1 //===- JumpThreading.cpp - Thread control through conditional blocks ------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file implements the Jump Threading pass.
10 //
11 //===----------------------------------------------------------------------===//
12 
13 #include "llvm/Transforms/Scalar/JumpThreading.h"
14 #include "llvm/ADT/DenseMap.h"
15 #include "llvm/ADT/DenseSet.h"
16 #include "llvm/ADT/MapVector.h"
17 #include "llvm/ADT/Optional.h"
18 #include "llvm/ADT/STLExtras.h"
19 #include "llvm/ADT/SmallPtrSet.h"
20 #include "llvm/ADT/SmallVector.h"
21 #include "llvm/ADT/Statistic.h"
22 #include "llvm/Analysis/AliasAnalysis.h"
23 #include "llvm/Analysis/BlockFrequencyInfo.h"
24 #include "llvm/Analysis/BranchProbabilityInfo.h"
25 #include "llvm/Analysis/CFG.h"
26 #include "llvm/Analysis/ConstantFolding.h"
27 #include "llvm/Analysis/DomTreeUpdater.h"
28 #include "llvm/Analysis/GlobalsModRef.h"
29 #include "llvm/Analysis/GuardUtils.h"
30 #include "llvm/Analysis/InstructionSimplify.h"
31 #include "llvm/Analysis/LazyValueInfo.h"
32 #include "llvm/Analysis/Loads.h"
33 #include "llvm/Analysis/LoopInfo.h"
34 #include "llvm/Analysis/TargetLibraryInfo.h"
35 #include "llvm/Analysis/ValueTracking.h"
36 #include "llvm/IR/BasicBlock.h"
37 #include "llvm/IR/CFG.h"
38 #include "llvm/IR/Constant.h"
39 #include "llvm/IR/ConstantRange.h"
40 #include "llvm/IR/Constants.h"
41 #include "llvm/IR/DataLayout.h"
42 #include "llvm/IR/Dominators.h"
43 #include "llvm/IR/Function.h"
44 #include "llvm/IR/InstrTypes.h"
45 #include "llvm/IR/Instruction.h"
46 #include "llvm/IR/Instructions.h"
47 #include "llvm/IR/IntrinsicInst.h"
48 #include "llvm/IR/Intrinsics.h"
49 #include "llvm/IR/LLVMContext.h"
50 #include "llvm/IR/MDBuilder.h"
51 #include "llvm/IR/Metadata.h"
52 #include "llvm/IR/Module.h"
53 #include "llvm/IR/PassManager.h"
54 #include "llvm/IR/PatternMatch.h"
55 #include "llvm/IR/Type.h"
56 #include "llvm/IR/Use.h"
57 #include "llvm/IR/User.h"
58 #include "llvm/IR/Value.h"
59 #include "llvm/InitializePasses.h"
60 #include "llvm/Pass.h"
61 #include "llvm/Support/BlockFrequency.h"
62 #include "llvm/Support/BranchProbability.h"
63 #include "llvm/Support/Casting.h"
64 #include "llvm/Support/CommandLine.h"
65 #include "llvm/Support/Debug.h"
66 #include "llvm/Support/raw_ostream.h"
67 #include "llvm/Transforms/Scalar.h"
68 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
69 #include "llvm/Transforms/Utils/Cloning.h"
70 #include "llvm/Transforms/Utils/Local.h"
71 #include "llvm/Transforms/Utils/SSAUpdater.h"
72 #include "llvm/Transforms/Utils/ValueMapper.h"
73 #include <algorithm>
74 #include <cassert>
75 #include <cstddef>
76 #include <cstdint>
77 #include <iterator>
78 #include <memory>
79 #include <utility>
80 
81 using namespace llvm;
82 using namespace jumpthreading;
83 
84 #define DEBUG_TYPE "jump-threading"
85 
86 STATISTIC(NumThreads, "Number of jumps threaded");
87 STATISTIC(NumFolds,   "Number of terminators folded");
88 STATISTIC(NumDupes,   "Number of branch blocks duplicated to eliminate phi");
89 
90 static cl::opt<unsigned>
91 BBDuplicateThreshold("jump-threading-threshold",
92           cl::desc("Max block size to duplicate for jump threading"),
93           cl::init(6), cl::Hidden);
94 
95 static cl::opt<unsigned>
96 ImplicationSearchThreshold(
97   "jump-threading-implication-search-threshold",
98   cl::desc("The number of predecessors to search for a stronger "
99            "condition to use to thread over a weaker condition"),
100   cl::init(3), cl::Hidden);
101 
102 static cl::opt<bool> PrintLVIAfterJumpThreading(
103     "print-lvi-after-jump-threading",
104     cl::desc("Print the LazyValueInfo cache after JumpThreading"), cl::init(false),
105     cl::Hidden);
106 
107 static cl::opt<bool> ThreadAcrossLoopHeaders(
108     "jump-threading-across-loop-headers",
109     cl::desc("Allow JumpThreading to thread across loop headers, for testing"),
110     cl::init(false), cl::Hidden);
111 
112 
113 namespace {
114 
115   /// This pass performs 'jump threading', which looks at blocks that have
116   /// multiple predecessors and multiple successors.  If one or more of the
117   /// predecessors of the block can be proven to always jump to one of the
118   /// successors, we forward the edge from the predecessor to the successor by
119   /// duplicating the contents of this block.
120   ///
121   /// An example of when this can occur is code like this:
122   ///
123   ///   if () { ...
124   ///     X = 4;
125   ///   }
126   ///   if (X < 3) {
127   ///
128   /// In this case, the unconditional branch at the end of the first if can be
129   /// revectored to the false side of the second if.
130   class JumpThreading : public FunctionPass {
131     JumpThreadingPass Impl;
132 
133   public:
134     static char ID; // Pass identification
135 
136     JumpThreading(int T = -1) : FunctionPass(ID), Impl(T) {
137       initializeJumpThreadingPass(*PassRegistry::getPassRegistry());
138     }
139 
140     bool runOnFunction(Function &F) override;
141 
142     void getAnalysisUsage(AnalysisUsage &AU) const override {
143       AU.addRequired<DominatorTreeWrapperPass>();
144       AU.addPreserved<DominatorTreeWrapperPass>();
145       AU.addRequired<AAResultsWrapperPass>();
146       AU.addRequired<LazyValueInfoWrapperPass>();
147       AU.addPreserved<LazyValueInfoWrapperPass>();
148       AU.addPreserved<GlobalsAAWrapperPass>();
149       AU.addRequired<TargetLibraryInfoWrapperPass>();
150     }
151 
152     void releaseMemory() override { Impl.releaseMemory(); }
153   };
154 
155 } // end anonymous namespace
156 
157 char JumpThreading::ID = 0;
158 
159 INITIALIZE_PASS_BEGIN(JumpThreading, "jump-threading",
160                 "Jump Threading", false, false)
161 INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass)
162 INITIALIZE_PASS_DEPENDENCY(LazyValueInfoWrapperPass)
163 INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)
164 INITIALIZE_PASS_DEPENDENCY(AAResultsWrapperPass)
165 INITIALIZE_PASS_END(JumpThreading, "jump-threading",
166                 "Jump Threading", false, false)
167 
168 // Public interface to the Jump Threading pass
169 FunctionPass *llvm::createJumpThreadingPass(int Threshold) {
170   return new JumpThreading(Threshold);
171 }
172 
173 JumpThreadingPass::JumpThreadingPass(int T) {
174   DefaultBBDupThreshold = (T == -1) ? BBDuplicateThreshold : unsigned(T);
175 }
176 
177 // Update branch probability information according to conditional
178 // branch probability. This is usually made possible for cloned branches
179 // in inline instances by the context specific profile in the caller.
180 // For instance,
181 //
182 //  [Block PredBB]
183 //  [Branch PredBr]
184 //  if (t) {
185 //     Block A;
186 //  } else {
187 //     Block B;
188 //  }
189 //
190 //  [Block BB]
191 //  cond = PN([true, %A], [..., %B]); // PHI node
192 //  [Branch CondBr]
193 //  if (cond) {
194 //    ...  // P(cond == true) = 1%
195 //  }
196 //
197 //  Here we know that when block A is taken, cond must be true, which means
198 //      P(cond == true | A) = 1
199 //
200 //  Given that P(cond == true) = P(cond == true | A) * P(A) +
201 //                               P(cond == true | B) * P(B)
202 //  we get:
203 //     P(cond == true ) = P(A) + P(cond == true | B) * P(B)
204 //
205 //  which gives us:
206 //     P(A) is less than P(cond == true), i.e.
207 //     P(t == true) <= P(cond == true)
208 //
209 //  In other words, if we know P(cond == true) is unlikely, we know
210 //  that P(t == true) is also unlikely.
211 //
212 static void updatePredecessorProfileMetadata(PHINode *PN, BasicBlock *BB) {
213   BranchInst *CondBr = dyn_cast<BranchInst>(BB->getTerminator());
214   if (!CondBr)
215     return;
216 
217   uint64_t TrueWeight, FalseWeight;
218   if (!CondBr->extractProfMetadata(TrueWeight, FalseWeight))
219     return;
220 
221   if (TrueWeight + FalseWeight == 0)
222     // Zero branch_weights do not give a hint for getting branch probabilities.
223     // Technically it would result in division by zero denominator, which is
224     // TrueWeight + FalseWeight.
225     return;
226 
227   // Returns the outgoing edge of the dominating predecessor block
228   // that leads to the PhiNode's incoming block:
229   auto GetPredOutEdge =
230       [](BasicBlock *IncomingBB,
231          BasicBlock *PhiBB) -> std::pair<BasicBlock *, BasicBlock *> {
232     auto *PredBB = IncomingBB;
233     auto *SuccBB = PhiBB;
234     SmallPtrSet<BasicBlock *, 16> Visited;
235     while (true) {
236       BranchInst *PredBr = dyn_cast<BranchInst>(PredBB->getTerminator());
237       if (PredBr && PredBr->isConditional())
238         return {PredBB, SuccBB};
239       Visited.insert(PredBB);
240       auto *SinglePredBB = PredBB->getSinglePredecessor();
241       if (!SinglePredBB)
242         return {nullptr, nullptr};
243 
244       // Stop searching when SinglePredBB has been visited. It means we see
245       // an unreachable loop.
246       if (Visited.count(SinglePredBB))
247         return {nullptr, nullptr};
248 
249       SuccBB = PredBB;
250       PredBB = SinglePredBB;
251     }
252   };
253 
254   for (unsigned i = 0, e = PN->getNumIncomingValues(); i != e; ++i) {
255     Value *PhiOpnd = PN->getIncomingValue(i);
256     ConstantInt *CI = dyn_cast<ConstantInt>(PhiOpnd);
257 
258     if (!CI || !CI->getType()->isIntegerTy(1))
259       continue;
260 
261     BranchProbability BP =
262         (CI->isOne() ? BranchProbability::getBranchProbability(
263                            TrueWeight, TrueWeight + FalseWeight)
264                      : BranchProbability::getBranchProbability(
265                            FalseWeight, TrueWeight + FalseWeight));
266 
267     auto PredOutEdge = GetPredOutEdge(PN->getIncomingBlock(i), BB);
268     if (!PredOutEdge.first)
269       return;
270 
271     BasicBlock *PredBB = PredOutEdge.first;
272     BranchInst *PredBr = dyn_cast<BranchInst>(PredBB->getTerminator());
273     if (!PredBr)
274       return;
275 
276     uint64_t PredTrueWeight, PredFalseWeight;
277     // FIXME: We currently only set the profile data when it is missing.
278     // With PGO, this can be used to refine even existing profile data with
279     // context information. This needs to be done after more performance
280     // testing.
281     if (PredBr->extractProfMetadata(PredTrueWeight, PredFalseWeight))
282       continue;
283 
284     // We can not infer anything useful when BP >= 50%, because BP is the
285     // upper bound probability value.
286     if (BP >= BranchProbability(50, 100))
287       continue;
288 
289     SmallVector<uint32_t, 2> Weights;
290     if (PredBr->getSuccessor(0) == PredOutEdge.second) {
291       Weights.push_back(BP.getNumerator());
292       Weights.push_back(BP.getCompl().getNumerator());
293     } else {
294       Weights.push_back(BP.getCompl().getNumerator());
295       Weights.push_back(BP.getNumerator());
296     }
297     PredBr->setMetadata(LLVMContext::MD_prof,
298                         MDBuilder(PredBr->getParent()->getContext())
299                             .createBranchWeights(Weights));
300   }
301 }
302 
303 /// runOnFunction - Toplevel algorithm.
304 bool JumpThreading::runOnFunction(Function &F) {
305   if (skipFunction(F))
306     return false;
307   auto TLI = &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F);
308   auto DT = &getAnalysis<DominatorTreeWrapperPass>().getDomTree();
309   auto LVI = &getAnalysis<LazyValueInfoWrapperPass>().getLVI();
310   auto AA = &getAnalysis<AAResultsWrapperPass>().getAAResults();
311   DomTreeUpdater DTU(*DT, DomTreeUpdater::UpdateStrategy::Lazy);
312   std::unique_ptr<BlockFrequencyInfo> BFI;
313   std::unique_ptr<BranchProbabilityInfo> BPI;
314   if (F.hasProfileData()) {
315     LoopInfo LI{DominatorTree(F)};
316     BPI.reset(new BranchProbabilityInfo(F, LI, TLI));
317     BFI.reset(new BlockFrequencyInfo(F, *BPI, LI));
318   }
319 
320   bool Changed = Impl.runImpl(F, TLI, LVI, AA, &DTU, F.hasProfileData(),
321                               std::move(BFI), std::move(BPI));
322   if (PrintLVIAfterJumpThreading) {
323     dbgs() << "LVI for function '" << F.getName() << "':\n";
324     LVI->printLVI(F, DTU.getDomTree(), dbgs());
325   }
326   return Changed;
327 }
328 
329 PreservedAnalyses JumpThreadingPass::run(Function &F,
330                                          FunctionAnalysisManager &AM) {
331   auto &TLI = AM.getResult<TargetLibraryAnalysis>(F);
332   auto &DT = AM.getResult<DominatorTreeAnalysis>(F);
333   auto &LVI = AM.getResult<LazyValueAnalysis>(F);
334   auto &AA = AM.getResult<AAManager>(F);
335   DomTreeUpdater DTU(DT, DomTreeUpdater::UpdateStrategy::Lazy);
336 
337   std::unique_ptr<BlockFrequencyInfo> BFI;
338   std::unique_ptr<BranchProbabilityInfo> BPI;
339   if (F.hasProfileData()) {
340     LoopInfo LI{DominatorTree(F)};
341     BPI.reset(new BranchProbabilityInfo(F, LI, &TLI));
342     BFI.reset(new BlockFrequencyInfo(F, *BPI, LI));
343   }
344 
345   bool Changed = runImpl(F, &TLI, &LVI, &AA, &DTU, F.hasProfileData(),
346                          std::move(BFI), std::move(BPI));
347 
348   if (!Changed)
349     return PreservedAnalyses::all();
350   PreservedAnalyses PA;
351   PA.preserve<GlobalsAA>();
352   PA.preserve<DominatorTreeAnalysis>();
353   PA.preserve<LazyValueAnalysis>();
354   return PA;
355 }
356 
357 bool JumpThreadingPass::runImpl(Function &F, TargetLibraryInfo *TLI_,
358                                 LazyValueInfo *LVI_, AliasAnalysis *AA_,
359                                 DomTreeUpdater *DTU_, bool HasProfileData_,
360                                 std::unique_ptr<BlockFrequencyInfo> BFI_,
361                                 std::unique_ptr<BranchProbabilityInfo> BPI_) {
362   LLVM_DEBUG(dbgs() << "Jump threading on function '" << F.getName() << "'\n");
363   TLI = TLI_;
364   LVI = LVI_;
365   AA = AA_;
366   DTU = DTU_;
367   BFI.reset();
368   BPI.reset();
369   // When profile data is available, we need to update edge weights after
370   // successful jump threading, which requires both BPI and BFI being available.
371   HasProfileData = HasProfileData_;
372   auto *GuardDecl = F.getParent()->getFunction(
373       Intrinsic::getName(Intrinsic::experimental_guard));
374   HasGuards = GuardDecl && !GuardDecl->use_empty();
375   if (HasProfileData) {
376     BPI = std::move(BPI_);
377     BFI = std::move(BFI_);
378   }
379 
380   // Reduce the number of instructions duplicated when optimizing strictly for
381   // size.
382   if (BBDuplicateThreshold.getNumOccurrences())
383     BBDupThreshold = BBDuplicateThreshold;
384   else if (F.hasFnAttribute(Attribute::MinSize))
385     BBDupThreshold = 3;
386   else
387     BBDupThreshold = DefaultBBDupThreshold;
388 
389   // JumpThreading must not processes blocks unreachable from entry. It's a
390   // waste of compute time and can potentially lead to hangs.
