGT:
3628  case ICmpInst::Predicate::ICMP_SLE:
3629  return nullptr;
3630  case ICmpInst::Predicate::ICMP_UGT:
3631  case ICmpInst::Predicate::ICMP_ULE:
3632  llvm_unreachable("Instsimplify took care of commut. variant");
3633  break;
3634  default:
3635  llvm_unreachable("All possible folds are handled.");
3636  }
3637 
3638  // The mask value may be a vector constant that has undefined elements. But it
3639  // may not be safe to propagate those undefs into the new compare, so replace
3640  // those elements by copying an existing, defined, and safe scalar constant.
3641  Type *OpTy = M->getType();
3642  auto *VecC = dyn_cast<Constant>(M);
3643  auto *OpVTy = dyn_cast<FixedVectorType>(OpTy);
3644  if (OpVTy && VecC && VecC->containsUndefOrPoisonElement()) {
3645  Constant *SafeReplacementConstant = nullptr;
3646  for (unsigned i = 0, e = OpVTy->getNumElements(); i != e; ++i) {
3647  if (!isa<UndefValue>(VecC->getAggregateElement(i))) {
3648  SafeReplacementConstant = VecC->getAggregateElement(i);
3649  break;
3650  }
3651  }
3652  assert(SafeReplacementConstant && "Failed to find undef replacement");
3653  M = Constant::replaceUndefsWith(VecC, SafeReplacementConstant);
3654  }
3655 
3656  return Builder.CreateICmp(DstPred, X, M);
3657 }
3658 
3659 /// Some comparisons can be simplified.
3660 /// In this case, we are looking for comparisons that look like
3661 /// a check for a lossy signed truncation.
3662 /// Folds: (MaskedBits is a constant.)
3663 /// ((%x << MaskedBits) a>> MaskedBits) SrcPred %x
3664 /// Into:
3665 /// (add %x, (1 << (KeptBits-1))) DstPred (1 << KeptBits)
3666 /// Where KeptBits = bitwidth(%x) - MaskedBits
3667 static Value *
3670  ICmpInst::Predicate SrcPred;
3671  Value *X;
3672  const APInt *C0, *C1; // FIXME: non-splats, potentially with undef.
3673  // We are ok with 'shl' having multiple uses, but 'ashr' must be one-use.
3674  if (!match(&I, m_c_ICmp(SrcPred,
3676  m_APInt(C1))),
3677  m_Deferred(X))))
3678  return nullptr;
3679 
3680  // Potential handling of non-splats: for each element:
3681  // * if both are undef, replace with constant 0.
3682  // Because (1<<0) is OK and is 1, and ((1<<0)>>1) is also OK and is 0.
3683  // * if both are not undef, and are different, bailout.
3684  // * else, only one is undef, then pick the non-undef one.
3685 
3686  // The shift amount must be equal.
3687  if (*C0 != *C1)
3688  return nullptr;
3689  const APInt &MaskedBits = *C0;
3690  assert(MaskedBits != 0 && "shift by zero should be folded away already.");
3691 
3692  ICmpInst::Predicate DstPred;
3693  switch (SrcPred) {
3694  case ICmpInst::Predicate::ICMP_EQ:
3695  // ((%x << MaskedBits) a>> MaskedBits) == %x
3696  // =>
3697  // (add %x, (1 << (KeptBits-1))) u< (1 << KeptBits)
3698  DstPred = ICmpInst::Predicate::ICMP_ULT;
3699  break;
3700  case ICmpInst::Predicate::ICMP_NE:
3701  // ((%x << MaskedBits) a>> MaskedBits) != %x
3702  // =>
3703  // (add %x, (1 << (KeptBits-1))) u>= (1 << KeptBits)
3704  DstPred = ICmpInst::Predicate::ICMP_UGE;
3705  break;
3706  // FIXME: are more folds possible?
3707  default:
3708  return nullptr;
3709  }
3710 
3711  auto *XType = X->getType();
3712  const unsigned XBitWidth = XType->getScalarSizeInBits();
3713  const APInt BitWidth = APInt(XBitWidth, XBitWidth);
3714  assert(BitWidth.ugt(MaskedBits) && "shifts should leave some bits untouched");
3715 
3716  // KeptBits = bitwidth(%x) - MaskedBits
3717  const APInt KeptBits = BitWidth - MaskedBits;
3718  assert(KeptBits.ugt(0) && KeptBits.ult(BitWidth) && "unreachable");
3719  // ICmpCst = (1 << KeptBits)
3720  const APInt ICmpCst = APInt(XBitWidth, 1).shl(KeptBits);
3721  assert(ICmpCst.isPowerOf2());
3722  // AddCst = (1 << (KeptBits-1))
3723  const APInt AddCst = ICmpCst.lshr(1);
3724  assert(AddCst.ult(ICmpCst) && AddCst.isPowerOf2());
3725 
3726  // T0 = add %x, AddCst
3727  Value *T0 = Builder.CreateAdd(X, ConstantInt::get(XType, AddCst));
3728  // T1 = T0 DstPred ICmpCst
3729  Value *T1 = Builder.CreateICmp(DstPred, T0, ConstantInt::get(XType, ICmpCst));
3730 
3731  return T1;
3732 }
3733 
3734 // Given pattern:
3735 // icmp eq/ne (and ((x shift Q), (y oppositeshift K))), 0
3736 // we should move shifts to the same hand of 'and', i.e. rewrite as
3737 // icmp eq/ne (and (x shift (Q+K)), y), 0 iff (Q+K) u< bitwidth(x)
3738 // We are only interested in opposite logical shifts here.
3739 // One of the shifts can be truncated.
3740 // If we can, we want to end up creating 'lshr' shift.
3741 static Value *
3744  if (!I.isEquality() || !match(I.getOperand(1), m_Zero()) ||
3745  !I.getOperand(0)->hasOneUse())
3746  return nullptr;
3747 
3748  auto m_AnyLogicalShift = m_LogicalShift(m_Value(), m_Value());
3749 
3750  // Look for an 'and' of two logical shifts, one of which may be truncated.
3751  // We use m_TruncOrSelf() on the RHS to correctly handle commutative case.