391   SmallPtrSet<BasicBlock *, 16> Unreachable;
392   assert(DTU && "DTU isn't passed into JumpThreading before using it.");
393   assert(DTU->hasDomTree() && "JumpThreading relies on DomTree to proceed.");
394   DominatorTree &DT = DTU->getDomTree();
395   for (auto &BB : F)
396     if (!DT.isReachableFromEntry(&BB))
397       Unreachable.insert(&BB);
398 
399   if (!ThreadAcrossLoopHeaders)
400     FindLoopHeaders(F);
401 
402   bool EverChanged = false;
403   bool Changed;
404   do {
405     Changed = false;
406     for (auto &BB : F) {
407       if (Unreachable.count(&BB))
408         continue;
409       while (ProcessBlock(&BB)) // Thread all of the branches we can over BB.
410         Changed = true;
411 
412       // Jump threading may have introduced redundant debug values into BB
413       // which should be removed.
414       if (Changed)
415         RemoveRedundantDbgInstrs(&BB);
416 
417       // Stop processing BB if it's the entry or is now deleted. The following
418       // routines attempt to eliminate BB and locating a suitable replacement
419       // for the entry is non-trivial.
420       if (&BB == &F.getEntryBlock() || DTU->isBBPendingDeletion(&BB))
421         continue;
422 
423       if (pred_empty(&BB)) {
424         // When ProcessBlock makes BB unreachable it doesn't bother to fix up
425         // the instructions in it. We must remove BB to prevent invalid IR.
426         LLVM_DEBUG(dbgs() << "  JT: Deleting dead block '" << BB.getName()
427                           << "' with terminator: " << *BB.getTerminator()
428                           << '\n');
429         LoopHeaders.erase(&BB);
430         LVI->eraseBlock(&BB);
431         DeleteDeadBlock(&BB, DTU);
432         Changed = true;
433         continue;
434       }
435 
436       // ProcessBlock doesn't thread BBs with unconditional TIs. However, if BB
437       // is "almost empty", we attempt to merge BB with its sole successor.
438       auto *BI = dyn_cast<BranchInst>(BB.getTerminator());
439       if (BI && BI->isUnconditional()) {
440         BasicBlock *Succ = BI->getSuccessor(0);
441         if (
442             // The terminator must be the only non-phi instruction in BB.
443             BB.getFirstNonPHIOrDbg()->isTerminator() &&
444             // Don't alter Loop headers and latches to ensure another pass can
445             // detect and transform nested loops later.
446             !LoopHeaders.count(&BB) && !LoopHeaders.count(Succ) &&
447             TryToSimplifyUncondBranchFromEmptyBlock(&BB, DTU)) {
448           RemoveRedundantDbgInstrs(Succ);
449           // BB is valid for cleanup here because we passed in DTU. F remains
450           // BB's parent until a DTU->getDomTree() event.
451           LVI->eraseBlock(&BB);
452           Changed = true;
453         }
454       }
455     }
456     EverChanged |= Changed;
457   } while (Changed);
458 
459   LoopHeaders.clear();
460   return EverChanged;
461 }
462 
463 // Replace uses of Cond with ToVal when safe to do so. If all uses are
464 // replaced, we can remove Cond. We cannot blindly replace all uses of Cond
465 // because we may incorrectly replace uses when guards/assumes are uses of
466 // of `Cond` and we used the guards/assume to reason about the `Cond` value
467 // at the end of block. RAUW unconditionally replaces all uses
468 // including the guards/assumes themselves and the uses before the
469 // guard/assume.
470 static void ReplaceFoldableUses(Instruction *Cond, Value *ToVal) {
471   assert(Cond->getType() == ToVal->getType());
472   auto *BB = Cond->getParent();
473   // We can unconditionally replace all uses in non-local blocks (i.e. uses
474   // strictly dominated by BB), since LVI information is true from the
475   // terminator of BB.
476   replaceNonLocalUsesWith(Cond, ToVal);
477   for (Instruction &I : reverse(*BB)) {
478     // Reached the Cond whose uses we are trying to replace, so there are no
479     // more uses.
480     if (&I == Cond)
481       break;
482     // We only replace uses in instructions that are guaranteed to reach the end
483     // of BB, where we know Cond is ToVal.
484     if (!isGuaranteedToTransferExecutionToSuccessor(&I))
485       break;
486     I.replaceUsesOfWith(Cond, ToVal);
487   }
488   if (Cond->use_empty() && !Cond->mayHaveSideEffects())
489     Cond->eraseFromParent();
490 }
491 
492 /// Return the cost of duplicating a piece of this block from first non-phi
493 /// and before StopAt instruction to thread across it. Stop scanning the block
494 /// when exceeding the threshold. If duplication is impossible, returns ~0U.
495 static unsigned getJumpThreadDuplicationCost(BasicBlock *BB,
496                                              Instruction *StopAt,
497                                              unsigned Threshold) {
498   assert(StopAt->getParent() == BB && "Not an instruction from proper BB?");
499   /// Ignore PHI nodes, these will be flattened when duplication happens.
500   BasicBlock::const_iterator I(BB->getFirstNonPHI());
501 
502   // FIXME: THREADING will delete values that are just used to compute the
503   // branch, so they shouldn't count against the duplication cost.
504 
505   unsigned Bonus = 0;
506   if (BB->getTerminator() == StopAt) {
507     // Threading through a switch statement is particularly profitable.  If this
508     // block ends in a switch, decrease its cost to make it more likely to
509     // happen.
510     if (isa<SwitchInst>(StopAt))
511       Bonus = 6;
512 
513     // The same holds for indirect branches, but slightly more so.
514     if (isa<IndirectBrInst>(StopAt))
515       Bonus = 8;
516   }
517 
518   // Bump the threshold up so the early exit from the loop doesn't skip the
519   // terminator-based Size adjustment at the end.
520   Threshold += Bonus;
521 
522   // Sum up the cost of each instruction until we get to the terminator.  Don't
523   // include the terminator because the copy won't include it.
524   unsigned Size = 0;
525   for (; &*I != StopAt; ++I) {
526 
527     // Stop scanning the block if we've reached the threshold.
528     if (Size > Threshold)
529       return Size;
530 
531     // Debugger intrinsics don't incur code size.
532     if (isa<DbgInfoIntrinsic>(I)) continue;
533 
534     // If this is a pointer->pointer bitcast, it is free.
535     if (isa<BitCastInst>(I) && I->getType()->isPointerTy())
536       continue;
537 
538     // Freeze instruction is free, too.
539     if (isa<FreezeInst>(I))
540       continue;
541 
542     // Bail out if this instruction gives back a token type, it is not possible
543     // to duplicate it if it is used outside this BB.
544     if (I->getType()->isTokenTy() && I->isUsedOutsideOfBlock(BB))
545       return ~0U;
546 
547     // All other instructions count for at least one unit.
548     ++Size;
549 
550     // Calls are more expensive.  If they are non-intrinsic calls, we model them
551     // as having cost of 4.  If they are a non-vector intrinsic, we model them
552     // as having cost of 2 total, and if they are a vector intrinsic, we model
553     // them as having cost 1.
554     if (const CallInst *CI = dyn_cast<CallInst>(I)) {
555       if (CI->cannotDuplicate() || CI->isConvergent())
556         // Blocks with NoDuplicate are modelled as having infinite cost, so they
557         // are never duplicated.
558         return ~0U;
559       else if (!isa<IntrinsicInst>(CI))
560         Size += 3;
561       else if (!CI->getType()->isVectorTy())
562         Size += 1;
563     }
564   }
565 
566   return Size > Bonus ? Size - Bonus : 0;
567 }
568 
569 /// FindLoopHeaders - We do not want jump threading to turn proper loop
570 /// structures into irreducible loops.  Doing this breaks up the loop nesting
571 /// hierarchy and pessimizes later transformations.  To prevent this from
572 /// happening, we first have to find the loop headers.  Here we approximate this
573 /// by finding targets of backedges in the CFG.
574 ///
575 /// Note that there definitely are cases when we want to allow threading of
576 /// edges across a loop header.  For example, threading a jump from outside the
577 /// loop (the preheader) to an exit block of the loop is definitely profitable.
578 /// It is also almost always profitable to thread backedges from within the loop
579 /// to exit blocks, and is often profitable to thread backedges to other blocks
580 /// within the loop (forming a nested loop).  This simple analysis is not rich
581 /// enough to track all of these properties and keep it up-to-date as the CFG
582 /// mutates, so we don't allow any of these transformations.
583 void JumpThreadingPass::FindLoopHeaders(Function &F) {
584   SmallVector<std::pair<const BasicBlock*,const BasicBlock*>, 32> Edges;
585   FindFunctionBackedges(F, Edges);
586 
587   for (const auto &Edge : Edges)
588     LoopHeaders.insert(Edge.second);
589 }
590 
591 /// getKnownConstant - Helper method to determine if we can thread over a
592 /// terminator with the given value as its condition, and if so what value to
593 /// use for that. What kind of value this is depends on whether we want an
594 /// integer or a block address, but an undef is always accepted.
595 /// Returns null if Val is null or not an appropriate constant.
596 static Constant *getKnownConstant(Value *Val, ConstantPreference Preference) {
597   if (!Val)
598     return nullptr;
599 
600   // Undef is "known" enough.
601   if (UndefValue *U = dyn_cast<UndefValue>(Val))
602     return U;
603 
604   if (Preference == WantBlockAddress)
605     return dyn_cast<BlockAddress>(Val->stripPointerCasts());
606 
607   return dyn_cast<ConstantInt>(Val);
608 }
609 
610 /// ComputeValueKnownInPredecessors - Given a basic block BB and a value V, see
611 /// if we can infer that the value is a known ConstantInt/BlockAddress or undef
612 /// in any of our predecessors.  If so, return the known list of value and pred
613 /// BB in the result vector.
614 ///
615 /// This returns true if there were any known values.
616 bool JumpThreadingPass::ComputeValueKnownInPredecessorsImpl(
617     Value *V, BasicBlock *BB, PredValueInfo &Result,
618     ConstantPreference Preference, DenseSet<Value *> &RecursionSet,
619     Instruction *CxtI) {
620   // This method walks up use-def chains recursively.  Because of this, we could
621   // get into an infinite loop going around loops in the use-def chain.  To
622   // prevent this, keep track of what (value, block) pairs we've already visited
623   // and terminate the search if we loop back to them
624   if (!RecursionSet.insert(V).second)
625     return false;
626 
627   // If V is a constant, then it is known in all predecessors.
628   if (Constant *KC = getKnownConstant(V, Preference)) {
629     for (BasicBlock *Pred : predecessors(BB))
630       Result.emplace_back(KC, Pred);
631 
632     return !Result.empty();
633   }
634 
635   // If V is a non-instruction value, or an instruction in a different block,
636   // then it can't be derived from a PHI.
637   Instruction *I = dyn_cast<Instruction>(V);
638   if (!I || I->getParent() != BB) {
639 
640     // Okay, if this is a live-in value, see if it has a known value at the end
641     // of any of our predecessors.
642     //
643     // FIXME: This should be an edge property, not a block end property.
644     /// TODO: Per PR2563, we could infer value range information about a
645     /// predecessor based on its terminator.
646     //
647     // FIXME: change this to use the more-rich 'getPredicateOnEdge' method if
648     // "I" is a non-local compare-with-a-constant instruction.  This would be
649     // able to handle value inequalities better, for example if the compare is
650     // "X < 4" and "X < 3" is known true but "X < 4" itself is not available.
651     // Perhaps getConstantOnEdge should be smart enough to do this?
652     for (BasicBlock *P : predecessors(BB)) {
653       // If the value is known by LazyValueInfo to be a constant in a
654       // predecessor, use that information to try to thread this block.
655       Constant *PredCst = LVI->getConstantOnEdge(V, P, BB, CxtI);
656       if (Constant *KC = getKnownConstant(PredCst, Preference))
657         Result.emplace_back(KC, P);
658     }
659 
660     return !Result.empty();
661   }
662 
663   /// If I is a PHI node, then we know the incoming values for any constants.
664   if (PHINode *PN = dyn_cast<PHINode>(I)) {
665     for (unsigned i = 0, e = PN->getNumIncomingValues(); i != e; ++i) {
666       Value *InVal = PN->getIncomingValue(i);
667       if (Constant *KC = getKnownConstant(InVal, Preference)) {
668         Result.emplace_back(KC, PN->getIncomingBlock(i));
669       } else {
670         Constant *CI = LVI->getConstantOnEdge(InVal,
671                                               PN->getIncomingBlock(i),
672                                               BB, CxtI);
673         if (Constant *KC = getKnownConstant(CI, Preference))
674           Result.emplace_back(KC, PN->getIncomingBlock(i));
675       }
676     }
677 
678     return !Result.empty();
679   }
680 
681   // Handle Cast instructions.
682   if (CastInst *CI = dyn_cast<CastInst>(I)) {
683     Value *Source = CI->getOperand(0);
684     ComputeValueKnownInPredecessorsImpl(Source, BB, Result, Preference,
685                                         RecursionSet, CxtI);
686     if (Result.empty())
687       return false;
688 
689     // Convert the known values.
690     for (auto &R : Result)
691       R.first = ConstantExpr::getCast(CI->getOpcode(), R.first, CI->getType());
692 
693     return true;
694   }
695 
696   if (FreezeInst *FI = dyn_cast<FreezeInst>(I)) {
697     Value *Source = FI->getOperand(0);
698     ComputeValueKnownInPredecessorsImpl(Source, BB, Result, Preference,
699                                         RecursionSet, CxtI);
700 
701     erase_if(Result, [](auto &Pair) {
702       return !isGuaranteedNotToBeUndefOrPoison(Pair.first);
703     });
704 
705     return !Result.empty();
706   }
707 
708   // Handle some boolean conditions.
709   if (I->getType()->getPrimitiveSizeInBits() == 1) {
710     assert(Preference == WantInteger && "One-bit non-integer type?");
711     // X | true -> true
712     // X & false -> false
713     if (I->getOpcode() == Instruction::Or ||
714         I->getOpcode() == Instruction::And) {
715       PredValueInfoTy LHSVals, RHSVals;
716 
717       ComputeValueKnownInPredecessorsImpl(I->getOperand(0), BB, LHSVals,
718                                       WantInteger, RecursionSet, CxtI);
719       ComputeValueKnownInPredecessorsImpl(I->getOperand(1), BB, RHSVals,
720                                           WantInteger, RecursionSet, CxtI);
721 
722       if (LHSVals.empty() && RHSVals.empty())
723         return false;
724 
725       ConstantInt *InterestingVal;
726       if (I->getOpcode() == Instruction::Or)
727         InterestingVal = ConstantInt::getTrue(I->getContext());
728       else
729         InterestingVal = ConstantInt::getFalse(I->getContext());
730 
731       SmallPtrSet<BasicBlock*, 4> LHSKnownBBs;
732 
733       // Scan for the sentinel.  If we find an undef, force it to the
734       // interesting value: x|undef -> true and x&undef -> false.
735       for (const auto &LHSVal : LHSVals)
736         if (LHSVal.first == InterestingVal || isa<UndefValue>(LHSVal.first)) {
737           Result.emplace_back(InterestingVal, LHSVal.second);
738           LHSKnownBBs.insert(LHSVal.second);
739         }
740       for (const auto &RHSVal : RHSVals)
741         if (RHSVal.first == InterestingVal || isa<UndefValue>(RHSVal.first)) {
742           // If we already inferred a value for this block on the LHS, don't
743           // re-add it.
744           if (!LHSKnownBBs.count(RHSVal.second))
745             Result.emplace_back(InterestingVal, RHSVal.second);
746         }
747 
748       return !Result.empty();
749     }
750 
751     // Handle the NOT form of XOR.
752     if (I->getOpcode() == Instruction::Xor &&
753         isa<ConstantInt>(I->getOperand(1)) &&
754         cast<ConstantInt>(I->getOperand(1))->isOne()) {
755       ComputeValueKnownInPredecessorsImpl(I->getOperand(0), BB, Result,
756                                           WantInteger, RecursionSet, CxtI);
757       if (Result.empty())
758         return false;
759 
760       // Invert the known values.
761       for (auto &R : Result)
762         R.first = ConstantExpr::getNot(R.first);
763 
764       return true;
765     }
766 
767   // Try to simplify some other binary operator values.
768   } else if (BinaryOperator *BO = dyn_cast<BinaryOperator>(I)) {
769     assert(Preference != WantBlockAddress
770             && "A binary operator creating a block address?");
771     if (ConstantInt *CI = dyn_cast<ConstantInt>(BO->getOperand(1))) {
772       PredValueInfoTy LHSVals;
773       ComputeValueKnownInPredecessorsImpl(BO->getOperand(0), BB, LHSVals,
774                                           WantInteger, RecursionSet, CxtI);
775 
776       // Try to use constant folding to simplify the binary operator.
777       for (const auto &LHSVal : LHSVals) {
778         Constant *V = LHSVal.first;
779         Constant *Folded = ConstantExpr::get(BO->getOpcode(), V, CI);
780 
781         if (Constant *KC = getKnownConstant(Folded, WantInteger))
782           Result.emplace_back(KC, LHSVal.second);
783       }
784     }
785 
786     return !Result.empty();
787   }
788 
789   // Handle compare with phi operand, where the PHI is defined in this block.