3752  Instruction *XShift, *MaybeTruncation, *YShift;
3753  if (!match(
3754  I.getOperand(0),
3755  m_c_And(m_CombineAnd(m_AnyLogicalShift, m_Instruction(XShift)),
3757  m_AnyLogicalShift, m_Instruction(YShift))),
3758  m_Instruction(MaybeTruncation)))))
3759  return nullptr;
3760 
3761  // We potentially looked past 'trunc', but only when matching YShift,
3762  // therefore YShift must have the widest type.
3763  Instruction *WidestShift = YShift;
3764  // Therefore XShift must have the shallowest type.
3765  // Or they both have identical types if there was no truncation.
3766  Instruction *NarrowestShift = XShift;
3767 
3768  Type *WidestTy = WidestShift->getType();
3769  Type *NarrowestTy = NarrowestShift->getType();
3770  assert(NarrowestTy == I.getOperand(0)->getType() &&
3771  "We did not look past any shifts while matching XShift though.");
3772  bool HadTrunc = WidestTy != I.getOperand(0)->getType();
3773 
3774  // If YShift is a 'lshr', swap the shifts around.
3775  if (match(YShift, m_LShr(m_Value(), m_Value())))
3776  std::swap(XShift, YShift);
3777 
3778  // The shifts must be in opposite directions.
3779  auto XShiftOpcode = XShift->getOpcode();
3780  if (XShiftOpcode == YShift->getOpcode())
3781  return nullptr; // Do not care about same-direction shifts here.
3782 
3783  Value *X, *XShAmt, *Y, *YShAmt;
3784  match(XShift, m_BinOp(m_Value(X), m_ZExtOrSelf(m_Value(XShAmt))));
3785  match(YShift, m_BinOp(m_Value(Y), m_ZExtOrSelf(m_Value(YShAmt))));
3786 
3787  // If one of the values being shifted is a constant, then we will end with
3788  // and+icmp, and [zext+]shift instrs will be constant-folded. If they are not,
3789  // however, we will need to ensure that we won't increase instruction count.
3790  if (!isa<Constant>(X) && !isa<Constant>(Y)) {
3791  // At least one of the hands of the 'and' should be one-use shift.
3792  if (!match(I.getOperand(0),
3793  m_c_And(m_OneUse(m_AnyLogicalShift), m_Value())))
3794  return nullptr;
3795  if (HadTrunc) {
3796  // Due to the 'trunc', we will need to widen X. For that either the old
3797  // 'trunc' or the shift amt in the non-truncated shift should be one-use.
3798  if (!MaybeTruncation->hasOneUse() &&
3799  !NarrowestShift->getOperand(1)->hasOneUse())
3800  return nullptr;
3801  }
3802  }
3803 
3804  // We have two shift amounts from two different shifts. The types of those
3805  // shift amounts may not match. If that's the case let's bailout now.
3806  if (XShAmt->getType() != YShAmt->getType())
3807  return nullptr;
3808 
3809  // As input, we have the following pattern:
3810  // icmp eq/ne (and ((x shift Q), (y oppositeshift K))), 0
3811  // We want to rewrite that as:
3812  // icmp eq/ne (and (x shift (Q+K)), y), 0 iff (Q+K) u< bitwidth(x)
3813  // While we know that originally (Q+K) would not overflow
3814  // (because 2 * (N-1) u<= iN -1), we have looked past extensions of
3815  // shift amounts. so it may now overflow in smaller bitwidth.
3816  // To ensure that does not happen, we need to ensure that the total maximal
3817  // shift amount is still representable in that smaller bit width.
3818  unsigned MaximalPossibleTotalShiftAmount =
3819  (WidestTy->getScalarSizeInBits() - 1) +
3820  (NarrowestTy->getScalarSizeInBits() - 1);
3821  APInt MaximalRepresentableShiftAmount =
3823  if (MaximalRepresentableShiftAmount.ult(MaximalPossibleTotalShiftAmount))
3824  return nullptr;
3825 
3826  // Can we fold (XShAmt+YShAmt) ?
3827  auto *NewShAmt = dyn_cast_or_null<Constant>(
3828  simplifyAddInst(XShAmt, YShAmt, /*isNSW=*/false,
3829  /*isNUW=*/false, SQ.getWithInstruction(&I)));
3830  if (!NewShAmt)
3831  return nullptr;
3832  NewShAmt = ConstantExpr::getZExtOrBitCast(NewShAmt, WidestTy);
3833  unsigned WidestBitWidth = WidestTy->getScalarSizeInBits();
3834 
3835  // Is the new shift amount smaller than the bit width?
3836  // FIXME: could also rely on ConstantRange.
3837  if (!match(NewShAmt,
3838  m_SpecificInt_ICMP(ICmpInst::Predicate::ICMP_ULT,
3839  APInt(WidestBitWidth, WidestBitWidth))))
3840  return nullptr;
3841 
3842  // An extra legality check is needed if we had trunc-of-lshr.
3843  if (HadTrunc && match(WidestShift, m_LShr(m_Value(), m_Value()))) {
3844  auto CanFold = [NewShAmt, WidestBitWidth, NarrowestShift, SQ,
3845  WidestShift]() {
3846  // It isn't obvious whether it's worth it to analyze non-constants here.
3847  // Also, let's basically give up on non-splat cases, pessimizing vectors.
3848  // If *any* of these preconditions matches we can perform the fold.
3849  Constant *NewShAmtSplat = NewShAmt->getType()->isVectorTy()
3850  ? NewShAmt->getSplatValue()
3851  : NewShAmt;
3852  // If it's edge-case shift (by 0 or by WidestBitWidth-1) we can fold.
3853  if (NewShAmtSplat &&
3854  (NewShAmtSplat->isNullValue() ||
3855  NewShAmtSplat->getUniqueInteger() == WidestBitWidth - 1))
3856  return true;
3857  // We consider *min* leading zeros so a single outlier
3858  // blocks the transform as opposed to allowing it.
3859  if (auto *C = dyn_cast<Constant>(NarrowestShift->getOperand(0))) {
3860  KnownBits Known = computeKnownBits(C, SQ.DL);
3861  unsigned MinLeadZero = Known.countMinLeadingZeros();
3862  // If the value being shifted has at most lowest bit set we can fold.