790   if (CmpInst *Cmp = dyn_cast<CmpInst>(I)) {
791     assert(Preference == WantInteger && "Compares only produce integers");
792     Type *CmpType = Cmp->getType();
793     Value *CmpLHS = Cmp->getOperand(0);
794     Value *CmpRHS = Cmp->getOperand(1);
795     CmpInst::Predicate Pred = Cmp->getPredicate();
796 
797     PHINode *PN = dyn_cast<PHINode>(CmpLHS);
798     if (!PN)
799       PN = dyn_cast<PHINode>(CmpRHS);
800     if (PN && PN->getParent() == BB) {
801       const DataLayout &DL = PN->getModule()->getDataLayout();
802       // We can do this simplification if any comparisons fold to true or false.
803       // See if any do.
804       for (unsigned i = 0, e = PN->getNumIncomingValues(); i != e; ++i) {
805         BasicBlock *PredBB = PN->getIncomingBlock(i);
806         Value *LHS, *RHS;
807         if (PN == CmpLHS) {
808           LHS = PN->getIncomingValue(i);
809           RHS = CmpRHS->DoPHITranslation(BB, PredBB);
810         } else {
811           LHS = CmpLHS->DoPHITranslation(BB, PredBB);
812           RHS = PN->getIncomingValue(i);
813         }
814         Value *Res = SimplifyCmpInst(Pred, LHS, RHS, {DL});
815         if (!Res) {
816           if (!isa<Constant>(RHS))
817             continue;
818 
819           // getPredicateOnEdge call will make no sense if LHS is defined in BB.
820           auto LHSInst = dyn_cast<Instruction>(LHS);
821           if (LHSInst && LHSInst->getParent() == BB)
822             continue;
823 
824           LazyValueInfo::Tristate
825             ResT = LVI->getPredicateOnEdge(Pred, LHS,
826                                            cast<Constant>(RHS), PredBB, BB,
827                                            CxtI ? CxtI : Cmp);
828           if (ResT == LazyValueInfo::Unknown)
829             continue;
830           Res = ConstantInt::get(Type::getInt1Ty(LHS->getContext()), ResT);
831         }
832 
833         if (Constant *KC = getKnownConstant(Res, WantInteger))
834           Result.emplace_back(KC, PredBB);
835       }
836 
837       return !Result.empty();
838     }
839 
840     // If comparing a live-in value against a constant, see if we know the
841     // live-in value on any predecessors.
842     if (isa<Constant>(CmpRHS) && !CmpType->isVectorTy()) {
843       Constant *CmpConst = cast<Constant>(CmpRHS);
844 
845       if (!isa<Instruction>(CmpLHS) ||
846           cast<Instruction>(CmpLHS)->getParent() != BB) {
847         for (BasicBlock *P : predecessors(BB)) {
848           // If the value is known by LazyValueInfo to be a constant in a
849           // predecessor, use that information to try to thread this block.
850           LazyValueInfo::Tristate Res =
851             LVI->getPredicateOnEdge(Pred, CmpLHS,
852                                     CmpConst, P, BB, CxtI ? CxtI : Cmp);
853           if (Res == LazyValueInfo::Unknown)
854             continue;
855 
856           Constant *ResC = ConstantInt::get(CmpType, Res);
857           Result.emplace_back(ResC, P);
858         }
859 
860         return !Result.empty();
861       }
862 
863       // InstCombine can fold some forms of constant range checks into
864       // (icmp (add (x, C1)), C2). See if we have we have such a thing with
865       // x as a live-in.
866       {
867         using namespace PatternMatch;
868 
869         Value *AddLHS;
870         ConstantInt *AddConst;
871         if (isa<ConstantInt>(CmpConst) &&
872             match(CmpLHS, m_Add(m_Value(AddLHS), m_ConstantInt(AddConst)))) {
873           if (!isa<Instruction>(AddLHS) ||
874               cast<Instruction>(AddLHS)->getParent() != BB) {
875             for (BasicBlock *P : predecessors(BB)) {
876               // If the value is known by LazyValueInfo to be a ConstantRange in
877               // a predecessor, use that information to try to thread this
878               // block.
879               ConstantRange CR = LVI->getConstantRangeOnEdge(
880                   AddLHS, P, BB, CxtI ? CxtI : cast<Instruction>(CmpLHS));
881               // Propagate the range through the addition.
882               CR = CR.add(AddConst->getValue());
883 
884               // Get the range where the compare returns true.
885               ConstantRange CmpRange = ConstantRange::makeExactICmpRegion(
886                   Pred, cast<ConstantInt>(CmpConst)->getValue());
887 
888               Constant *ResC;
889               if (CmpRange.contains(CR))
890                 ResC = ConstantInt::getTrue(CmpType);
891               else if (CmpRange.inverse().contains(CR))
892                 ResC = ConstantInt::getFalse(CmpType);
893               else
894                 continue;
895 
896               Result.emplace_back(ResC, P);
897             }
898 
899             return !Result.empty();
900           }
901         }
902       }
903 
904       // Try to find a constant value for the LHS of a comparison,
905       // and evaluate it statically if we can.
906       PredValueInfoTy LHSVals;
907       ComputeValueKnownInPredecessorsImpl(I->getOperand(0), BB, LHSVals,
908                                           WantInteger, RecursionSet, CxtI);
909 
910       for (const auto &LHSVal : LHSVals) {
911         Constant *V = LHSVal.first;
912         Constant *Folded = ConstantExpr::getCompare(Pred, V, CmpConst);
913         if (Constant *KC = getKnownConstant(Folded, WantInteger))
914           Result.emplace_back(KC, LHSVal.second);
915       }
916 
917       return !Result.empty();
918     }
919   }
920 
921   if (SelectInst *SI = dyn_cast<SelectInst>(I)) {
922     // Handle select instructions where at least one operand is a known constant
923     // and we can figure out the condition value for any predecessor block.
924     Constant *TrueVal = getKnownConstant(SI->getTrueValue(), Preference);
925     Constant *FalseVal = getKnownConstant(SI->getFalseValue(), Preference);
926     PredValueInfoTy Conds;
927     if ((TrueVal || FalseVal) &&
928         ComputeValueKnownInPredecessorsImpl(SI->getCondition(), BB, Conds,
929                                             WantInteger, RecursionSet, CxtI)) {
930       for (auto &C : Conds) {
931         Constant *Cond = C.first;
932 
933         // Figure out what value to use for the condition.
934         bool KnownCond;
935         if (ConstantInt *CI = dyn_cast<ConstantInt>(Cond)) {
936           // A known boolean.
937           KnownCond = CI->isOne();
938         } else {
939           assert(isa<UndefValue>(Cond) && "Unexpected condition value");
940           // Either operand will do, so be sure to pick the one that's a known
941           // constant.
942           // FIXME: Do this more cleverly if both values are known constants?
943           KnownCond = (TrueVal != nullptr);
944         }
945 
946         // See if the select has a known constant value for this predecessor.
947         if (Constant *Val = KnownCond ? TrueVal : FalseVal)
948           Result.emplace_back(Val, C.second);
949       }
950 
951       return !Result.empty();
952     }
953   }
954 
955   // If all else fails, see if LVI can figure out a constant value for us.
956   Constant *CI = LVI->getConstant(V, BB, CxtI);
957   if (Constant *KC = getKnownConstant(CI, Preference)) {
958     for (BasicBlock *Pred : predecessors(BB))
959       Result.emplace_back(KC, Pred);
960   }
961 
962   return !Result.empty();
963 }
964 
965 /// GetBestDestForBranchOnUndef - If we determine that the specified block ends
966 /// in an undefined jump, decide which block is best to revector to.
967 ///
968 /// Since we can pick an arbitrary destination, we pick the successor with the
969 /// fewest predecessors.  This should reduce the in-degree of the others.
970 static unsigned GetBestDestForJumpOnUndef(BasicBlock *BB) {
971   Instruction *BBTerm = BB->getTerminator();
972   unsigned MinSucc = 0;
973   BasicBlock *TestBB = BBTerm->getSuccessor(MinSucc);
974   // Compute the successor with the minimum number of predecessors.
975   unsigned MinNumPreds = pred_size(TestBB);
976   for (unsigned i = 1, e = BBTerm->getNumSuccessors(); i != e; ++i) {
977     TestBB = BBTerm->getSuccessor(i);
978     unsigned NumPreds = pred_size(TestBB);
979     if (NumPreds < MinNumPreds) {
980       MinSucc = i;
981       MinNumPreds = NumPreds;
982     }
983   }
984 
985   return MinSucc;
986 }
987 
988 static bool hasAddressTakenAndUsed(BasicBlock *BB) {
989   if (!BB->hasAddressTaken()) return false;
990 
991   // If the block has its address taken, it may be a tree of dead constants
992   // hanging off of it.  These shouldn't keep the block alive.
993   BlockAddress *BA = BlockAddress::get(BB);
994   BA->removeDeadConstantUsers();
995   return !BA->use_empty();
996 }
997 
998 /// ProcessBlock - If there are any predecessors whose control can be threaded
999 /// through to a successor, transform them now.
1000 bool JumpThreadingPass::ProcessBlock(BasicBlock *BB) {
1001   // If the block is trivially dead, just return and let the caller nuke it.
1002   // This simplifies other transformations.
1003   if (DTU->isBBPendingDeletion(BB) ||
1004       (pred_empty(BB) && BB != &BB->getParent()->getEntryBlock()))
1005     return false;
1006 
1007   // If this block has a single predecessor, and if that pred has a single
1008   // successor, merge the blocks.  This encourages recursive jump threading
1009   // because now the condition in this block can be threaded through
1010   // predecessors of our predecessor block.
1011   if (MaybeMergeBasicBlockIntoOnlyPred(BB))
1012     return true;
1013 
1014   if (TryToUnfoldSelectInCurrBB(BB))
1015     return true;
1016 
1017   // Look if we can propagate guards to predecessors.
1018   if (HasGuards && ProcessGuards(BB))
1019     return true;
1020 
1021   // What kind of constant we're looking for.
1022   ConstantPreference Preference = WantInteger;
1023 
1024   // Look to see if the terminator is a conditional branch, switch or indirect
1025   // branch, if not we can't thread it.
1026   Value *Condition;
1027   Instruction *Terminator = BB->getTerminator();
1028   if (BranchInst *BI = dyn_cast<BranchInst>(Terminator)) {
1029     // Can't thread an unconditional jump.
1030     if (BI->isUnconditional()) return false;
1031     Condition = BI->getCondition();
1032   } else if (SwitchInst *SI = dyn_cast<SwitchInst>(Terminator)) {
1033     Condition = SI->getCondition();
1034   } else if (IndirectBrInst *IB = dyn_cast<IndirectBrInst>(Terminator)) {
1035     // Can't thread indirect branch with no successors.
1036     if (IB->getNumSuccessors() == 0) return false;
1037     Condition = IB->getAddress()->stripPointerCasts();
1038     Preference = WantBlockAddress;
1039   } else {
1040     return false; // Must be an invoke or callbr.
1041   }
1042 
1043   // Run constant folding to see if we can reduce the condition to a simple
1044   // constant.
1045   if (Instruction *I = dyn_cast<Instruction>(Condition)) {
1046     Value *SimpleVal =
1047         ConstantFoldInstruction(I, BB->getModule()->getDataLayout(), TLI);
1048     if (SimpleVal) {
1049       I->replaceAllUsesWith(SimpleVal);
1050       if (isInstructionTriviallyDead(I, TLI))
1051         I->eraseFromParent();
1052       Condition = SimpleVal;
1053     }
1054   }
1055 
1056   // If the terminator is branching on an undef or freeze undef, we can pick any
1057   // of the successors to branch to.  Let GetBestDestForJumpOnUndef decide.
1058   auto *FI = dyn_cast<FreezeInst>(Condition);
1059   if (isa<UndefValue>(Condition) ||
1060       (FI && isa<UndefValue>(FI->getOperand(0)) && FI->hasOneUse())) {
1061     unsigned BestSucc = GetBestDestForJumpOnUndef(BB);
1062     std::vector<DominatorTree::UpdateType> Updates;
1063 
1064     // Fold the branch/switch.
1065     Instruction *BBTerm = BB->getTerminator();
1066     Updates.reserve(BBTerm->getNumSuccessors());
1067     for (unsigned i = 0, e = BBTerm->getNumSuccessors(); i != e; ++i) {
1068       if (i == BestSucc) continue;
1069       BasicBlock *Succ = BBTerm->getSuccessor(i);
1070       Succ->removePredecessor(BB, true);
1071       Updates.push_back({DominatorTree::Delete, BB, Succ});
1072     }
1073 
1074     LLVM_DEBUG(dbgs() << "  In block '" << BB->getName()
1075                       << "' folding undef terminator: " << *BBTerm << '\n');
1076     BranchInst::Create(BBTerm->getSuccessor(BestSucc), BBTerm);
1077     BBTerm->eraseFromParent();
1078     DTU->applyUpdatesPermissive(Updates);
1079     if (FI)
1080       FI->eraseFromParent();
1081     return true;
1082   }
1083 
1084   // If the terminator of this block is branching on a constant, simplify the
1085   // terminator to an unconditional branch.  This can occur due to threading in
1086   // other blocks.
1087   if (getKnownConstant(Condition, Preference)) {
1088     LLVM_DEBUG(dbgs() << "  In block '" << BB->getName()
1089                       << "' folding terminator: " << *BB->getTerminator()
1090                       << '\n');
1091     ++NumFolds;
1092     ConstantFoldTerminator(BB, true, nullptr, DTU);
1093     return true;
1094   }
1095 
1096   Instruction *CondInst = dyn_cast<Instruction>(Condition);
1097 
1098   // All the rest of our checks depend on the condition being an instruction.
1099   if (!CondInst) {
1100     // FIXME: Unify this with code below.
1101     if (ProcessThreadableEdges(Condition, BB, Preference, Terminator))
1102       return true;
1103     return false;
1104   }
1105 
1106   if (CmpInst *CondCmp = dyn_cast<CmpInst>(CondInst)) {
1107     // If we're branching on a conditional, LVI might be able to determine
1108     // it's value at the branch instruction.  We only handle comparisons
1109     // against a constant at this time.
1110     // TODO: This should be extended to handle switches as well.
1111     BranchInst *CondBr = dyn_cast<BranchInst>(BB->getTerminator());
1112     Constant *CondConst = dyn_cast<Constant>(CondCmp->getOperand(1));
1113     if (CondBr && CondConst) {
1114       // We should have returned as soon as we turn a conditional branch to
1115       // unconditional. Because its no longer interesting as far as jump
1116       // threading is concerned.
1117       assert(CondBr->isConditional() && "Threading on unconditional terminator");
1118 
1119       LazyValueInfo::Tristate Ret =
1120         LVI->getPredicateAt(CondCmp->getPredicate(), CondCmp->getOperand(0),
1121                             CondConst, CondBr);
1122       if (Ret != LazyValueInfo::Unknown) {
1123         unsigned ToRemove = Ret == LazyValueInfo::True ? 1 : 0;
1124         unsigned ToKeep = Ret == LazyValueInfo::True ? 0 : 1;
1125         BasicBlock *ToRemoveSucc = CondBr->getSuccessor(ToRemove);
1126         ToRemoveSucc->removePredecessor(BB, true);
1127         BranchInst *UncondBr =
1128           BranchInst::Create(CondBr->getSuccessor(ToKeep), CondBr);
1129         UncondBr->setDebugLoc(CondBr->getDebugLoc());
1130         CondBr->eraseFromParent();
1131         if (CondCmp->use_empty())
1132           CondCmp->eraseFromParent();
1133         // We can safely replace *some* uses of the CondInst if it has
1134         // exactly one value as returned by LVI. RAUW is incorrect in the
1135         // presence of guards and assumes, that have the `Cond` as the use. This
1136         // is because we use the guards/assume to reason about the `Cond` value
1137         // at the end of block, but RAUW unconditionally replaces all uses
1138         // including the guards/assumes themselves and the uses before the
1139         // guard/assume.
1140         else if (CondCmp->getParent() == BB) {
1141           auto *CI = Ret == LazyValueInfo::True ?
1142             ConstantInt::getTrue(CondCmp->getType()) :
1143             ConstantInt::getFalse(CondCmp->getType());
1144           ReplaceFoldableUses(CondCmp, CI);
1145         }
1146         DTU->applyUpdatesPermissive(
1147             {{DominatorTree::Delete, BB, ToRemoveSucc}});
1148         return true;
1149       }
1150 
1151       // We did not manage to simplify this branch, try to see whether
1152       // CondCmp depends on a known phi-select pattern.
1153       if (TryToUnfoldSelect(CondCmp, BB))
1154         return true;
1155     }
1156   }
1157 
1158   if (SwitchInst *SI = dyn_cast<SwitchInst>(BB->getTerminator()))
1159     if (TryToUnfoldSelect(SI, BB))
1160       return true;
1161 
1162   // Check for some cases that are worth simplifying.  Right now we want to look
1163   // for loads that are used by a switch or by the condition for the branch.  If
1164   // we see one, check to see if it's partially redundant.  If so, insert a PHI
1165   // which can then be used to thread the values.