3863  unsigned MaxActiveBits = Known.getBitWidth() - MinLeadZero;
3864  if (MaxActiveBits <= 1)
3865  return true;
3866  // Precondition: NewShAmt u<= countLeadingZeros(C)
3867  if (NewShAmtSplat && NewShAmtSplat->getUniqueInteger().ule(MinLeadZero))
3868  return true;
3869  }
3870  if (auto *C = dyn_cast<Constant>(WidestShift->getOperand(0))) {
3871  KnownBits Known = computeKnownBits(C, SQ.DL);
3872  unsigned MinLeadZero = Known.countMinLeadingZeros();
3873  // If the value being shifted has at most lowest bit set we can fold.
3874  unsigned MaxActiveBits = Known.getBitWidth() - MinLeadZero;
3875  if (MaxActiveBits <= 1)
3876  return true;
3877  // Precondition: ((WidestBitWidth-1)-NewShAmt) u<= countLeadingZeros(C)
3878  if (NewShAmtSplat) {
3879  APInt AdjNewShAmt =
3880  (WidestBitWidth - 1) - NewShAmtSplat->getUniqueInteger();
3881  if (AdjNewShAmt.ule(MinLeadZero))
3882  return true;
3883  }
3884  }
3885  return false; // Can't tell if it's ok.
3886  };
3887  if (!CanFold())
3888  return nullptr;
3889  }
3890 
3891  // All good, we can do this fold.
3892  X = Builder.CreateZExt(X, WidestTy);
3893  Y = Builder.CreateZExt(Y, WidestTy);
3894  // The shift is the same that was for X.
3895  Value *T0 = XShiftOpcode == Instruction::BinaryOps::LShr
3896  ? Builder.CreateLShr(X, NewShAmt)
3897  : Builder.CreateShl(X, NewShAmt);
3898  Value *T1 = Builder.CreateAnd(T0, Y);
3899  return Builder.CreateICmp(I.getPredicate(), T1,
3900  Constant::getNullValue(WidestTy));
3901 }
3902 
3903 /// Fold
3904 /// (-1 u/ x) u< y
3905 /// ((x * y) ?/ x) != y
3906 /// to
3907 /// @llvm.?mul.with.overflow(x, y) plus extraction of overflow bit
3908 /// Note that the comparison is commutative, while inverted (u>=, ==) predicate
3909 /// will mean that we are looking for the opposite answer.
3911  ICmpInst::Predicate Pred;
3912  Value *X, *Y;
3913  Instruction *Mul;
3914  Instruction *Div;
3915  bool NeedNegation;
3916  // Look for: (-1 u/ x) u</u>= y
3917  if (!I.isEquality() &&
3918  match(&I, m_c_ICmp(Pred,
3920  m_Instruction(Div)),
3921  m_Value(Y)))) {
3922  Mul = nullptr;
3923 
3924  // Are we checking that overflow does not happen, or does happen?
3925  switch (Pred) {
3926  case ICmpInst::Predicate::ICMP_ULT:
3927  NeedNegation = false;
3928  break; // OK
3929  case ICmpInst::Predicate::ICMP_UGE:
3930  NeedNegation = true;
3931  break; // OK
3932  default:
3933  return nullptr; // Wrong predicate.
3934  }
3935  } else // Look for: ((x * y) / x) !=/== y
3936  if (I.isEquality() &&
3937  match(&I,
3938  m_c_ICmp(Pred, m_Value(Y),
3939  m_CombineAnd(
3941  m_Value(X)),
3942  m_Instruction(Mul)),
3943  m_Deferred(X))),
3944  m_Instruction(Div))))) {
3945  NeedNegation = Pred == ICmpInst::Predicate::ICMP_EQ;
3946  } else
3947  return nullptr;
3948 
3950  // If the pattern included (x * y), we'll want to insert new instructions
3951  // right before that original multiplication so that we can replace it.
3952  bool MulHadOtherUses = Mul && !Mul->hasOneUse();
3953  if (MulHadOtherUses)
3954  Builder.SetInsertPoint(Mul);
3955 
3956  Function *F = Intrinsic::getDeclaration(I.getModule(),
3957  Div->getOpcode() == Instruction::UDiv
3958  ? Intrinsic::umul_with_overflow
3959  : Intrinsic::smul_with_overflow,
3960  X->getType());
3961  CallInst *Call = Builder.CreateCall(F, {X, Y}, "mul");
3962 
3963  // If the multiplication was used elsewhere, to ensure that we don't leave
3964  // "duplicate" instructions, replace uses of that original multiplication
3965  // with the multiplication result from the with.overflow intrinsic.
3966  if (MulHadOtherUses)
3967  replaceInstUsesWith(*Mul, Builder.CreateExtractValue(Call, 0, "mul.val"));
3968 
3969  Value *Res = Builder.CreateExtractValue(Call, 1, "mul.ov");
3970  if (NeedNegation) // This technically increases instruction count.
3971  Res = Builder.CreateNot(Res, "mul.not.ov");
3972 
3973  // If we replaced the mul, erase it. Do this after all uses of Builder,
3974  // as the mul is used as insertion point.
3975  if (MulHadOtherUses)
3976  eraseInstFromFunction(*Mul);
3977 
3978  return Res;
3979 }
3980 
3982  CmpInst::Predicate Pred;
3983  Value *X;
3984  if (!match(&I, m_c_ICmp(Pred, m_NSWNeg(m_Value(X)), m_Deferred(X))))
3985  return nullptr;
3986 
3987  if (ICmpInst::isSigned(Pred))
3988  Pred = ICmpInst::getSwappedPredicate(Pred);
3989  else if (ICmpInst::isUnsigned(Pred))
3990  Pred = ICmpInst::getSignedPredicate(Pred);
3991  // else for equality-comparisons just keep the predicate.
3992 
3993  return ICmpInst::Create(Instruction::ICmp, Pred, X,
3994  Constant::getNullValue(X->getType()), I.getName());
3995 }
3996 
3997 /// Try to fold icmp (binop), X or icmp X, (binop).
3998 /// TODO: A large part of this logic is duplicated in InstSimplify's
3999 /// simplifyICmpWithBinOp(). We should be able to share that and avoid the code
4000 /// duplication.
4002  const SimplifyQuery &SQ) {
4003  const SimplifyQuery Q = SQ.getWithInstruction(&I);
4004  Value *Op0 = I.getOperand(0), *Op1 = I.getOperand(1);
4005 
4006  // Special logic for binary operators.
4007  BinaryOperator *BO0 = dyn_cast<BinaryOperator>(Op0);
4008  BinaryOperator *BO1 = dyn_cast<BinaryOperator>(Op1);
4009  if (!BO0 && !BO1)
4010  return nullptr;
4011 
4012  if (Instruction *NewICmp = foldICmpXNegX(I))
4013  return NewICmp;
4014 
4015  const CmpInst::Predicate Pred = I.getPredicate();
4016  Value *X;
4017 
4018  // Convert add-with-unsigned-overflow comparisons into a 'not' with compare.
4019  // (Op1 + X) u</u>= Op1 --> ~Op1 u</u>= X
4020  if (match(Op0, m_OneUse(m_c_Add(m_Specific(Op1), m_Value(X)))) &&
4021  (Pred == ICmpInst::ICMP_ULT || Pred == ICmpInst::ICMP_UGE))
4022  return new ICmpInst(Pred, Builder.CreateNot(Op1), X);
4023  // Op0 u>/u<= (Op0 + X) --> X u>/u<= ~Op0
4024  if (match(Op1, m_OneUse(m_c_Add(m_Specific(Op0), m_Value(X)))) &&
4025  (Pred == ICmpInst::ICMP_UGT || Pred == ICmpInst::ICMP_ULE))
4026  return new ICmpInst(Pred, X, Builder.CreateNot(Op0));
4027 
4028  {
4029  // (Op1 + X) + C u</u>= Op1 --> ~C - X u</u>= Op1
4030  Constant *C;
4031  if (match(Op0, m_OneUse(m_Add(m_c_Add(m_Specific(Op1), m_Value(X)),
4032  m_ImmConstant(C)))) &&
4033  (Pred == ICmpInst::ICMP_ULT || Pred == ICmpInst::ICMP_UGE)) {
4035  return new ICmpInst(Pred, Builder.CreateSub(C2, X), Op1);
4036  }
4037  // Op0 u>/u<= (Op0 + X) + C --> Op0 u>/u<= ~C - X
4038  if (match(Op1, m_OneUse(m_Add(m_c_Add(m_Specific(Op0), m_Value(X)),
4039  m_ImmConstant(C)))) &&
4040  (Pred == ICmpInst::ICMP_UGT || Pred == ICmpInst::ICMP_ULE)) {
4042  return new ICmpInst(Pred, Op0, Builder.CreateSub(C2, X));
4043  }
4044  }
4045 
4046  {
4047  // Similar to above: an unsigned overflow comparison may use offset + mask:
4048  // ((Op1 + C) & C) u< Op1 --> Op1 != 0
4049  // ((Op1 + C) & C) u>= Op1 --> Op1 == 0
4050  // Op0 u> ((Op0 + C) & C) --> Op0 != 0
4051  // Op0 u<= ((Op0 + C) & C) --> Op0 == 0
4052  BinaryOperator *BO;
4053  const APInt *C;
4054  if ((Pred == ICmpInst::ICMP_ULT || Pred == ICmpInst::ICMP_UGE) &&
4055  match(Op0, m_And(m_BinOp(BO), m_LowBitMask(C))) &&
4057  CmpInst::Predicate NewPred =
4059  Constant *Zero = ConstantInt::getNullValue(Op1->getType());
4060  return new ICmpInst(NewPred, Op1, Zero);
4061  }
4062 
4063  if ((Pred == ICmpInst::ICMP_UGT || Pred == ICmpInst::ICMP_ULE) &&
4064  match(Op1, m_And(m_BinOp(BO), m_LowBitMask(C))) &&
4066  CmpInst::Predicate NewPred =
4068  Constant *Zero = ConstantInt::getNullValue(Op1->getType());
4069  return new ICmpInst(NewPred, Op0, Zero);
4070  }
4071  }
4072 
4073  bool NoOp0WrapProblem = false, NoOp1WrapProblem = false;
4074  if (BO0 && isa<OverflowingBinaryOperator>(BO0))
4075  NoOp0WrapProblem =
4076  ICmpInst::isEquality(Pred) ||
4077  (CmpInst::isUnsigned(Pred) && BO0->hasNoUnsignedWrap()) ||
4078  (CmpInst::isSigned(Pred) && BO0->hasNoSignedWrap());
4079  if (BO1 && isa<OverflowingBinaryOperator>(BO1))
4080  NoOp1WrapProblem =
4081  ICmpInst::isEquality(Pred) ||
4082  (CmpInst::isUnsigned(Pred) && BO1->hasNoUnsignedWrap()) ||
4083  (CmpInst::isSigned(Pred) && BO1->hasNoSignedWrap());
4084 
4085  // Analyze the case when either Op0 or Op1 is an add instruction.
4086  // Op0 = A + B (or A and B are null); Op1 = C + D (or C and D are null).
4087  Value *A = nullptr, *B = nullptr, *C = nullptr, *D = nullptr;
4088  if (BO0 && BO0->getOpcode() == Instruction::Add) {
4089  A = BO0->getOperand(0);
4090  B = BO0->getOperand(1);
4091  }
4092  if (BO1 && BO1->getOpcode() == Instruction::Add) {
4093  C = BO1->getOperand(0);
4094  D = BO1->getOperand(1);
4095  }
4096 
4097  // icmp (A+B), A -> icmp B, 0 for equalities or if there is no overflow.
4098  // icmp (A+B), B -> icmp A, 0 for equalities or if there is no overflow.
4099  if ((A == Op1 || B == Op1) && NoOp0WrapProblem)
4100  return new ICmpInst(Pred, A == Op1 ? B : A,
4101  Constant::getNullValue(Op1->getType()));
4102 
4103  // icmp C, (C+D) -> icmp 0, D for equalities or if there is no overflow.
4104  // icmp D, (C+D) -> icmp 0, C for equalities or if there is no overflow.
4105  if ((C == Op0 || D == Op0) && NoOp1WrapProblem)
4106  return new ICmpInst(Pred, Constant::getNullValue(Op0->getType()),
4107  C == Op0 ? D : C);
4108 
4109  // icmp (A+B), (A+D) -> icmp B, D for equalities or if there is no overflow.
4110  if (A && C && (A == C || A == D || B == C || B == D) && NoOp0WrapProblem &&
4111  NoOp1WrapProblem) {
4112  // Determine Y and Z in the form icmp (X+Y), (X+Z).