1166   Value *SimplifyValue = CondInst;
1167 
1168   if (auto *FI = dyn_cast<FreezeInst>(SimplifyValue))
1169     // Look into freeze's operand
1170     SimplifyValue = FI->getOperand(0);
1171 
1172   if (CmpInst *CondCmp = dyn_cast<CmpInst>(SimplifyValue))
1173     if (isa<Constant>(CondCmp->getOperand(1)))
1174       SimplifyValue = CondCmp->getOperand(0);
1175 
1176   // TODO: There are other places where load PRE would be profitable, such as
1177   // more complex comparisons.
1178   if (LoadInst *LoadI = dyn_cast<LoadInst>(SimplifyValue))
1179     if (SimplifyPartiallyRedundantLoad(LoadI))
1180       return true;
1181 
1182   // Before threading, try to propagate profile data backwards:
1183   if (PHINode *PN = dyn_cast<PHINode>(CondInst))
1184     if (PN->getParent() == BB && isa<BranchInst>(BB->getTerminator()))
1185       updatePredecessorProfileMetadata(PN, BB);
1186 
1187   // Handle a variety of cases where we are branching on something derived from
1188   // a PHI node in the current block.  If we can prove that any predecessors
1189   // compute a predictable value based on a PHI node, thread those predecessors.
1190   if (ProcessThreadableEdges(CondInst, BB, Preference, Terminator))
1191     return true;
1192 
1193   // If this is an otherwise-unfoldable branch on a phi node or freeze(phi) in
1194   // the current block, see if we can simplify.
1195   PHINode *PN = dyn_cast<PHINode>(
1196       isa<FreezeInst>(CondInst) ? cast<FreezeInst>(CondInst)->getOperand(0)
1197                                 : CondInst);
1198 
1199   if (PN && PN->getParent() == BB && isa<BranchInst>(BB->getTerminator()))
1200     return ProcessBranchOnPHI(PN);
1201 
1202   // If this is an otherwise-unfoldable branch on a XOR, see if we can simplify.
1203   if (CondInst->getOpcode() == Instruction::Xor &&
1204       CondInst->getParent() == BB && isa<BranchInst>(BB->getTerminator()))
1205     return ProcessBranchOnXOR(cast<BinaryOperator>(CondInst));
1206 
1207   // Search for a stronger dominating condition that can be used to simplify a
1208   // conditional branch leaving BB.
1209   if (ProcessImpliedCondition(BB))
1210     return true;
1211 
1212   return false;
1213 }
1214 
1215 bool JumpThreadingPass::ProcessImpliedCondition(BasicBlock *BB) {
1216   auto *BI = dyn_cast<BranchInst>(BB->getTerminator());
1217   if (!BI || !BI->isConditional())
1218     return false;
1219 
1220   Value *Cond = BI->getCondition();
1221   BasicBlock *CurrentBB = BB;
1222   BasicBlock *CurrentPred = BB->getSinglePredecessor();
1223   unsigned Iter = 0;
1224 
1225   auto &DL = BB->getModule()->getDataLayout();
1226 
1227   while (CurrentPred && Iter++ < ImplicationSearchThreshold) {
1228     auto *PBI = dyn_cast<BranchInst>(CurrentPred->getTerminator());
1229     if (!PBI || !PBI->isConditional())
1230       return false;
1231     if (PBI->getSuccessor(0) != CurrentBB && PBI->getSuccessor(1) != CurrentBB)
1232       return false;
1233 
1234     bool CondIsTrue = PBI->getSuccessor(0) == CurrentBB;
1235     Optional<bool> Implication =
1236         isImpliedCondition(PBI->getCondition(), Cond, DL, CondIsTrue);
1237     if (Implication) {
1238       BasicBlock *KeepSucc = BI->getSuccessor(*Implication ? 0 : 1);
1239       BasicBlock *RemoveSucc = BI->getSuccessor(*Implication ? 1 : 0);
1240       RemoveSucc->removePredecessor(BB);
1241       BranchInst *UncondBI = BranchInst::Create(KeepSucc, BI);
1242       UncondBI->setDebugLoc(BI->getDebugLoc());
1243       BI->eraseFromParent();
1244       DTU->applyUpdatesPermissive({{DominatorTree::Delete, BB, RemoveSucc}});
1245       return true;
1246     }
1247     CurrentBB = CurrentPred;
1248     CurrentPred = CurrentBB->getSinglePredecessor();
1249   }
1250 
1251   return false;
1252 }
1253 
1254 /// Return true if Op is an instruction defined in the given block.
1255 static bool isOpDefinedInBlock(Value *Op, BasicBlock *BB) {
1256   if (Instruction *OpInst = dyn_cast<Instruction>(Op))
1257     if (OpInst->getParent() == BB)
1258       return true;
1259   return false;
1260 }
1261 
1262 /// SimplifyPartiallyRedundantLoad - If LoadI is an obviously partially
1263 /// redundant load instruction, eliminate it by replacing it with a PHI node.
1264 /// This is an important optimization that encourages jump threading, and needs
1265 /// to be run interlaced with other jump threading tasks.
1266 bool JumpThreadingPass::SimplifyPartiallyRedundantLoad(LoadInst *LoadI) {
1267   // Don't hack volatile and ordered loads.
1268   if (!LoadI->isUnordered()) return false;
1269 
1270   // If the load is defined in a block with exactly one predecessor, it can't be
1271   // partially redundant.
1272   BasicBlock *LoadBB = LoadI->getParent();
1273   if (LoadBB->getSinglePredecessor())
1274     return false;
1275 
1276   // If the load is defined in an EH pad, it can't be partially redundant,
1277   // because the edges between the invoke and the EH pad cannot have other
1278   // instructions between them.
1279   if (LoadBB->isEHPad())
1280     return false;
1281 
1282   Value *LoadedPtr = LoadI->getOperand(0);
1283 
1284   // If the loaded operand is defined in the LoadBB and its not a phi,
1285   // it can't be available in predecessors.
1286   if (isOpDefinedInBlock(LoadedPtr, LoadBB) && !isa<PHINode>(LoadedPtr))
1287     return false;
1288 
1289   // Scan a few instructions up from the load, to see if it is obviously live at
1290   // the entry to its block.
1291   BasicBlock::iterator BBIt(LoadI);
1292   bool IsLoadCSE;
1293   if (Value *AvailableVal = FindAvailableLoadedValue(
1294           LoadI, LoadBB, BBIt, DefMaxInstsToScan, AA, &IsLoadCSE)) {
1295     // If the value of the load is locally available within the block, just use
1296     // it.  This frequently occurs for reg2mem'd allocas.
1297 
1298     if (IsLoadCSE) {
1299       LoadInst *NLoadI = cast<LoadInst>(AvailableVal);
1300       combineMetadataForCSE(NLoadI, LoadI, false);
1301     };
1302 
1303     // If the returned value is the load itself, replace with an undef. This can
1304     // only happen in dead loops.
1305     if (AvailableVal == LoadI)
1306       AvailableVal = UndefValue::get(LoadI->getType());
1307     if (AvailableVal->getType() != LoadI->getType())
1308       AvailableVal = CastInst::CreateBitOrPointerCast(
1309           AvailableVal, LoadI->getType(), "", LoadI);
1310     LoadI->replaceAllUsesWith(AvailableVal);
1311     LoadI->eraseFromParent();
1312     return true;
1313   }
1314 
1315   // Otherwise, if we scanned the whole block and got to the top of the block,
1316   // we know the block is locally transparent to the load.  If not, something
1317   // might clobber its value.
1318   if (BBIt != LoadBB->begin())
1319     return false;
1320 
1321   // If all of the loads and stores that feed the value have the same AA tags,
1322   // then we can propagate them onto any newly inserted loads.
1323   AAMDNodes AATags;
1324   LoadI->getAAMetadata(AATags);
1325 
1326   SmallPtrSet<BasicBlock*, 8> PredsScanned;
1327 
1328   using AvailablePredsTy = SmallVector<std::pair<BasicBlock *, Value *>, 8>;
1329 
1330   AvailablePredsTy AvailablePreds;
1331   BasicBlock *OneUnavailablePred = nullptr;
1332   SmallVector<LoadInst*, 8> CSELoads;
1333 
1334   // If we got here, the loaded value is transparent through to the start of the
1335   // block.  Check to see if it is available in any of the predecessor blocks.
1336   for (BasicBlock *PredBB : predecessors(LoadBB)) {
1337     // If we already scanned this predecessor, skip it.
1338     if (!PredsScanned.insert(PredBB).second)
1339       continue;
1340 
1341     BBIt = PredBB->end();
1342     unsigned NumScanedInst = 0;
1343     Value *PredAvailable = nullptr;
1344     // NOTE: We don't CSE load that is volatile or anything stronger than
1345     // unordered, that should have been checked when we entered the function.
1346     assert(LoadI->isUnordered() &&
1347            "Attempting to CSE volatile or atomic loads");
1348     // If this is a load on a phi pointer, phi-translate it and search
1349     // for available load/store to the pointer in predecessors.
1350     Value *Ptr = LoadedPtr->DoPHITranslation(LoadBB, PredBB);
1351     PredAvailable = FindAvailablePtrLoadStore(
1352         Ptr, LoadI->getType(), LoadI->isAtomic(), PredBB, BBIt,
1353         DefMaxInstsToScan, AA, &IsLoadCSE, &NumScanedInst);
1354 
1355     // If PredBB has a single predecessor, continue scanning through the
1356     // single predecessor.
1357     BasicBlock *SinglePredBB = PredBB;
1358     while (!PredAvailable && SinglePredBB && BBIt == SinglePredBB->begin() &&
1359            NumScanedInst < DefMaxInstsToScan) {
1360       SinglePredBB = SinglePredBB->getSinglePredecessor();
1361       if (SinglePredBB) {
1362         BBIt = SinglePredBB->end();
1363         PredAvailable = FindAvailablePtrLoadStore(
1364             Ptr, LoadI->getType(), LoadI->isAtomic(), SinglePredBB, BBIt,
1365             (DefMaxInstsToScan - NumScanedInst), AA, &IsLoadCSE,
1366             &NumScanedInst);
1367       }
1368     }
1369 
1370     if (!PredAvailable) {
1371       OneUnavailablePred = PredBB;
1372       continue;
1373     }
1374 
1375     if (IsLoadCSE)
1376       CSELoads.push_back(cast<LoadInst>(PredAvailable));
1377 
1378     // If so, this load is partially redundant.  Remember this info so that we
1379     // can create a PHI node.
1380     AvailablePreds.emplace_back(PredBB, PredAvailable);
1381   }
1382 
1383   // If the loaded value isn't available in any predecessor, it isn't partially
1384   // redundant.
1385   if (AvailablePreds.empty()) return false;
1386 
1387   // Okay, the loaded value is available in at least one (and maybe all!)
1388   // predecessors.  If the value is unavailable in more than one unique
1389   // predecessor, we want to insert a merge block for those common predecessors.
1390   // This ensures that we only have to insert one reload, thus not increasing
1391   // code size.
1392   BasicBlock *UnavailablePred = nullptr;
1393 
1394   // If the value is unavailable in one of predecessors, we will end up
1395   // inserting a new instruction into them. It is only valid if all the
1396   // instructions before LoadI are guaranteed to pass execution to its
1397   // successor, or if LoadI is safe to speculate.
1398   // TODO: If this logic becomes more complex, and we will perform PRE insertion
1399   // farther than to a predecessor, we need to reuse the code from GVN's PRE.
1400   // It requires domination tree analysis, so for this simple case it is an
1401   // overkill.
1402   if (PredsScanned.size() != AvailablePreds.size() &&
1403       !isSafeToSpeculativelyExecute(LoadI))
1404     for (auto I = LoadBB->begin(); &*I != LoadI; ++I)
1405       if (!isGuaranteedToTransferExecutionToSuccessor(&*I))
1406         return false;
1407 
1408   // If there is exactly one predecessor where the value is unavailable, the
1409   // already computed 'OneUnavailablePred' block is it.  If it ends in an
1410   // unconditional branch, we know that it isn't a critical edge.
1411   if (PredsScanned.size() == AvailablePreds.size()+1 &&
1412       OneUnavailablePred->getTerminator()->getNumSuccessors() == 1) {
1413     UnavailablePred = OneUnavailablePred;
1414   } else if (PredsScanned.size() != AvailablePreds.size()) {
1415     // Otherwise, we had multiple unavailable predecessors or we had a critical
1416     // edge from the one.
1417     SmallVector<BasicBlock*, 8> PredsToSplit;
1418     SmallPtrSet<BasicBlock*, 8> AvailablePredSet;
1419 
1420     for (const auto &AvailablePred : AvailablePreds)
1421       AvailablePredSet.insert(AvailablePred.first);
1422 
1423     // Add all the unavailable predecessors to the PredsToSplit list.
1424     for (BasicBlock *P : predecessors(LoadBB)) {
1425       // If the predecessor is an indirect goto, we can't split the edge.
1426       // Same for CallBr.
1427       if (isa<IndirectBrInst>(P->getTerminator()) ||
1428           isa<CallBrInst>(P->getTerminator()))
1429         return false;
1430 
1431       if (!AvailablePredSet.count(P))
1432         PredsToSplit.push_back(P);
1433     }
1434 
1435     // Split them out to their own block.
1436     UnavailablePred = SplitBlockPreds(LoadBB, PredsToSplit, "thread-pre-split");
1437   }
1438 
1439   // If the value isn't available in all predecessors, then there will be
1440   // exactly one where it isn't available.  Insert a load on that edge and add
1441   // it to the AvailablePreds list.
1442   if (UnavailablePred) {
1443     assert(UnavailablePred->getTerminator()->getNumSuccessors() == 1 &&
1444            "Can't handle critical edge here!");
1445     LoadInst *NewVal = new LoadInst(
1446         LoadI->getType(), LoadedPtr->DoPHITranslation(LoadBB, UnavailablePred),
1447         LoadI->getName() + ".pr", false, LoadI->getAlign(),
1448         LoadI->getOrdering(), LoadI->getSyncScopeID(),
1449         UnavailablePred->getTerminator());
1450     NewVal->setDebugLoc(LoadI->getDebugLoc());
1451     if (AATags)
1452       NewVal->setAAMetadata(AATags);
1453 
1454     AvailablePreds.emplace_back(UnavailablePred, NewVal);
1455   }
1456 
1457   // Now we know that each predecessor of this block has a value in
1458   // AvailablePreds, sort them for efficient access as we're walking the preds.
1459   array_pod_sort(AvailablePreds.begin(), AvailablePreds.end());
1460 
1461   // Create a PHI node at the start of the block for the PRE'd load value.
1462   pred_iterator PB = pred_begin(LoadBB), PE = pred_end(LoadBB);
1463   PHINode *PN = PHINode::Create(LoadI->getType(), std::distance(PB, PE), "",
1464                                 &LoadBB->front());
1465   PN->takeName(LoadI);
1466   PN->setDebugLoc(LoadI->getDebugLoc());
1467 
1468   // Insert new entries into the PHI for each predecessor.  A single block may
1469   // have multiple entries here.
1470   for (pred_iterator PI = PB; PI != PE; ++PI) {
1471     BasicBlock *P = *PI;
1472     AvailablePredsTy::iterator I =
1473         llvm::lower_bound(AvailablePreds, std::make_pair(P, (Value *)nullptr));
1474 
1475     assert(I != AvailablePreds.end() && I->first == P &&
1476            "Didn't find entry for predecessor!");
1477 
1478     // If we have an available predecessor but it requires casting, insert the
1479     // cast in the predecessor and use the cast. Note that we have to update the
1480     // AvailablePreds vector as we go so that all of the PHI entries for this
1481     // predecessor use the same bitcast.
1482     Value *&PredV = I->second;
1483     if (PredV->getType() != LoadI->getType())
1484       PredV = CastInst::CreateBitOrPointerCast(PredV, LoadI->getType(), "",
1485                                                P->getTerminator());
1486 
1487     PN->addIncoming(PredV, I->first);
1488   }
1489 
1490   for (LoadInst *PredLoadI : CSELoads) {
1491     combineMetadataForCSE(PredLoadI, LoadI, true);
1492   }
1493 
1494   LoadI->replaceAllUsesWith(PN);
1495   LoadI->eraseFromParent();
1496 
1497   return true;
1498 }
1499 
1500 /// FindMostPopularDest - The specified list contains multiple possible
1501 /// threadable destinations.  Pick the one that occurs the most frequently in
1502 /// the list.
1503 static BasicBlock *
1504 FindMostPopularDest(BasicBlock *BB,
1505                     const SmallVectorImpl<std::pair<BasicBlock *,
1506                                           BasicBlock *>> &PredToDestList) {
1507   assert(!PredToDestList.empty());
1508 
1509   // Determine popularity.  If there are multiple possible destinations, we
1510   // explicitly choose to ignore 'undef' destinations.  We prefer to thread
1511   // blocks with known and real destinations to threading undef.  We'll handle
1512   // them later if interesting.