4113  Value *Y, *Z;
4114  if (A == C) {
4115  // C + B == C + D -> B == D
4116  Y = B;
4117  Z = D;
4118  } else if (A == D) {
4119  // D + B == C + D -> B == C
4120  Y = B;
4121  Z = C;
4122  } else if (B == C) {
4123  // A + C == C + D -> A == D
4124  Y = A;
4125  Z = D;
4126  } else {
4127  assert(B == D);
4128  // A + D == C + D -> A == C
4129  Y = A;
4130  Z = C;
4131  }
4132  return new ICmpInst(Pred, Y, Z);
4133  }
4134 
4135  // icmp slt (A + -1), Op1 -> icmp sle A, Op1
4136  if (A && NoOp0WrapProblem && Pred == CmpInst::ICMP_SLT &&
4137  match(B, m_AllOnes()))
4138  return new ICmpInst(CmpInst::ICMP_SLE, A, Op1);
4139 
4140  // icmp sge (A + -1), Op1 -> icmp sgt A, Op1
4141  if (A && NoOp0WrapProblem && Pred == CmpInst::ICMP_SGE &&
4142  match(B, m_AllOnes()))
4143  return new ICmpInst(CmpInst::ICMP_SGT, A, Op1);
4144 
4145  // icmp sle (A + 1), Op1 -> icmp slt A, Op1
4146  if (A && NoOp0WrapProblem && Pred == CmpInst::ICMP_SLE && match(B, m_One()))
4147  return new ICmpInst(CmpInst::ICMP_SLT, A, Op1);
4148 
4149  // icmp sgt (A + 1), Op1 -> icmp sge A, Op1
4150  if (A && NoOp0WrapProblem && Pred == CmpInst::ICMP_SGT && match(B, m_One()))
4151  return new ICmpInst(CmpInst::ICMP_SGE, A, Op1);
4152 
4153  // icmp sgt Op0, (C + -1) -> icmp sge Op0, C
4154  if (C && NoOp1WrapProblem && Pred == CmpInst::ICMP_SGT &&
4155  match(D, m_AllOnes()))
4156  return new ICmpInst(CmpInst::ICMP_SGE, Op0, C);
4157 
4158  // icmp sle Op0, (C + -1) -> icmp slt Op0, C
4159  if (C && NoOp1WrapProblem && Pred == CmpInst::ICMP_SLE &&
4160  match(D, m_AllOnes()))
4161  return new ICmpInst(CmpInst::ICMP_SLT, Op0, C);
4162 
4163  // icmp sge Op0, (C + 1) -> icmp sgt Op0, C
4164  if (C && NoOp1WrapProblem && Pred == CmpInst::ICMP_SGE && match(D, m_One()))
4165  return new ICmpInst(CmpInst::ICMP_SGT, Op0, C);
4166 
4167  // icmp slt Op0, (C + 1) -> icmp sle Op0, C
4168  if (C && NoOp1WrapProblem && Pred == CmpInst::ICMP_SLT && match(D, m_One()))
4169  return new ICmpInst(CmpInst::ICMP_SLE, Op0, C);
4170 
4171  // TODO: The subtraction-related identities shown below also hold, but
4172  // canonicalization from (X -nuw 1) to (X + -1) means that the combinations
4173  // wouldn't happen even if they were implemented.
4174  //
4175  // icmp ult (A - 1), Op1 -> icmp ule A, Op1
4176  // icmp uge (A - 1), Op1 -> icmp ugt A, Op1
4177  // icmp ugt Op0, (C - 1) -> icmp uge Op0, C
4178  // icmp ule Op0, (C - 1) -> icmp ult Op0, C
4179 
4180  // icmp ule (A + 1), Op0 -> icmp ult A, Op1
4181  if (A && NoOp0WrapProblem && Pred == CmpInst::ICMP_ULE && match(B, m_One()))
4182  return new ICmpInst(CmpInst::ICMP_ULT, A, Op1);
4183 
4184  // icmp ugt (A + 1), Op0 -> icmp uge A, Op1
4185  if (A && NoOp0WrapProblem && Pred == CmpInst::ICMP_UGT && match(B, m_One()))
4186  return new ICmpInst(CmpInst::ICMP_UGE, A, Op1);
4187 
4188  // icmp uge Op0, (C + 1) -> icmp ugt Op0, C
4189  if (C && NoOp1WrapProblem && Pred == CmpInst::ICMP_UGE && match(D, m_One()))
4190  return new ICmpInst(CmpInst::ICMP_UGT, Op0, C);
4191 
4192  // icmp ult Op0, (C + 1) -> icmp ule Op0, C
4193  if (C && NoOp1WrapProblem && Pred == CmpInst::ICMP_ULT && match(D, m_One()))
4194  return new ICmpInst(CmpInst::ICMP_ULE, Op0, C);
4195 
4196  // if C1 has greater magnitude than C2:
4197  // icmp (A + C1), (C + C2) -> icmp (A + C3), C
4198  // s.t. C3 = C1 - C2
4199  //
4200  // if C2 has greater magnitude than C1:
4201  // icmp (A + C1), (C + C2) -> icmp A, (C + C3)
4202  // s.t. C3 = C2 - C1
4203  if (A && C && NoOp0WrapProblem && NoOp1WrapProblem &&
4204  (BO0->hasOneUse() || BO1->hasOneUse()) && !I.isUnsigned()) {
4205  const APInt *AP1, *AP2;
4206  // TODO: Support non-uniform vectors.
4207  // TODO: Allow undef passthrough if B AND D's element is undef.