1513   MapVector<BasicBlock *, unsigned> DestPopularity;
1514 
1515   // Populate DestPopularity with the successors in the order they appear in the
1516   // successor list.  This way, we ensure determinism by iterating it in the
1517   // same order in std::max_element below.  We map nullptr to 0 so that we can
1518   // return nullptr when PredToDestList contains nullptr only.
1519   DestPopularity[nullptr] = 0;
1520   for (auto *SuccBB : successors(BB))
1521     DestPopularity[SuccBB] = 0;
1522 
1523   for (const auto &PredToDest : PredToDestList)
1524     if (PredToDest.second)
1525       DestPopularity[PredToDest.second]++;
1526 
1527   // Find the most popular dest.
1528   using VT = decltype(DestPopularity)::value_type;
1529   auto MostPopular = std::max_element(
1530       DestPopularity.begin(), DestPopularity.end(),
1531       [](const VT &L, const VT &R) { return L.second < R.second; });
1532 
1533   // Okay, we have finally picked the most popular destination.
1534   return MostPopular->first;
1535 }
1536 
1537 // Try to evaluate the value of V when the control flows from PredPredBB to
1538 // BB->getSinglePredecessor() and then on to BB.
1539 Constant *JumpThreadingPass::EvaluateOnPredecessorEdge(BasicBlock *BB,
1540                                                        BasicBlock *PredPredBB,
1541                                                        Value *V) {
1542   BasicBlock *PredBB = BB->getSinglePredecessor();
1543   assert(PredBB && "Expected a single predecessor");
1544 
1545   if (Constant *Cst = dyn_cast<Constant>(V)) {
1546     return Cst;
1547   }
1548 
1549   // Consult LVI if V is not an instruction in BB or PredBB.
1550   Instruction *I = dyn_cast<Instruction>(V);
1551   if (!I || (I->getParent() != BB && I->getParent() != PredBB)) {
1552     return LVI->getConstantOnEdge(V, PredPredBB, PredBB, nullptr);
1553   }
1554 
1555   // Look into a PHI argument.
1556   if (PHINode *PHI = dyn_cast<PHINode>(V)) {
1557     if (PHI->getParent() == PredBB)
1558       return dyn_cast<Constant>(PHI->getIncomingValueForBlock(PredPredBB));
1559     return nullptr;
1560   }
1561 
1562   // If we have a CmpInst, try to fold it for each incoming edge into PredBB.
1563   if (CmpInst *CondCmp = dyn_cast<CmpInst>(V)) {
1564     if (CondCmp->getParent() == BB) {
1565       Constant *Op0 =
1566           EvaluateOnPredecessorEdge(BB, PredPredBB, CondCmp->getOperand(0));
1567       Constant *Op1 =
1568           EvaluateOnPredecessorEdge(BB, PredPredBB, CondCmp->getOperand(1));
1569       if (Op0 && Op1) {
1570         return ConstantExpr::getCompare(CondCmp->getPredicate(), Op0, Op1);
1571       }
1572     }
1573     return nullptr;
1574   }
1575 
1576   return nullptr;
1577 }
1578 
1579 bool JumpThreadingPass::ProcessThreadableEdges(Value *Cond, BasicBlock *BB,
1580                                                ConstantPreference Preference,
1581                                                Instruction *CxtI) {
1582   // If threading this would thread across a loop header, don't even try to
1583   // thread the edge.
1584   if (LoopHeaders.count(BB))
1585     return false;
1586 
1587   PredValueInfoTy PredValues;
1588   if (!ComputeValueKnownInPredecessors(Cond, BB, PredValues, Preference,
1589                                        CxtI)) {
1590     // We don't have known values in predecessors.  See if we can thread through
1591     // BB and its sole predecessor.
1592     return MaybeThreadThroughTwoBasicBlocks(BB, Cond);
1593   }
1594 
1595   assert(!PredValues.empty() &&
1596          "ComputeValueKnownInPredecessors returned true with no values");
1597 
1598   LLVM_DEBUG(dbgs() << "IN BB: " << *BB;
1599              for (const auto &PredValue : PredValues) {
1600                dbgs() << "  BB '" << BB->getName()
1601                       << "': FOUND condition = " << *PredValue.first
1602                       << " for pred '" << PredValue.second->getName() << "'.\n";
1603   });
1604 
1605   // Decide what we want to thread through.  Convert our list of known values to
1606   // a list of known destinations for each pred.  This also discards duplicate
1607   // predecessors and keeps track of the undefined inputs (which are represented
1608   // as a null dest in the PredToDestList).
1609   SmallPtrSet<BasicBlock*, 16> SeenPreds;
1610   SmallVector<std::pair<BasicBlock*, BasicBlock*>, 16> PredToDestList;
1611 
1612   BasicBlock *OnlyDest = nullptr;
1613   BasicBlock *MultipleDestSentinel = (BasicBlock*)(intptr_t)~0ULL;
1614   Constant *OnlyVal = nullptr;
1615   Constant *MultipleVal = (Constant *)(intptr_t)~0ULL;
1616 
1617   for (const auto &PredValue : PredValues) {
1618     BasicBlock *Pred = PredValue.second;
1619     if (!SeenPreds.insert(Pred).second)
1620       continue;  // Duplicate predecessor entry.
1621 
1622     Constant *Val = PredValue.first;
1623 
1624     BasicBlock *DestBB;
1625     if (isa<UndefValue>(Val))
1626       DestBB = nullptr;
1627     else if (BranchInst *BI = dyn_cast<BranchInst>(BB->getTerminator())) {
1628       assert(isa<ConstantInt>(Val) && "Expecting a constant integer");
1629       DestBB = BI->getSuccessor(cast<ConstantInt>(Val)->isZero());
1630     } else if (SwitchInst *SI = dyn_cast<SwitchInst>(BB->getTerminator())) {
1631       assert(isa<ConstantInt>(Val) && "Expecting a constant integer");
1632       DestBB = SI->findCaseValue(cast<ConstantInt>(Val))->getCaseSuccessor();
1633     } else {
1634       assert(isa<IndirectBrInst>(BB->getTerminator())
1635               && "Unexpected terminator");
1636       assert(isa<BlockAddress>(Val) && "Expecting a constant blockaddress");
1637       DestBB = cast<BlockAddress>(Val)->getBasicBlock();
1638     }
1639 
1640     // If we have exactly one destination, remember it for efficiency below.
1641     if (PredToDestList.empty()) {
1642       OnlyDest = DestBB;
1643       OnlyVal = Val;
1644     } else {
1645       if (OnlyDest != DestBB)
1646         OnlyDest = MultipleDestSentinel;
1647       // It possible we have same destination, but different value, e.g. default
1648       // case in switchinst.
1649       if (Val != OnlyVal)
1650         OnlyVal = MultipleVal;
1651     }
1652 
1653     // If the predecessor ends with an indirect goto, we can't change its
1654     // destination. Same for CallBr.
1655     if (isa<IndirectBrInst>(Pred->getTerminator()) ||
1656         isa<CallBrInst>(Pred->getTerminator()))
1657       continue;
1658 
1659     PredToDestList.emplace_back(Pred, DestBB);
1660   }
1661 
1662   // If all edges were unthreadable, we fail.
1663   if (PredToDestList.empty())
1664     return false;
1665 
1666   // If all the predecessors go to a single known successor, we want to fold,
1667   // not thread. By doing so, we do not need to duplicate the current block and
1668   // also miss potential opportunities in case we dont/cant duplicate.
1669   if (OnlyDest && OnlyDest != MultipleDestSentinel) {
1670     if (BB->hasNPredecessors(PredToDestList.size())) {
1671       bool SeenFirstBranchToOnlyDest = false;
1672       std::vector <DominatorTree::UpdateType> Updates;
1673       Updates.reserve(BB->getTerminator()->getNumSuccessors() - 1);
1674       for (BasicBlock *SuccBB : successors(BB)) {
1675         if (SuccBB == OnlyDest && !SeenFirstBranchToOnlyDest) {
1676           SeenFirstBranchToOnlyDest = true; // Don't modify the first branch.
1677         } else {
1678           SuccBB->removePredecessor(BB, true); // This is unreachable successor.
1679           Updates.push_back({DominatorTree::Delete, BB, SuccBB});
1680         }
1681       }
1682 
1683       // Finally update the terminator.
1684       Instruction *Term = BB->getTerminator();
1685       BranchInst::Create(OnlyDest, Term);
1686       Term->eraseFromParent();
1687       DTU->applyUpdatesPermissive(Updates);
1688 
1689       // If the condition is now dead due to the removal of the old terminator,
1690       // erase it.
1691       if (auto *CondInst = dyn_cast<Instruction>(Cond)) {
1692         if (CondInst->use_empty() && !CondInst->mayHaveSideEffects())
1693           CondInst->eraseFromParent();
1694         // We can safely replace *some* uses of the CondInst if it has
1695         // exactly one value as returned by LVI. RAUW is incorrect in the
1696         // presence of guards and assumes, that have the `Cond` as the use. This
1697         // is because we use the guards/assume to reason about the `Cond` value
1698         // at the end of block, but RAUW unconditionally replaces all uses
1699         // including the guards/assumes themselves and the uses before the
1700         // guard/assume.
1701         else if (OnlyVal && OnlyVal != MultipleVal &&
1702                  CondInst->getParent() == BB)
1703           ReplaceFoldableUses(CondInst, OnlyVal);
1704       }
1705       return true;
1706     }
1707   }
1708 
1709   // Determine which is the most common successor.  If we have many inputs and
1710   // this block is a switch, we want to start by threading the batch that goes
1711   // to the most popular destination first.  If we only know about one
1712   // threadable destination (the common case) we can avoid this.
1713   BasicBlock *MostPopularDest = OnlyDest;
1714 
1715   if (MostPopularDest == MultipleDestSentinel) {
1716     // Remove any loop headers from the Dest list, ThreadEdge conservatively
1717     // won't process them, but we might have other destination that are eligible
1718     // and we still want to process.
1719     erase_if(PredToDestList,
1720              [&](const std::pair<BasicBlock *, BasicBlock *> &PredToDest) {
1721                return LoopHeaders.count(PredToDest.second) != 0;
1722              });
1723 
1724     if (PredToDestList.empty())
1725       return false;
1726 
1727     MostPopularDest = FindMostPopularDest(BB, PredToDestList);
1728   }
1729 
1730   // Now that we know what the most popular destination is, factor all
1731   // predecessors that will jump to it into a single predecessor.
1732   SmallVector<BasicBlock*, 16> PredsToFactor;
1733   for (const auto &PredToDest : PredToDestList)
1734     if (PredToDest.second == MostPopularDest) {
1735       BasicBlock *Pred = PredToDest.first;
1736 
1737       // This predecessor may be a switch or something else that has multiple
1738       // edges to the block.  Factor each of these edges by listing them
1739       // according to # occurrences in PredsToFactor.
1740       for (BasicBlock *Succ : successors(Pred))
1741         if (Succ == BB)
1742           PredsToFactor.push_back(Pred);
1743     }
1744 
1745   // If the threadable edges are branching on an undefined value, we get to pick
1746   // the destination that these predecessors should get to.
1747   if (!MostPopularDest)
1748     MostPopularDest = BB->getTerminator()->
1749                             getSuccessor(GetBestDestForJumpOnUndef(BB));
1750 
1751   // Ok, try to thread it!
1752   return TryThreadEdge(BB, PredsToFactor, MostPopularDest);
1753 }
1754 
1755 /// ProcessBranchOnPHI - We have an otherwise unthreadable conditional branch on
1756 /// a PHI node (or freeze PHI) in the current block.  See if there are any
1757 /// simplifications we can do based on inputs to the phi node.
1758 bool JumpThreadingPass::ProcessBranchOnPHI(PHINode *PN) {
1759   BasicBlock *BB = PN->getParent();
1760 
1761   // TODO: We could make use of this to do it once for blocks with common PHI
1762   // values.
1763   SmallVector<BasicBlock*, 1> PredBBs;
1764   PredBBs.resize(1);
1765 
1766   // If any of the predecessor blocks end in an unconditional branch, we can
1767   // *duplicate* the conditional branch into that block in order to further
1768   // encourage jump threading and to eliminate cases where we have branch on a
1769   // phi of an icmp (branch on icmp is much better).
1770   // This is still beneficial when a frozen phi is used as the branch condition
1771   // because it allows CodeGenPrepare to further canonicalize br(freeze(icmp))
1772   // to br(icmp(freeze ...)).
1773   for (unsigned i = 0, e = PN->getNumIncomingValues(); i != e; ++i) {
1774     BasicBlock *PredBB = PN->getIncomingBlock(i);
1775     if (BranchInst *PredBr = dyn_cast<BranchInst>(PredBB->getTerminator()))
1776       if (PredBr->isUnconditional()) {
1777         PredBBs[0] = PredBB;
1778         // Try to duplicate BB into PredBB.
1779         if (DuplicateCondBranchOnPHIIntoPred(BB, PredBBs))
1780           return true;
1781       }
1782   }
1783 
1784   return false;
1785 }
1786 
1787 /// ProcessBranchOnXOR - We have an otherwise unthreadable conditional branch on
1788 /// a xor instruction in the current block.  See if there are any
1789 /// simplifications we can do based on inputs to the xor.
1790 bool JumpThreadingPass::ProcessBranchOnXOR(BinaryOperator *BO) {
1791   BasicBlock *BB = BO->getParent();
1792 
1793   // If either the LHS or RHS of the xor is a constant, don't do this
1794   // optimization.
1795   if (isa<ConstantInt>(BO->getOperand(0)) ||
1796       isa<ConstantInt>(BO->getOperand(1)))
1797     return false;
1798 
1799   // If the first instruction in BB isn't a phi, we won't be able to infer
1800   // anything special about any particular predecessor.
1801   if (!isa<PHINode>(BB->front()))
1802     return false;
1803 
1804   // If this BB is a landing pad, we won't be able to split the edge into it.
1805   if (BB->isEHPad())
1806     return false;
1807 
1808   // If we have a xor as the branch input to this block, and we know that the
1809   // LHS or RHS of the xor in any predecessor is true/false, then we can clone
1810   // the condition into the predecessor and fix that value to true, saving some
1811   // logical ops on that path and encouraging other paths to simplify.
1812   //
1813   // This copies something like this:
1814   //
1815   //  BB:
1816   //    %X = phi i1 [1],  [%X']
1817   //    %Y = icmp eq i32 %A, %B
1818   //    %Z = xor i1 %X, %Y
1819   //    br i1 %Z, ...
1820   //
1821   // Into:
1822   //  BB':
1823   //    %Y = icmp ne i32 %A, %B
1824   //    br i1 %Y, ...
1825 
1826   PredValueInfoTy XorOpValues;
1827   bool isLHS = true;
1828   if (!ComputeValueKnownInPredecessors(BO->getOperand(0), BB, XorOpValues,
1829                                        WantInteger, BO)) {
1830     assert(XorOpValues.empty());
1831     if (!ComputeValueKnownInPredecessors(BO->getOperand(1), BB, XorOpValues,
1832                                          WantInteger, BO))
1833       return false;
1834     isLHS = false;
1835   }
1836 
1837   assert(!XorOpValues.empty() &&
1838          "ComputeValueKnownInPredecessors returned true with no values");
1839 
1840   // Scan the information to see which is most popular: true or false.  The
1841   // predecessors can be of the set true, false, or undef.
1842   unsigned NumTrue = 0, NumFalse = 0;
1843   for (const auto &XorOpValue : XorOpValues) {
1844     if (isa<UndefValue>(XorOpValue.first))
1845       // Ignore undefs for the count.
1846       continue;
1847     if (cast<ConstantInt>(XorOpValue.first)->isZero())
1848       ++NumFalse;
1849     else
1850       ++NumTrue;
1851   }
1852 
1853   // Determine which value to split on, true, false, or undef if neither.
1854   ConstantInt *SplitVal = nullptr;
1855   if (NumTrue > NumFalse)
1856     SplitVal = ConstantInt::getTrue(BB->getContext());
1857   else if (NumTrue != 0 || NumFalse != 0)
1858     SplitVal = ConstantInt::getFalse(BB->getContext());
1859 
1860   // Collect all of the blocks that this can be folded into so that we can
1861   // factor this once and clone it once.
1862   SmallVector<BasicBlock*, 8> BlocksToFoldInto;
1863   for (const auto &XorOpValue : XorOpValues) {
1864     if (XorOpValue.first != SplitVal && !isa<UndefValue>(XorOpValue.first))
1865       continue;
1866 
1867     BlocksToFoldInto.push_back(XorOpValue.second);
1868   }
1869 
1870   // If we inferred a value for all of the predecessors, then duplication won't
1871   // help us.  However, we can just replace the LHS or RHS with the constant.
1872   if (BlocksToFoldInto.size() ==
1873       cast<PHINode>(BB->front()).getNumIncomingValues()) {
1874     if (!SplitVal) {
1875       // If all preds provide undef, just nuke the xor, because it is undef too.