4208  if (match(B, m_APIntAllowUndef(AP1)) && match(D, m_APIntAllowUndef(AP2)) &&
4209  AP1->isNegative() == AP2->isNegative()) {
4210  APInt AP1Abs = AP1->abs();
4211  APInt AP2Abs = AP2->abs();
4212  if (AP1Abs.uge(AP2Abs)) {
4213  APInt Diff = *AP1 - *AP2;
4214  bool HasNUW = BO0->hasNoUnsignedWrap() && Diff.ule(*AP1);
4215  bool HasNSW = BO0->hasNoSignedWrap();
4216  Constant *C3 = Constant::getIntegerValue(BO0->getType(), Diff);
4217  Value *NewAdd = Builder.CreateAdd(A, C3, "", HasNUW, HasNSW);
4218  return new ICmpInst(Pred, NewAdd, C);
4219  } else {
4220  APInt Diff = *AP2 - *AP1;
4221  bool HasNUW = BO1->hasNoUnsignedWrap() && Diff.ule(*AP2);
4222  bool HasNSW = BO1->hasNoSignedWrap();
4223  Constant *C3 = Constant::getIntegerValue(BO0->getType(), Diff);
4224  Value *NewAdd = Builder.CreateAdd(C, C3, "", HasNUW, HasNSW);
4225  return new ICmpInst(Pred, A, NewAdd);
4226  }
4227  }
4228  Constant *Cst1, *Cst2;
4229  if (match(B, m_ImmConstant(Cst1)) && match(D, m_ImmConstant(Cst2)) &&
4230  ICmpInst::isEquality(Pred)) {
4231  Constant *Diff = ConstantExpr::getSub(Cst2, Cst1);
4232  Value *NewAdd = Builder.CreateAdd(C, Diff);
4233  return new ICmpInst(Pred, A, NewAdd);
4234  }
4235  }
4236 
4237  // Analyze the case when either Op0 or Op1 is a sub instruction.
4238  // Op0 = A - B (or A and B are null); Op1 = C - D (or C and D are null).
4239  A = nullptr;
4240  B = nullptr;
4241  C = nullptr;
4242  D = nullptr;
4243  if (BO0 && BO0->getOpcode() == Instruction::Sub) {
4244  A = BO0->getOperand(0);
4245  B = BO0->getOperand(1);
4246  }
4247  if (BO1 && BO1->getOpcode() == Instruction::Sub) {
4248  C = BO1->getOperand(0);
4249  D = BO1->getOperand(1);
4250  }
4251 
4252  // icmp (A-B), A -> icmp 0, B for equalities or if there is no overflow.
4253  if (A == Op1 && NoOp0WrapProblem)
4254  return new ICmpInst(Pred, Constant::getNullValue(Op1->getType()), B);
4255  // icmp C, (C-D) -> icmp D, 0 for equalities or if there is no overflow.
4256  if (C == Op0 && NoOp1WrapProblem)
4257  return new ICmpInst(Pred, D, Constant::getNullValue(Op0->getType()));
4258 
4259  // Convert sub-with-unsigned-overflow comparisons into a comparison of args.
4260  // (A - B) u>/u<= A --> B u>/u<= A
4261  if (A == Op1 && (Pred == ICmpInst::ICMP_UGT || Pred == ICmpInst::ICMP_ULE))
4262  return new ICmpInst(Pred, B, A);
4263  // C u</u>= (C - D) --> C u</u>= D
4264  if (C == Op0 && (Pred == ICmpInst::ICMP_ULT || Pred == ICmpInst::ICMP_UGE))
4265  return new ICmpInst(Pred, C, D);
4266  // (A - B) u>=/u< A --> B u>/u<= A iff B != 0
4267  if (A == Op1 && (Pred == ICmpInst::ICMP_UGE || Pred == ICmpInst::ICMP_ULT) &&
4268  isKnownNonZero(B, Q.DL, /*Depth=*/0, Q.AC, Q.CxtI, Q.DT))
4269  return new ICmpInst(CmpInst::getFlippedStrictnessPredicate(Pred), B, A);
4270  // C u<=/u> (C - D) --> C u</u>= D iff B != 0
4271  if (C == Op0 && (Pred == ICmpInst::ICMP_ULE || Pred == ICmpInst::ICMP_UGT) &&
4272  isKnownNonZero(D, Q.DL, /*Depth=*/0, Q.AC, Q.CxtI, Q.DT))
4273  return new ICmpInst(CmpInst::getFlippedStrictnessPredicate(Pred), C, D);
4274 
4275  // icmp (A-B), (C-B) -> icmp A, C for equalities or if there is no overflow.
4276  if (B && D && B == D && NoOp0WrapProblem && NoOp1WrapProblem)
4277  return new ICmpInst(Pred, A, C);
4278 
4279  // icmp (A-B), (A-D) -> icmp D, B for equalities or if there is no overflow.
4280  if (A && C && A == C && NoOp0WrapProblem && NoOp1WrapProblem)
4281  return new ICmpInst(Pred, D, B);
4282 
4283  // icmp (0-X) < cst --> x > -cst
4284  if (NoOp0WrapProblem && ICmpInst::isSigned(Pred)) {
4285  Value *X;
4286  if (match(BO0, m_Neg(m_Value(X))))
4287  if (Constant *RHSC = dyn_cast<Constant>(Op1))
4288  if (RHSC->isNotMinSignedValue())
4289  return new ICmpInst(I.getSwappedPredicate(), X,
4290  ConstantExpr::getNeg(RHSC));
4291  }
4292 
4293  {
4294  // Try to remove shared constant multiplier from equality comparison:
4295  // X * C == Y * C (with no overflowing/aliasing) --> X == Y
4296  Value *X, *Y;
4297  const APInt *C;
4298  if (match(Op0, m_Mul(m_Value(X), m_APInt(C))) && *C != 0 &&
4299  match(Op1, m_Mul(m_Value(Y), m_SpecificInt(*C))) && I.isEquality())
4300  if (!C->countTrailingZeros() ||
4301  (BO0 && BO1 && BO0->hasNoSignedWrap() && BO1->hasNoSignedWrap()) ||
4302  (BO0 && BO1 && BO0->hasNoUnsignedWrap() && BO1->hasNoUnsignedWrap()))
4303  return new ICmpInst(Pred, X, Y);
4304  }
4305 
4306  BinaryOperator *SRem = nullptr;
4307  // icmp (srem X, Y), Y
4308  if (BO0 && BO0->getOpcode() == Instruction::SRem && Op1 == BO0->getOperand(1))
4309  SRem = BO0;
4310  // icmp Y, (srem X, Y)
4311  else if (BO1 && BO1->getOpcode() == Instruction::SRem &&
4312  Op0 == BO1->getOperand(1))
4313  SRem = BO1;
4314  if (SRem) {
4315  // We don't check hasOneUse to avoid increasing register pressure because
4316  // the value we use is the same value this instruction was already using.