1876       BO->replaceAllUsesWith(UndefValue::get(BO->getType()));
1877       BO->eraseFromParent();
1878     } else if (SplitVal->isZero()) {
1879       // If all preds provide 0, replace the xor with the other input.
1880       BO->replaceAllUsesWith(BO->getOperand(isLHS));
1881       BO->eraseFromParent();
1882     } else {
1883       // If all preds provide 1, set the computed value to 1.
1884       BO->setOperand(!isLHS, SplitVal);
1885     }
1886 
1887     return true;
1888   }
1889 
1890   // If any of predecessors end with an indirect goto, we can't change its
1891   // destination. Same for CallBr.
1892   if (any_of(BlocksToFoldInto, [](BasicBlock *Pred) {
1893         return isa<IndirectBrInst>(Pred->getTerminator()) ||
1894                isa<CallBrInst>(Pred->getTerminator());
1895       }))
1896     return false;
1897 
1898   // Try to duplicate BB into PredBB.
1899   return DuplicateCondBranchOnPHIIntoPred(BB, BlocksToFoldInto);
1900 }
1901 
1902 /// AddPHINodeEntriesForMappedBlock - We're adding 'NewPred' as a new
1903 /// predecessor to the PHIBB block.  If it has PHI nodes, add entries for
1904 /// NewPred using the entries from OldPred (suitably mapped).
1905 static void AddPHINodeEntriesForMappedBlock(BasicBlock *PHIBB,
1906                                             BasicBlock *OldPred,
1907                                             BasicBlock *NewPred,
1908                                      DenseMap<Instruction*, Value*> &ValueMap) {
1909   for (PHINode &PN : PHIBB->phis()) {
1910     // Ok, we have a PHI node.  Figure out what the incoming value was for the
1911     // DestBlock.
1912     Value *IV = PN.getIncomingValueForBlock(OldPred);
1913 
1914     // Remap the value if necessary.
1915     if (Instruction *Inst = dyn_cast<Instruction>(IV)) {
1916       DenseMap<Instruction*, Value*>::iterator I = ValueMap.find(Inst);
1917       if (I != ValueMap.end())
1918         IV = I->second;
1919     }
1920 
1921     PN.addIncoming(IV, NewPred);
1922   }
1923 }
1924 
1925 /// Merge basic block BB into its sole predecessor if possible.
1926 bool JumpThreadingPass::MaybeMergeBasicBlockIntoOnlyPred(BasicBlock *BB) {
1927   BasicBlock *SinglePred = BB->getSinglePredecessor();
1928   if (!SinglePred)
1929     return false;
1930 
1931   const Instruction *TI = SinglePred->getTerminator();
1932   if (TI->isExceptionalTerminator() || TI->getNumSuccessors() != 1 ||
1933       SinglePred == BB || hasAddressTakenAndUsed(BB))
1934     return false;
1935 
1936   // If SinglePred was a loop header, BB becomes one.
1937   if (LoopHeaders.erase(SinglePred))
1938     LoopHeaders.insert(BB);
1939 
1940   LVI->eraseBlock(SinglePred);
1941   MergeBasicBlockIntoOnlyPred(BB, DTU);
1942 
1943   // Now that BB is merged into SinglePred (i.e. SinglePred code followed by
1944   // BB code within one basic block `BB`), we need to invalidate the LVI
1945   // information associated with BB, because the LVI information need not be
1946   // true for all of BB after the merge. For example,
1947   // Before the merge, LVI info and code is as follows:
1948   // SinglePred: <LVI info1 for %p val>
1949   // %y = use of %p
1950   // call @exit() // need not transfer execution to successor.
1951   // assume(%p) // from this point on %p is true
1952   // br label %BB
1953   // BB: <LVI info2 for %p val, i.e. %p is true>
1954   // %x = use of %p
1955   // br label exit
1956   //
1957   // Note that this LVI info for blocks BB and SinglPred is correct for %p
1958   // (info2 and info1 respectively). After the merge and the deletion of the
1959   // LVI info1 for SinglePred. We have the following code:
1960   // BB: <LVI info2 for %p val>
1961   // %y = use of %p
1962   // call @exit()
1963   // assume(%p)
1964   // %x = use of %p <-- LVI info2 is correct from here onwards.
1965   // br label exit
1966   // LVI info2 for BB is incorrect at the beginning of BB.
1967 
1968   // Invalidate LVI information for BB if the LVI is not provably true for
1969   // all of BB.
1970   if (!isGuaranteedToTransferExecutionToSuccessor(BB))
1971     LVI->eraseBlock(BB);
1972   return true;
1973 }
1974 
1975 /// Update the SSA form.  NewBB contains instructions that are copied from BB.
1976 /// ValueMapping maps old values in BB to new ones in NewBB.
1977 void JumpThreadingPass::UpdateSSA(
1978     BasicBlock *BB, BasicBlock *NewBB,
1979     DenseMap<Instruction *, Value *> &ValueMapping) {
1980   // If there were values defined in BB that are used outside the block, then we
1981   // now have to update all uses of the value to use either the original value,
1982   // the cloned value, or some PHI derived value.  This can require arbitrary
1983   // PHI insertion, of which we are prepared to do, clean these up now.
1984   SSAUpdater SSAUpdate;
1985   SmallVector<Use *, 16> UsesToRename;
1986 
1987   for (Instruction &I : *BB) {
1988     // Scan all uses of this instruction to see if it is used outside of its
1989     // block, and if so, record them in UsesToRename.
1990     for (Use &U : I.uses()) {
1991       Instruction *User = cast<Instruction>(U.getUser());
1992       if (PHINode *UserPN = dyn_cast<PHINode>(User)) {
1993         if (UserPN->getIncomingBlock(U) == BB)
1994           continue;
1995       } else if (User->getParent() == BB)
1996         continue;
1997 
1998       UsesToRename.push_back(&U);
1999     }
2000 
2001     // If there are no uses outside the block, we're done with this instruction.
2002     if (UsesToRename.empty())
2003       continue;
2004     LLVM_DEBUG(dbgs() << "JT: Renaming non-local uses of: " << I << "\n");
2005 
2006     // We found a use of I outside of BB.  Rename all uses of I that are outside
2007     // its block to be uses of the appropriate PHI node etc.  See ValuesInBlocks
2008     // with the two values we know.
2009     SSAUpdate.Initialize(I.getType(), I.getName());
2010     SSAUpdate.AddAvailableValue(BB, &I);
2011     SSAUpdate.AddAvailableValue(NewBB, ValueMapping[&I]);
2012 
2013     while (!UsesToRename.empty())
2014       SSAUpdate.RewriteUse(*UsesToRename.pop_back_val());
2015     LLVM_DEBUG(dbgs() << "\n");
2016   }
2017 }
2018 
2019 /// Clone instructions in range [BI, BE) to NewBB.  For PHI nodes, we only clone
2020 /// arguments that come from PredBB.  Return the map from the variables in the
2021 /// source basic block to the variables in the newly created basic block.
2022 DenseMap<Instruction *, Value *>
2023 JumpThreadingPass::CloneInstructions(BasicBlock::iterator BI,
2024                                      BasicBlock::iterator BE, BasicBlock *NewBB,
2025                                      BasicBlock *PredBB) {
2026   // We are going to have to map operands from the source basic block to the new
2027   // copy of the block 'NewBB'.  If there are PHI nodes in the source basic
2028   // block, evaluate them to account for entry from PredBB.
2029   DenseMap<Instruction *, Value *> ValueMapping;
2030 
2031   // Clone the phi nodes of the source basic block into NewBB.  The resulting
2032   // phi nodes are trivial since NewBB only has one predecessor, but SSAUpdater
2033   // might need to rewrite the operand of the cloned phi.
2034   for (; PHINode *PN = dyn_cast<PHINode>(BI); ++BI) {
2035     PHINode *NewPN = PHINode::Create(PN->getType(), 1, PN->getName(), NewBB);
2036     NewPN->addIncoming(PN->getIncomingValueForBlock(PredBB), PredBB);
2037     ValueMapping[PN] = NewPN;
2038   }
2039 
2040   // Clone the non-phi instructions of the source basic block into NewBB,
2041   // keeping track of the mapping and using it to remap operands in the cloned
2042   // instructions.
2043   for (; BI != BE; ++BI) {
2044     Instruction *New = BI->clone();
2045     New->setName(BI->getName());
2046     NewBB->getInstList().push_back(New);
2047     ValueMapping[&*BI] = New;
2048 
2049     // Remap operands to patch up intra-block references.
2050     for (unsigned i = 0, e = New->getNumOperands(); i != e; ++i)
2051       if (Instruction *Inst = dyn_cast<Instruction>(New->getOperand(i))) {
2052         DenseMap<Instruction *, Value *>::iterator I = ValueMapping.find(Inst);
2053         if (I != ValueMapping.end())
2054           New->setOperand(i, I->second);
2055       }
2056   }
2057 
2058   return ValueMapping;
2059 }
2060 
2061 /// Attempt to thread through two successive basic blocks.
2062 bool JumpThreadingPass::MaybeThreadThroughTwoBasicBlocks(BasicBlock *BB,
2063                                                          Value *Cond) {
2064   // Consider:
2065   //
2066   // PredBB:
2067   //   %var = phi i32* [ null, %bb1 ], [ @a, %bb2 ]
2068   //   %tobool = icmp eq i32 %cond, 0
2069   //   br i1 %tobool, label %BB, label ...
2070   //
2071   // BB:
2072   //   %cmp = icmp eq i32* %var, null
2073   //   br i1 %cmp, label ..., label ...
2074   //
2075   // We don't know the value of %var at BB even if we know which incoming edge
2076   // we take to BB.  However, once we duplicate PredBB for each of its incoming
2077   // edges (say, PredBB1 and PredBB2), we know the value of %var in each copy of
2078   // PredBB.  Then we can thread edges PredBB1->BB and PredBB2->BB through BB.
2079 
2080   // Require that BB end with a Branch for simplicity.
2081   BranchInst *CondBr = dyn_cast<BranchInst>(BB->getTerminator());
2082   if (!CondBr)
2083     return false;
2084 
2085   // BB must have exactly one predecessor.
2086   BasicBlock *PredBB = BB->getSinglePredecessor();
2087   if (!PredBB)
2088     return false;
2089 
2090   // Require that PredBB end with a conditional Branch. If PredBB ends with an
2091   // unconditional branch, we should be merging PredBB and BB instead. For
2092   // simplicity, we don't deal with a switch.
2093   BranchInst *PredBBBranch = dyn_cast<BranchInst>(PredBB->getTerminator());
2094   if (!PredBBBranch || PredBBBranch->isUnconditional())
2095     return false;
2096 
2097   // If PredBB has exactly one incoming edge, we don't gain anything by copying
2098   // PredBB.
2099   if (PredBB->getSinglePredecessor())
2100     return false;
2101 
2102   // Don't thread through PredBB if it contains a successor edge to itself, in
2103   // which case we would infinite loop.  Suppose we are threading an edge from
2104   // PredPredBB through PredBB and BB to SuccBB with PredBB containing a
2105   // successor edge to itself.  If we allowed jump threading in this case, we
2106   // could duplicate PredBB and BB as, say, PredBB.thread and BB.thread.  Since
2107   // PredBB.thread has a successor edge to PredBB, we would immediately come up
2108   // with another jump threading opportunity from PredBB.thread through PredBB
2109   // and BB to SuccBB.  This jump threading would repeatedly occur.  That is, we
2110   // would keep peeling one iteration from PredBB.
2111   if (llvm::is_contained(successors(PredBB), PredBB))
2112     return false;
2113 
2114   // Don't thread across a loop header.
2115   if (LoopHeaders.count(PredBB))
2116     return false;
2117 
2118   // Avoid complication with duplicating EH pads.
2119   if (PredBB->isEHPad())
2120     return false;
2121 
2122   // Find a predecessor that we can thread.  For simplicity, we only consider a
2123   // successor edge out of BB to which we thread exactly one incoming edge into
2124   // PredBB.
2125   unsigned ZeroCount = 0;
2126   unsigned OneCount = 0;
2127   BasicBlock *ZeroPred = nullptr;
2128   BasicBlock *OnePred = nullptr;
2129   for (BasicBlock *P : predecessors(PredBB)) {
2130     if (ConstantInt *CI = dyn_cast_or_null<ConstantInt>(
2131             EvaluateOnPredecessorEdge(BB, P, Cond))) {
2132       if (CI->isZero()) {
2133         ZeroCount++;
2134         ZeroPred = P;
2135       } else if (CI->isOne()) {
2136         OneCount++;
2137         OnePred = P;
2138       }
2139     }
2140   }
2141 
2142   // Disregard complicated cases where we have to thread multiple edges.
2143   BasicBlock *PredPredBB;
2144   if (ZeroCount == 1) {
2145     PredPredBB = ZeroPred;
2146   } else if (OneCount == 1) {
2147     PredPredBB = OnePred;
2148   } else {
2149     return false;
2150   }
2151 
2152   BasicBlock *SuccBB = CondBr->getSuccessor(PredPredBB == ZeroPred);
2153 
2154   // If threading to the same block as we come from, we would infinite loop.
2155   if (SuccBB == BB) {
2156     LLVM_DEBUG(dbgs() << "  Not threading across BB '" << BB->getName()
2157                       << "' - would thread to self!\n");
2158     return false;
2159   }
2160 
2161   // If threading this would thread across a loop header, don't thread the edge.
2162   // See the comments above FindLoopHeaders for justifications and caveats.
2163   if (LoopHeaders.count(BB) || LoopHeaders.count(SuccBB)) {
2164     LLVM_DEBUG({
2165       bool BBIsHeader = LoopHeaders.count(BB);
2166       bool SuccIsHeader = LoopHeaders.count(SuccBB);
2167       dbgs() << "  Not threading across "
2168              << (BBIsHeader ? "loop header BB '" : "block BB '")
2169              << BB->getName() << "' to dest "
2170              << (SuccIsHeader ? "loop header BB '" : "block BB '")
2171              << SuccBB->getName()
2172              << "' - it might create an irreducible loop!\n";
2173     });
2174     return false;
2175   }
2176 
2177   // Compute the cost of duplicating BB and PredBB.
2178   unsigned BBCost =
2179       getJumpThreadDuplicationCost(BB, BB->getTerminator(), BBDupThreshold);
2180   unsigned PredBBCost = getJumpThreadDuplicationCost(
2181       PredBB, PredBB->getTerminator(), BBDupThreshold);
2182 
2183   // Give up if costs are too high.  We need to check BBCost and PredBBCost
2184   // individually before checking their sum because getJumpThreadDuplicationCost
2185   // return (unsigned)~0 for those basic blocks that cannot be duplicated.
2186   if (BBCost > BBDupThreshold || PredBBCost > BBDupThreshold ||
2187       BBCost + PredBBCost > BBDupThreshold) {
2188     LLVM_DEBUG(dbgs() << "  Not threading BB '" << BB->getName()
2189                       << "' - Cost is too high: " << PredBBCost
2190                       << " for PredBB, " << BBCost << "for BB\n");
2191     return false;
2192   }
2193 
2194   // Now we are ready to duplicate PredBB.
2195   ThreadThroughTwoBasicBlocks(PredPredBB, PredBB, BB, SuccBB);
2196   return true;
2197 }
2198 
2199 void JumpThreadingPass::ThreadThroughTwoBasicBlocks(BasicBlock *PredPredBB,
2200                                                     BasicBlock *PredBB,
2201                                                     BasicBlock *BB,
2202                                                     BasicBlock *SuccBB) {
2203   LLVM_DEBUG(dbgs() << "  Threading through '" << PredBB->getName() << "' and '"
2204                     << BB->getName() << "'\n");
2205 
2206   BranchInst *CondBr = cast<BranchInst>(BB->getTerminator());
2207   BranchInst *PredBBBranch = cast<BranchInst>(PredBB->getTerminator());
2208 
2209   BasicBlock *NewBB =
2210       BasicBlock::Create(PredBB->getContext(), PredBB->getName() + ".thread",
2211                          PredBB->getParent(), PredBB);
2212   NewBB->moveAfter(PredBB);
2213 
2214   // Set the block frequency of NewBB.
2215   if (HasProfileData) {
2216     auto NewBBFreq = BFI->getBlockFreq(PredPredBB) *
2217                      BPI->getEdgeProbability(PredPredBB, PredBB);
2218     BFI->setBlockFreq(NewBB, NewBBFreq.getFrequency());
2219   }
2220 
2221   // We are going to have to map operands from the original BB block to the new
2222   // copy of the block 'NewBB'.  If there are PHI nodes in PredBB, evaluate them
2223   // to account for entry from PredPredBB.
2224   DenseMap<Instruction *, Value *> ValueMapping =
2225       CloneInstructions(PredBB->begin(), PredBB->end(), NewBB, PredPredBB);
2226 
2227   // Update the terminator of PredPredBB to jump to NewBB instead of PredBB.
2228   // This eliminates predecessors from PredPredBB, which requires us to simplify
2229   // any PHI nodes in PredBB.
2230   Instruction *PredPredTerm = PredPredBB->getTerminator();
2231   for (unsigned i = 0, e = PredPredTerm->getNumSuccessors(); i != e; ++i)
2232     if (PredPredTerm->getSuccessor(i) == PredBB) {
2233       PredBB->removePredecessor(PredPredBB, true);
2234       PredPredTerm->setSuccessor(i, NewBB);
2235     }
2236 
2237   AddPHINodeEntriesForMappedBlock(PredBBBranch->getSuccessor(0), PredBB, NewBB,
2238                                   ValueMapping);
2239   AddPHINodeEntriesForMappedBlock(PredBBBranch->getSuccessor(1), PredBB, NewBB,
2240                                   ValueMapping);
2241 
2242   DTU->applyUpdatesPermissive(
2243       {{DominatorTree::Insert, NewBB, CondBr->getSuccessor(0)},
2244        {DominatorTree::Insert, NewBB, CondBr->getSuccessor(1)},
2245        {DominatorTree::Insert, PredPredBB, NewBB},
2246        {DominatorTree::Delete, PredPredBB, PredBB}});
2247 
2248   UpdateSSA(PredBB, NewBB, ValueMapping);
2249 
2250   // Clean up things like PHI nodes with single operands, dead instructions,
2251   // etc.
2252   SimplifyInstructionsInBlock(NewBB, TLI);
2253   SimplifyInstructionsInBlock(PredBB, TLI);
2254 
2255   SmallVector<BasicBlock *, 1> PredsToFactor;
2256   PredsToFactor.push_back(NewBB);
2257   ThreadEdge(BB, PredsToFactor, SuccBB);
2258 }
2259 
2260 /// TryThreadEdge - Thread an edge if it's safe and profitable to do so.
2261 bool JumpThreadingPass::TryThreadEdge(
2262     BasicBlock *BB, const SmallVectorImpl<BasicBlock *> &PredBBs,
2263     BasicBlock *SuccBB) {
2264   // If threading to the same block as we come from, we would infinite loop.
2265   if (SuccBB == BB) {
2266     LLVM_DEBUG(dbgs() << "  Not threading across BB '" << BB->getName()
2267                       << "' - would thread to self!\n");
2268     return false;
2269   }
2270 
2271   // If threading this would thread across a loop header, don't thread the edge.
2272   // See the comments above FindLoopHeaders for justifications and caveats.
2273   if (LoopHeaders.count(BB) || LoopHeaders.count(SuccBB)) {
2274     LLVM_DEBUG({
2275       bool BBIsHeader = LoopHeaders.count(BB);
2276       bool SuccIsHeader = LoopHeaders.count(SuccBB);
2277       dbgs() << "  Not threading across "
2278           << (BBIsHeader ? "loop header BB '" : "block BB '") << BB->getName()
2279           << "' to dest " << (SuccIsHeader ? "loop header BB '" : "block BB '")
2280           << SuccBB->getName() << "' - it might create an irreducible loop!\n";
2281     });
2282     return false;
2283   }
2284 
2285   unsigned JumpThreadCost =
2286       getJumpThreadDuplicationCost(BB, BB->getTerminator(), BBDupThreshold);
2287   if (JumpThreadCost > BBDupThreshold) {
2288     LLVM_DEBUG(dbgs() << "  Not threading BB '" << BB->getName()
2289                       << "' - Cost is too high: " << JumpThreadCost << "\n");
2290     return false;
2291   }
2292 
2293   ThreadEdge(BB, PredBBs, SuccBB);
2294   return true;
2295 }
2296 
2297 /// ThreadEdge - We have decided that it is safe and profitable to factor the
2298 /// blocks in PredBBs to one predecessor, then thread an edge from it to SuccBB
2299 /// across BB.  Transform the IR to reflect this change.
2300 void JumpThreadingPass::ThreadEdge(BasicBlock *BB,
2301                                    const SmallVectorImpl<BasicBlock *> &PredBBs,
2302                                    BasicBlock *SuccBB) {
2303   assert(SuccBB != BB && "Don't create an infinite loop");
2304 
2305   assert(!LoopHeaders.count(BB) && !LoopHeaders.count(SuccBB) &&
2306          "Don't thread across loop headers");
2307 
2308   // And finally, do it!  Start by factoring the predecessors if needed.
2309   BasicBlock *PredBB;
2310   if (PredBBs.size() == 1)
2311     PredBB = PredBBs[0];
2312   else {
2313     LLVM_DEBUG(dbgs() << "  Factoring out " << PredBBs.size()
2314                       << " common predecessors.\n");
2315     PredBB = SplitBlockPreds(BB, PredBBs, ".thr_comm");
2316   }
2317 
2318   // And finally, do it!
2319   LLVM_DEBUG(dbgs() << "  Threading edge from '" << PredBB->getName()
2320                     << "' to '" << SuccBB->getName()
2321                     << ", across block:\n    " << *BB << "\n");
2322 
2323   LVI->threadEdge(PredBB, BB, SuccBB);
2324 
2325   BasicBlock *NewBB = BasicBlock::Create(BB->getContext(),
2326                                          BB->getName()+".thread",
2327                                          BB->getParent(), BB);
2328   NewBB->moveAfter(PredBB);
2329 
2330   // Set the block frequency of NewBB.
2331   if (HasProfileData) {
2332     auto NewBBFreq =
2333         BFI->getBlockFreq(PredBB) * BPI->getEdgeProbability(PredBB, BB);
2334     BFI->setBlockFreq(NewBB, NewBBFreq.getFrequency());
2335   }
2336 
2337   // Copy all the instructions from BB to NewBB except the terminator.
2338   DenseMap<Instruction *, Value *> ValueMapping =
2339       CloneInstructions(BB->begin(), std::prev(BB->end()), NewBB, PredBB);
2340 
2341   // We didn't copy the terminator from BB over to NewBB, because there is now
2342   // an unconditional jump to SuccBB.  Insert the unconditional jump.
2343   BranchInst *NewBI = BranchInst::Create(SuccBB, NewBB);
2344   NewBI->setDebugLoc(BB->getTerminator()->getDebugLoc());
2345 
2346   // Check to see if SuccBB has PHI nodes. If so, we need to add entries to the
2347   // PHI nodes for NewBB now.
2348   AddPHINodeEntriesForMappedBlock(SuccBB, BB, NewBB, ValueMapping);
2349 
2350   // Update the terminator of PredBB to jump to NewBB instead of BB.  This
2351   // eliminates predecessors from BB, which requires us to simplify any PHI
2352   // nodes in BB.
2353   Instruction *PredTerm = PredBB->getTerminator();
2354   for (unsigned i = 0, e = PredTerm->getNumSuccessors(); i != e; ++i)
2355     if (PredTerm->getSuccessor(i) == BB) {
2356       BB->removePredecessor(PredBB, true);
2357       PredTerm->setSuccessor(i, NewBB);
2358     }
2359 
2360   // Enqueue required DT updates.
2361   DTU->applyUpdatesPermissive({{DominatorTree::Insert, NewBB, SuccBB},
2362                                {DominatorTree::Insert, PredBB, NewBB},
2363                                {DominatorTree::Delete, PredBB, BB}});
2364 
2365   UpdateSSA(BB, NewBB, ValueMapping);
2366 
2367   // At this point, the IR is fully up to date and consistent.  Do a quick scan
2368   // over the new instructions and zap any that are constants or dead.  This
2369   // frequently happens because of phi translation.
2370   SimplifyInstructionsInBlock(NewBB, TLI);
2371 
2372   // Update the edge weight from BB to SuccBB, which should be less than before.
2373   UpdateBlockFreqAndEdgeWeight(PredBB, BB, NewBB, SuccBB);
2374 
2375   // Threaded an edge!
2376   ++NumThreads;
2377 }
2378 
2379 /// Create a new basic block that will be the predecessor of BB and successor of
2380 /// all blocks in Preds. When profile data is available, update the frequency of
2381 /// this new block.
2382 BasicBlock *JumpThreadingPass::SplitBlockPreds(BasicBlock *BB,
2383                                                ArrayRef<BasicBlock *> Preds,
2384                                                const char *Suffix) {
2385   SmallVector<BasicBlock *, 2> NewBBs;
2386 
2387   // Collect the frequencies of all predecessors of BB, which will be used to
2388   // update the edge weight of the result of splitting predecessors.
2389   DenseMap<BasicBlock *, BlockFrequency> FreqMap;
2390   if (HasProfileData)
2391     for (auto Pred : Preds)
2392       FreqMap.insert(std::make_pair(
2393           Pred, BFI->getBlockFreq(Pred) * BPI->getEdgeProbability(Pred, BB)));
2394 
2395   // In the case when BB is a LandingPad block we create 2 new predecessors
2396   // instead of just one.
2397   if (BB->isLandingPad()) {
2398     std::string NewName = std::string(Suffix) + ".split-lp";
2399     SplitLandingPadPredecessors(BB, Preds, Suffix, NewName.c_str(), NewBBs);
2400   } else {
2401     NewBBs.push_back(SplitBlockPredecessors(BB, Preds, Suffix));
2402   }
2403 
2404   std::vector<DominatorTree::UpdateType> Updates;
2405   Updates.reserve((2 * Preds.size()) + NewBBs.size());
2406   for (auto NewBB : NewBBs) {
2407     BlockFrequency NewBBFreq(0);
2408     Updates.push_back({DominatorTree::Insert, NewBB, BB});
2409     for (auto Pred : predecessors(NewBB)) {
2410       Updates.push_back({DominatorTree::Delete, Pred, BB});
2411       Updates.push_back({DominatorTree::Insert, Pred, NewBB});
2412       if (HasProfileData) // Update frequencies between Pred -> NewBB.
2413         NewBBFreq += FreqMap.lookup(Pred);
2414     }
2415     if (HasProfileData) // Apply the summed frequency to NewBB.
2416       BFI->setBlockFreq(NewBB, NewBBFreq.getFrequency());
2417   }
2418 
2419   DTU->applyUpdatesPermissive(Updates);
2420   return NewBBs[0];
2421 }
2422 
2423 bool JumpThreadingPass::doesBlockHaveProfileData(BasicBlock *BB) {
2424   const Instruction *TI = BB->getTerminator();
2425   assert(TI->getNumSuccessors() > 1 && "not a split");
2426 
2427   MDNode *WeightsNode = TI->getMetadata(LLVMContext::MD_prof);
2428   if (!WeightsNode)
2429     return false;
2430 
2431   MDString *MDName = cast<MDString>(WeightsNode->getOperand(0));
2432   if (MDName->getString() != "branch_weights")
2433     return false;
2434 
2435   // Ensure there are weights for all of the successors. Note that the first
2436   // operand to the metadata node is a name, not a weight.
2437   return WeightsNode->getNumOperands() == TI->getNumSuccessors() + 1;
2438 }
2439 
2440 /// Update the block frequency of BB and branch weight and the metadata on the
2441 /// edge BB->SuccBB. This is done by scaling the weight of BB->SuccBB by 1 -
2442 /// Freq(PredBB->BB) / Freq(BB->SuccBB).
2443 void JumpThreadingPass::UpdateBlockFreqAndEdgeWeight(BasicBlock *PredBB,
2444                                                      BasicBlock *BB,
2445                                                      BasicBlock *NewBB,
2446                                                      BasicBlock *SuccBB) {
2447   if (!HasProfileData)
2448     return;
2449 
2450   assert(BFI && BPI && "BFI & BPI should have been created here");
2451 
2452   // As the edge from PredBB to BB is deleted, we have to update the block
2453   // frequency of BB.
2454   auto BBOrigFreq = BFI->getBlockFreq(BB);
2455   auto NewBBFreq = BFI->getBlockFreq(NewBB);
2456   auto BB2SuccBBFreq = BBOrigFreq * BPI->getEdgeProbability(BB, SuccBB);
2457   auto BBNewFreq = BBOrigFreq - NewBBFreq;
2458   BFI->setBlockFreq(BB, BBNewFreq.getFrequency());
2459 
2460   // Collect updated outgoing edges' frequencies from BB and use them to update
2461   // edge probabilities.
2462   SmallVector<uint64_t, 4> BBSuccFreq;
2463   for (BasicBlock *Succ : successors(BB)) {
2464     auto SuccFreq = (Succ == SuccBB)
2465                         ? BB2SuccBBFreq - NewBBFreq
2466                         : BBOrigFreq * BPI->getEdgeProbability(BB, Succ);
2467     BBSuccFreq.push_back(SuccFreq.getFrequency());
2468   }
2469 
2470   uint64_t MaxBBSuccFreq =
2471       *std::max_element(BBSuccFreq.begin(), BBSuccFreq.end());
2472 
2473   SmallVector<BranchProbability, 4> BBSuccProbs;
2474   if (MaxBBSuccFreq == 0)
2475     BBSuccProbs.assign(BBSuccFreq.size(),
2476                        {1, static_cast<unsigned>(BBSuccFreq.size())});
2477   else {
2478     for (uint64_t Freq : BBSuccFreq)
2479       BBSuccProbs.push_back(
2480           BranchProbability::getBranchProbability(Freq, MaxBBSuccFreq));
2481     // Normalize edge probabilities so that they sum up to one.
2482     BranchProbability::normalizeProbabilities(BBSuccProbs.begin(),
2483                                               BBSuccProbs.end());
2484   }
2485 
2486   // Update edge probabilities in BPI.
2487   BPI->setEdgeProbability(BB, BBSuccProbs);
2488 
2489   // Update the profile metadata as well.
2490   //
2491   // Don't do this if the profile of the transformed blocks was statically
2492   // estimated.  (This could occur despite the function having an entry
2493   // frequency in completely cold parts of the CFG.)
2494   //
2495   // In this case we don't want to suggest to subsequent passes that the
2496   // calculated weights are fully consistent.  Consider this graph:
2497   //
2498   //                 check_1
2499   //             50% /  |
2500   //             eq_1   | 50%
2501   //                 \  |
2502   //                 check_2
2503   //             50% /  |
2504   //             eq_2   | 50%
2505   //                 \  |
2506   //                 check_3
2507   //             50% /  |
2508   //             eq_3   | 50%
2509   //                 \  |
2510   //
2511   // Assuming the blocks check_* all compare the same value against 1, 2 and 3,
2512   // the overall probabilities are inconsistent; the total probability that the
2513   // value is either 1, 2 or 3 is 150%.
2514   //
2515   // As a consequence if we thread eq_1 -> check_2 to check_3, check_2->check_3
2516   // becomes 0%.  This is even worse if the edge whose probability becomes 0% is
2517   // the loop exit edge.  Then based solely on static estimation we would assume
2518   // the loop was extremely hot.
2519   //
2520   // FIXME this locally as well so that BPI and BFI are consistent as well.  We
2521   // shouldn't make edges extremely likely or unlikely based solely on static
2522   // estimation.
2523   if (BBSuccProbs.size() >= 2 && doesBlockHaveProfileData(BB)) {
2524     SmallVector<uint32_t, 4> Weights;
2525     for (auto Prob : BBSuccProbs)
2526       Weights.push_back(Prob.getNumerator());
2527 
2528     auto TI = BB->getTerminator();
2529     TI->setMetadata(
2530         LLVMContext::MD_prof,
2531         MDBuilder(TI->getParent()->getContext()).createBranchWeights(Weights));
2532   }
2533 }
2534 
2535 /// DuplicateCondBranchOnPHIIntoPred - PredBB contains an unconditional branch
2536 /// to BB which contains an i1 PHI node and a conditional branch on that PHI.
2537 /// If we can duplicate the contents of BB up into PredBB do so now, this
2538 /// improves the odds that the branch will be on an analyzable instruction like
2539 /// a compare.
2540 bool JumpThreadingPass::DuplicateCondBranchOnPHIIntoPred(
2541     BasicBlock *BB, const SmallVectorImpl<BasicBlock *> &PredBBs) {
2542   assert(!PredBBs.empty() && "Can't handle an empty set");
2543 
2544   // If BB is a loop header, then duplicating this block outside the loop would
2545   // cause us to transform this into an irreducible loop, don't do this.
2546   // See the comments above FindLoopHeaders for justifications and caveats.
2547   if (LoopHeaders.count(BB)) {
2548     LLVM_DEBUG(dbgs() << "  Not duplicating loop header '" << BB->getName()
2549                       << "' into predecessor block '" << PredBBs[0]->getName()
2550                       << "' - it might create an irreducible loop!\n");
2551     return false;
2552   }
2553 
2554   unsigned DuplicationCost =
2555       getJumpThreadDuplicationCost(BB, BB->getTerminator(), BBDupThreshold);
2556   if (DuplicationCost > BBDupThreshold) {
2557     LLVM_DEBUG(dbgs() << "  Not duplicating BB '" << BB->getName()
2558                       << "' - Cost is too high: " << DuplicationCost << "\n");
2559     return false;
2560   }
2561 
2562   // And finally, do it!  Start by factoring the predecessors if needed.