4317  switch (SRem == BO0 ? ICmpInst::getSwappedPredicate(Pred) : Pred) {
4318  default:
4319  break;
4320  case ICmpInst::ICMP_EQ:
4321  return replaceInstUsesWith(I, ConstantInt::getFalse(I.getType()));
4322  case ICmpInst::ICMP_NE:
4323  return replaceInstUsesWith(I, ConstantInt::getTrue(I.getType()));
4324  case ICmpInst::ICMP_SGT:
4325  case ICmpInst::ICMP_SGE:
4326  return new ICmpInst(ICmpInst::ICMP_SGT, SRem->getOperand(1),
4328  case ICmpInst::ICMP_SLT:
4329  case ICmpInst::ICMP_SLE:
4330  return new ICmpInst(ICmpInst::ICMP_SLT, SRem->getOperand(1),
4331  Constant::getNullValue(SRem->getType()));
4332  }
4333  }
4334 
4335  if (BO0 && BO1 && BO0->getOpcode() == BO1->getOpcode() && BO0->hasOneUse() &&
4336  BO1->hasOneUse() && BO0->getOperand(1) == BO1->getOperand(1)) {
4337  switch (BO0->getOpcode()) {
4338  default:
4339  break;
4340  case Instruction::Add:
4341  case Instruction::Sub:
4342  case Instruction::Xor: {
4343  if (I.isEquality()) // a+x icmp eq/ne b+x --> a icmp b
4344  return new ICmpInst(Pred, BO0->getOperand(0), BO1->getOperand(0));
4345 
4346  const APInt *C;
4347  if (match(BO0->getOperand(1), m_APInt(C))) {
4348  // icmp u/s (a ^ signmask), (b ^ signmask) --> icmp s/u a, b
4349  if (C->isSignMask()) {
4350  ICmpInst::Predicate NewPred = I.getFlippedSignednessPredicate();
4351  return new ICmpInst(NewPred, BO0->getOperand(0), BO1->getOperand(0));
4352  }
4353 
4354  // icmp u/s (a ^ maxsignval), (b ^ maxsignval) --> icmp s/u' a, b
4355  if (BO0->getOpcode() == Instruction::Xor && C->isMaxSignedValue()) {
4356  ICmpInst::Predicate NewPred = I.getFlippedSignednessPredicate();
4357  NewPred = I.getSwappedPredicate(NewPred);
4358  return new ICmpInst(NewPred, BO0->getOperand(0), BO1->getOperand(0));
4359  }
4360  }
4361  break;
4362  }
4363  case Instruction::Mul: {
4364  if (!I.isEquality())
4365  break;
4366 
4367  const APInt *C;
4368  if (match(BO0->getOperand(1), m_APInt(C)) && !C->isZero() &&
4369  !C->isOne()) {
4370  // icmp eq/ne (X * C), (Y * C) --> icmp (X & Mask), (Y & Mask)
4371  // Mask = -1 >> count-trailing-zeros(C).
4372  if (unsigned TZs = C->countTrailingZeros()) {
4374  BO0->getType(),
4375  APInt::getLowBitsSet(C->getBitWidth(), C->getBitWidth() - TZs));
4376  Value *And1 = Builder.CreateAnd(BO0->getOperand(0), Mask);
4377  Value *And2 = Builder.CreateAnd(BO1->getOperand(0), Mask);
4378  return new ICmpInst(Pred, And1, And2);
4379  }
4380  }
4381  break;
4382  }
4383  case Instruction::UDiv:
4384  case Instruction::LShr:
4385  if (I.isSigned() || !BO0->isExact() || !BO1->isExact())
4386  break;
4387  return new ICmpInst(Pred, BO0->getOperand(0), BO1->getOperand(0));
4388 
4389  case Instruction::SDiv:
4390  if (!I.isEquality() || !BO0->isExact() || !BO1->isExact())
4391  break;
4392  return new ICmpInst(Pred, BO0->getOperand(0), BO1->getOperand(0));
4393 
4394  case Instruction::AShr:
4395  if (!BO0->isExact() || !BO1->isExact())
4396  break;
4397  return new ICmpInst(Pred, BO0->getOperand(0), BO1->getOperand(0));
4398 
4399  case Instruction::Shl: {
4400  bool NUW = BO0->hasNoUnsignedWrap() && BO1->hasNoUnsignedWrap();
4401  bool NSW = BO0->hasNoSignedWrap() && BO1->hasNoSignedWrap();
4402  if (!NUW && !NSW)
4403  break;
4404  if (!NSW && I.isSigned())
4405  break;
4406  return new ICmpInst(Pred, BO0->getOperand(0), BO1->getOperand(0));
4407  }
4408  }
4409  }
4410 
4411  if (BO0) {
4412  // Transform A & (L - 1) `ult` L --> L != 0
4413  auto LSubOne = m_Add(m_Specific(Op1), m_AllOnes());
4414  auto BitwiseAnd = m_c_And(m_Value(), LSubOne);
4415 
4416  if (match(BO0, BitwiseAnd) && Pred == ICmpInst::ICMP_ULT) {
4417  auto *Zero = Constant::getNullValue(BO0->getType());
4418  return new ICmpInst(ICmpInst::ICMP_NE, Op1, Zero);
4419  }
4420  }
4421 
4422  if (Value *V = foldMultiplicationOverflowCheck(I))
4423  return replaceInstUsesWith(I, V);
4424 
4426  return replaceInstUsesWith(I, V);
4427 
4429  return replaceInstUsesWith(I, V);
4430 
4432  return replaceInstUsesWith(I, V);
4433 
4434  return nullptr;
4435 }
4436 
4437 /// Fold icmp Pred min|max(X, Y), X.
4439  ICmpInst::Predicate Pred = Cmp.getPredicate();
4440  Value *Op0 = Cmp.getOperand(0);
4441  Value *X = Cmp.getOperand(1);
4442 
4443  // Canonicalize minimum or maximum operand to LHS of the icmp.
4444  if (match(X, m_c_SMin(m_Specific(Op0), m_Value())) ||
4445  match(X, m_c_SMax(m_Specific(Op0), m_Value())) ||
4446  match(X, m_c_UMin(m_Specific(Op0), m_Value())) ||
4447  match(X, m_c_UMax(m_Specific(Op0), m_Value()))) {
4448  std::swap(Op0, X);
4449  Pred = Cmp.getSwappedPredicate();
4450  }
4451 
4452  Value *Y;
4453  if (match(Op0, m_c_SMin(m_Specific(X), m_Value(Y)))) {
4454  // smin(X, Y) == X --> X s<= Y
4455  // smin(X, Y) s>= X --> X s<= Y
4456  if (Pred == CmpInst::ICMP_EQ || Pred == CmpInst::ICMP_SGE)
4457  return new ICmpInst(ICmpInst::ICMP_SLE, X, Y);
4458 
4459  // smin(X, Y) != X --> X s> Y
4460  // smin(X, Y) s< X --> X s> Y
4461  if (Pred == CmpInst::ICMP_NE || Pred == CmpInst::ICMP_SLT)
4462  return new ICmpInst(ICmpInst::ICMP_SGT, X, Y);
4463 
4464  // These cases should be handled in InstSimplify:
4465  // smin(X, Y) s<= X --> true
4466  // smin(X, Y) s> X --> false
4467  return nullptr;
4468  }
4469 
4470  if (match(Op0, m_c_SMax(m_Specific(X), m_Value(Y)))) {
4471  // smax(X, Y) == X --> X s>= Y
4472  // smax(X, Y) s<= X --> X s>= Y
4473  if (Pred == CmpInst::ICMP_EQ || Pred == CmpInst::ICMP_SLE)
4474  return new ICmpInst(ICmpInst::ICMP_SGE, X, Y);
4475 
4476  // smax(X, Y) != X --> X s< Y
4477  // smax(X, Y) s> X --> X s< Y
4478  if (Pred == CmpInst::ICMP_NE || Pred == CmpInst::ICMP_SGT)
4479  return new ICmpInst(ICmpInst::ICMP_SLT, X, Y);
4480 
4481  // These cases should be handled in InstSimplify:
4482  // smax(X, Y) s>= X --> true
4483  // smax(X, Y) s< X --> false
4484  return nullptr;
4485  }
4486 
4487  if (match(Op0, m_c_UMin(m_Specific(X), m_Value(Y)))) {
4488  // umin(X, Y) == X --> X u<= Y
4489  // umin(X, Y) u>= X --> X u<= Y
4490  if (Pred == CmpInst::ICMP_EQ || Pred == CmpInst::ICMP_UGE)
4491  return new ICmpInst(ICmpInst::ICMP_ULE, X, Y);
4492 
4493  // umin(X, Y) != X --> X u> Y
4494  // umin(X, Y) u< X --> X u> Y
4495  if (Pred == CmpInst::ICMP_NE || Pred == CmpInst::ICMP_ULT)
4496  return new ICmpInst(ICmpInst::ICMP_UGT, X, Y);
4497 
4498  // These cases should be handled in InstSimplify:
4499  // umin(X, Y) u<= X --> true
4500  // umin(X, Y) u> X --> false
4501  return nullptr;
4502  }
4503 
4504  if (match(Op0, m_c_UMax(m_Specific(X), m_Value(Y)))) {
4505  // umax(X, Y) == X --> X u>= Y
4506  // umax(X, Y) u<= X --> X u>= Y
4507  if (Pred == CmpInst::ICMP_EQ || Pred == CmpInst::ICMP_ULE)
4508  return new ICmpInst(ICmpInst::ICMP_UGE, X, Y);
4509 
4510  // umax(X, Y) != X --> X u< Y
4511  // umax(X, Y) u> X --> X u< Y
4512  if (Pred == CmpInst::ICMP_NE || Pred == CmpInst::ICMP_UGT)
4513  return new ICmpInst(ICmpInst::ICMP_ULT, X, Y);
4514 
4515  // These cases should be handled in InstSimplify:
4516  // umax(X, Y) u>= X --> true
4517  // umax(X, Y) u< X --> false
4518  return nullptr;
4519  }
4520 
4521  return nullptr;
4522 }
4523 
4525  if (!I.isEquality())
4526  return nullptr;
4527 
4528  Value *Op0 = I.getOperand(0), *Op1 = I.getOperand(1);
4529  const CmpInst::Predicate Pred = I.getPredicate();
4530  Value *A, *B, *C, *D;
4531  if (match(Op0, m_Xor(m_Value(A), m_Value(B)))) {
4532  if (A == Op1 || B == Op1) { // (A^B) == A -> B == 0
4533  Value *OtherVal = A == Op1 ? B : A;
4534  return new ICmpInst(Pred, OtherVal, Constant::getNullValue(A->getType()));
4535  }
4536 
4537  if (match(Op1, m_Xor(m_Value(C), m_Value(D)))) {
4538  // A^c1 == C^c2 --> A == C^(c1^c2)
4539  ConstantInt *C1, *C2;
4540  if (match(B, m_ConstantInt(C1)) && match(D, m_ConstantInt(C2)) &&
4541  Op1->hasOneUse()) {
4542  Constant *NC = Builder.getInt(C1->getValue() ^ C2->getValue());
4543  Value *Xor = Builder.CreateXor(C, NC);
4544  return new ICmpInst(Pred, A, Xor);
4545  }
4546 
4547  // A^B == A^D -> B == D
4548  if (A == C)
4549  return new ICmpInst(Pred, B, D);
4550  if (A == D)
4551  return new ICmpInst(Pred, B, C);
4552  if (B == C)
4553  return new ICmpInst(Pred, A, D);
4554  if (B == D)
4555  return new ICmpInst(Pred, A, C);
4556  }
4557  }
4558 
4559  if (match(Op1, m_Xor(m_Value(A), m_Value(B))) && (A == Op0 || B == Op0)) {
4560  // A == (A^B) -> B == 0
4561  Value *OtherVal = A == Op0 ? B : A;
4562  return new ICmpInst(Pred, OtherVal, Constant::getNullValue(A->getType()));
4563  }
4564 
4565  // (X&Z) == (Y&Z) -> (X^Y) & Z == 0
4566  if (match(Op0, m_OneUse(m_And(m_Value(A), m_Value(B)))) &&
4567  match(Op1, m_OneUse(m_And(m_Value(C), m_Value(D))))) {
4568  Value *X = nullptr, *Y = nullptr, *Z = nullptr;
4569 
4570  if (A == C) {
4571  X = B;
4572  Y = D;
4573  Z = A;
4574  } else if (A == D) {
4575  X = B;
4576  Y =