2563   std::vector<DominatorTree::UpdateType> Updates;
2564   BasicBlock *PredBB;
2565   if (PredBBs.size() == 1)
2566     PredBB = PredBBs[0];
2567   else {
2568     LLVM_DEBUG(dbgs() << "  Factoring out " << PredBBs.size()
2569                       << " common predecessors.\n");
2570     PredBB = SplitBlockPreds(BB, PredBBs, ".thr_comm");
2571   }
2572   Updates.push_back({DominatorTree::Delete, PredBB, BB});
2573 
2574   // Okay, we decided to do this!  Clone all the instructions in BB onto the end
2575   // of PredBB.
2576   LLVM_DEBUG(dbgs() << "  Duplicating block '" << BB->getName()
2577                     << "' into end of '" << PredBB->getName()
2578                     << "' to eliminate branch on phi.  Cost: "
2579                     << DuplicationCost << " block is:" << *BB << "\n");
2580 
2581   // Unless PredBB ends with an unconditional branch, split the edge so that we
2582   // can just clone the bits from BB into the end of the new PredBB.
2583   BranchInst *OldPredBranch = dyn_cast<BranchInst>(PredBB->getTerminator());
2584 
2585   if (!OldPredBranch || !OldPredBranch->isUnconditional()) {
2586     BasicBlock *OldPredBB = PredBB;
2587     PredBB = SplitEdge(OldPredBB, BB);
2588     Updates.push_back({DominatorTree::Insert, OldPredBB, PredBB});
2589     Updates.push_back({DominatorTree::Insert, PredBB, BB});
2590     Updates.push_back({DominatorTree::Delete, OldPredBB, BB});
2591     OldPredBranch = cast<BranchInst>(PredBB->getTerminator());
2592   }
2593 
2594   // We are going to have to map operands from the original BB block into the
2595   // PredBB block.  Evaluate PHI nodes in BB.
2596   DenseMap<Instruction*, Value*> ValueMapping;
2597 
2598   BasicBlock::iterator BI = BB->begin();
2599   for (; PHINode *PN = dyn_cast<PHINode>(BI); ++BI)
2600     ValueMapping[PN] = PN->getIncomingValueForBlock(PredBB);
2601   // Clone the non-phi instructions of BB into PredBB, keeping track of the
2602   // mapping and using it to remap operands in the cloned instructions.
2603   for (; BI != BB->end(); ++BI) {
2604     Instruction *New = BI->clone();
2605 
2606     // Remap operands to patch up intra-block references.
2607     for (unsigned i = 0, e = New->getNumOperands(); i != e; ++i)
2608       if (Instruction *Inst = dyn_cast<Instruction>(New->getOperand(i))) {
2609         DenseMap<Instruction*, Value*>::iterator I = ValueMapping.find(Inst);
2610         if (I != ValueMapping.end())
2611           New->setOperand(i, I->second);
2612       }
2613 
2614     // If this instruction can be simplified after the operands are updated,
2615     // just use the simplified value instead.  This frequently happens due to
2616     // phi translation.
2617     if (Value *IV = SimplifyInstruction(
2618             New,
2619             {BB->getModule()->getDataLayout(), TLI, nullptr, nullptr, New})) {
2620       ValueMapping[&*BI] = IV;
2621       if (!New->mayHaveSideEffects()) {
2622         New->deleteValue();
2623         New = nullptr;
2624       }
2625     } else {
2626       ValueMapping[&*BI] = New;
2627     }
2628     if (New) {
2629       // Otherwise, insert the new instruction into the block.
2630       New->setName(BI->getName());
2631       PredBB->getInstList().insert(OldPredBranch->getIterator(), New);
2632       // Update Dominance from simplified New instruction operands.
2633       for (unsigned i = 0, e = New->getNumOperands(); i != e; ++i)
2634         if (BasicBlock *SuccBB = dyn_cast<BasicBlock>(New->getOperand(i)))
2635           Updates.push_back({DominatorTree::Insert, PredBB, SuccBB});
2636     }
2637   }
2638 
2639   // Check to see if the targets of the branch had PHI nodes. If so, we need to
2640   // add entries to the PHI nodes for branch from PredBB now.
2641   BranchInst *BBBranch = cast<BranchInst>(BB->getTerminator());
2642   AddPHINodeEntriesForMappedBlock(BBBranch->getSuccessor(0), BB, PredBB,
2643                                   ValueMapping);
2644   AddPHINodeEntriesForMappedBlock(BBBranch->getSuccessor(1), BB, PredBB,
2645                                   ValueMapping);
2646 
2647   UpdateSSA(BB, PredBB, ValueMapping);
2648 
2649   // PredBB no longer jumps to BB, remove entries in the PHI node for the edge
2650   // that we nuked.
2651   BB->removePredecessor(PredBB, true);
2652 
2653   // Remove the unconditional branch at the end of the PredBB block.
2654   OldPredBranch->eraseFromParent();
2655   DTU->applyUpdatesPermissive(Updates);
2656 
2657   ++NumDupes;
2658   return true;
2659 }
2660 
2661 // Pred is a predecessor of BB with an unconditional branch to BB. SI is
2662 // a Select instruction in Pred. BB has other predecessors and SI is used in
2663 // a PHI node in BB. SI has no other use.
2664 // A new basic block, NewBB, is created and SI is converted to compare and
2665 // conditional branch. SI is erased from parent.
2666 void JumpThreadingPass::UnfoldSelectInstr(BasicBlock *Pred, BasicBlock *BB,
2667                                           SelectInst *SI, PHINode *SIUse,
2668                                           unsigned Idx) {
2669   // Expand the select.
2670   //
2671   // Pred --
2672   //  |    v
2673   //  |  NewBB
2674   //  |    |
2675   //  |-----
2676   //  v
2677   // BB
2678   BranchInst *PredTerm = cast<BranchInst>(Pred->getTerminator());
2679   BasicBlock *NewBB = BasicBlock::Create(BB->getContext(), "select.unfold",
2680                                          BB->getParent(), BB);
2681   // Move the unconditional branch to NewBB.
2682   PredTerm->removeFromParent();
2683   NewBB->getInstList().insert(NewBB->end(), PredTerm);
2684   // Create a conditional branch and update PHI nodes.
2685   BranchInst::Create(NewBB, BB, SI->getCondition(), Pred);
2686   SIUse->setIncomingValue(Idx, SI->getFalseValue());
2687   SIUse->addIncoming(SI->getTrueValue(), NewBB);
2688 
2689   // The select is now dead.
2690   SI->eraseFromParent();
2691   DTU->applyUpdatesPermissive({{DominatorTree::Insert, NewBB, BB},
2692                                {DominatorTree::Insert, Pred, NewBB}});
2693 
2694   // Update any other PHI nodes in BB.
2695   for (BasicBlock::iterator BI = BB->begin();
2696        PHINode *Phi = dyn_cast<PHINode>(BI); ++BI)
2697     if (Phi != SIUse)
2698       Phi->addIncoming(Phi->getIncomingValueForBlock(Pred), NewBB);
2699 }
2700 
2701 bool JumpThreadingPass::TryToUnfoldSelect(SwitchInst *SI, BasicBlock *BB) {
2702   PHINode *CondPHI = dyn_cast<PHINode>(SI->getCondition());
2703 
2704   if (!CondPHI || CondPHI->getParent() != BB)
2705     return false;
2706 
2707   for (unsigned I = 0, E = CondPHI->getNumIncomingValues(); I != E; ++I) {
2708     BasicBlock *Pred = CondPHI->getIncomingBlock(I);
2709     SelectInst *PredSI = dyn_cast<SelectInst>(CondPHI->getIncomingValue(I));
2710 
2711     // The second and third condition can be potentially relaxed. Currently
2712     // the conditions help to simplify the code and allow us to reuse existing
2713     // code, developed for TryToUnfoldSelect(CmpInst *, BasicBlock *)
2714     if (!PredSI || PredSI->getParent() != Pred || !PredSI->hasOneUse())
2715       continue;
2716 
2717     BranchInst *PredTerm = dyn_cast<BranchInst>(Pred->getTerminator());
2718     if (!PredTerm || !PredTerm->isUnconditional())
2719       continue;
2720 
2721     UnfoldSelectInstr(Pred, BB, PredSI, CondPHI, I);
2722     return true;
2723   }
2724   return false;
2725 }
2726 
2727 /// TryToUnfoldSelect - Look for blocks of the form
2728 /// bb1:
2729 ///   %a = select
2730 ///   br bb2
2731 ///
2732 /// bb2:
2733 ///   %p = phi [%a, %bb1] ...
2734 ///   %c = icmp %p
2735 ///   br i1 %c
2736 ///
2737 /// And expand the select into a branch structure if one of its arms allows %c
2738 /// to be folded. This later enables threading from bb1 over bb2.
2739 bool JumpThreadingPass::TryToUnfoldSelect(CmpInst *CondCmp, BasicBlock *BB) {
2740   BranchInst *CondBr = dyn_cast<BranchInst>(BB->getTerminator());
2741   PHINode *CondLHS = dyn_cast<PHINode>(CondCmp->getOperand(0));
2742   Constant *CondRHS = cast<Constant>(CondCmp->getOperand(1));
2743 
2744   if (!CondBr || !CondBr->isConditional() || !CondLHS ||
2745       CondLHS->getParent() != BB)
2746     return false;
2747 
2748   for (unsigned I = 0, E = CondLHS->getNumIncomingValues(); I != E; ++I) {
2749     BasicBlock *Pred = CondLHS->getIncomingBlock(I);
2750     SelectInst *SI = dyn_cast<SelectInst>(CondLHS->getIncomingValue(I));
2751 
2752     // Look if one of the incoming values is a select in the corresponding
2753     // predecessor.
2754     if (!SI || SI->getParent() != Pred || !SI->hasOneUse())
2755       continue;
2756 
2757     BranchInst *PredTerm = dyn_cast<BranchInst>(Pred->getTerminator());
2758     if (!PredTerm || !PredTerm->isUnconditional())
2759       continue;
2760 
2761     // Now check if one of the select values would allow us to constant fold the
2762     // terminator in BB. We don't do the transform if both sides fold, those
2763     // cases will be threaded in any case.
2764     LazyValueInfo::Tristate LHSFolds =
2765         LVI->getPredicateOnEdge(CondCmp->getPredicate(), SI->getOperand(1),
2766                                 CondRHS, Pred, BB, CondCmp);
2767     LazyValueInfo::Tristate RHSFolds =
2768         LVI->getPredicateOnEdge(CondCmp->getPredicate(), SI->getOperand(2),
2769                                 CondRHS, Pred, BB, CondCmp);
2770     if ((LHSFolds != LazyValueInfo::Unknown ||
2771          RHSFolds != LazyValueInfo::Unknown) &&
2772         LHSFolds != RHSFolds) {
2773       UnfoldSelectInstr(Pred, BB, SI, CondLHS, I);
2774       return true;
2775     }
2776   }
2777   return false;
2778 }
2779 
2780 /// TryToUnfoldSelectInCurrBB - Look for PHI/Select or PHI/CMP/Select in the
2781 /// same BB in the form
2782 /// bb:
2783 ///   %p = phi [false, %bb1], [true, %bb2], [false, %bb3], [true, %bb4], ...
2784 ///   %s = select %p, trueval, falseval
2785 ///
2786 /// or
2787 ///
2788 /// bb:
2789 ///   %p = phi [0, %bb1], [1, %bb2], [0, %bb3], [1, %bb4], ...
2790 ///   %c = cmp %p, 0
2791 ///   %s = select %c, trueval, falseval
2792 ///
2793 /// And expand the select into a branch structure. This later enables
2794 /// jump-threading over bb in this pass.
2795 ///
2796 /// Using the similar approach of SimplifyCFG::FoldCondBranchOnPHI(), unfold
2797 /// select if the associated PHI has at least one constant.  If the unfolded
2798 /// select is not jump-threaded, it will be folded again in the later
2799 /// optimizations.
2800 bool JumpThreadingPass::TryToUnfoldSelectInCurrBB(BasicBlock *BB) {
2801   // This transform can introduce a UB (a conditional branch that depends on a
2802   // poison value) that was not present in the original program. See
2803   // @TryToUnfoldSelectInCurrBB test in test/Transforms/JumpThreading/select.ll.
2804   // Disable this transform under MemorySanitizer.
2805   // FIXME: either delete it or replace with a valid transform. This issue is
2806   // not limited to MemorySanitizer (but has only been observed as an MSan false
2807   // positive in practice so far).
2808   if (BB->getParent()->hasFnAttribute(Attribute::SanitizeMemory))
2809     return false;
2810 
2811   // If threading this would thread across a loop header, don't thread the edge.
2812   // See the comments above FindLoopHeaders for justifications and caveats.
2813   if (LoopHeaders.count(BB))
2814     return false;
2815 
2816   for (BasicBlock::iterator BI = BB->begin();
2817        PHINode *PN = dyn_cast<PHINode>(BI); ++BI) {
2818     // Look for a Phi having at least one constant incoming value.
2819     if (llvm::all_of(PN->incoming_values(),
2820                      [](Value *V) { return !isa<ConstantInt>(V); }))
2821       continue;
2822 
2823     auto isUnfoldCandidate = [BB](SelectInst *SI, Value *V) {
2824       // Check if SI is in BB and use V as condition.
2825       if (SI->getParent() != BB)
2826         return false;
2827       Value *Cond = SI->getCondition();
2828       return (Cond && Cond == V && Cond->getType()->isIntegerTy(1));
2829     };
2830 
2831     SelectInst *SI = nullptr;
2832     for (Use &U : PN->uses()) {
2833       if (ICmpInst *Cmp = dyn_cast<ICmpInst>(U.getUser())) {
2834         // Look for a ICmp in BB that compares PN with a constant and is the
2835         // condition of a Select.
2836         if (Cmp->getParent() == BB && Cmp->hasOneUse() &&
2837             isa<ConstantInt>(Cmp->getOperand(1 - U.getOperandNo())))
2838           if (SelectInst *SelectI = dyn_cast<SelectInst>(Cmp->user_back()))
2839             if (isUnfoldCandidate(SelectI, Cmp->use_begin()->get())) {
2840               SI = SelectI;
2841               break;
2842             }
2843       } else if (SelectInst *SelectI = dyn_cast<SelectInst>(U.getUser())) {
2844         // Look for a Select in BB that uses PN as condition.
2845         if (isUnfoldCandidate(SelectI, U.get())) {
2846           SI = SelectI;
2847           break;
2848         }
2849       }
2850     }
2851 
2852     if (!SI)
2853       continue;
2854     // Expand the select.
2855     Instruction *Term =
2856         SplitBlockAndInsertIfThen(SI->getCondition(), SI, false);
2857     BasicBlock *SplitBB = SI->getParent();
2858     BasicBlock *NewBB = Term->getParent();
2859     PHINode *NewPN = PHINode::Create(SI->getType(), 2, "", SI);
2860     NewPN->addIncoming(SI->getTrueValue(), Term->getParent());
2861     NewPN->addIncoming(SI->getFalseValue(), BB);
2862     SI->replaceAllUsesWith(NewPN);
2863     SI->eraseFromParent();
2864     // NewBB and SplitBB are newly created blocks which require insertion.
2865     std::vector<DominatorTree::UpdateType> Updates;
2866     Updates.reserve((2 * SplitBB->getTerminator()->getNumSuccessors()) + 3);
2867     Updates.push_back({DominatorTree::Insert, BB, SplitBB});
2868     Updates.push_back({DominatorTree::Insert, BB, NewBB});
2869     Updates.push_back({DominatorTree::Insert, NewBB, SplitBB});
2870     // BB's successors were moved to SplitBB, update DTU accordingly.
2871     for (auto *Succ : successors(SplitBB)) {
2872       Updates.push_back({DominatorTree::Delete, BB, Succ});
2873       Updates.push_back({DominatorTree::Insert, SplitBB, Succ});
2874     }
2875     DTU->applyUpdatesPermissive(Updates);
2876     return true;
2877   }
2878   return false;
2879 }
2880 
2881 /// Try to propagate a guard from the current BB into one of its predecessors
2882 /// in case if another branch of execution implies that the condition of this
2883 /// guard is always true. Currently we only process the simplest case that
2884 /// looks like:
2885 ///
2886 /// Start:
2887 ///   %cond = ...
2888 ///   br i1 %cond, label %T1, label %F1
2889 /// T1:
2890 ///   br label %Merge
2891 /// F1:
2892 ///   br label %Merge
2893 /// Merge:
2894 ///   %condGuard = ...
2895 ///   call void(i1, ...) @llvm.experimental.guard( i1 %condGuard )[ "deopt"() ]
2896 ///
2897 /// And cond either implies condGuard or !condGuard. In this case all the
2898 /// instructions before the guard can be duplicated in both branches, and the
2899 /// guard is then threaded to one of them.
2900 bool JumpThreadingPass::ProcessGuards(BasicBlock *BB) {
2901   using namespace PatternMatch;
2902 
2903   // We only want to deal with two predecessors.
2904   BasicBlock *Pred1, *Pred2;
2905   auto PI = pred_begin(BB), PE = pred_end(BB);
2906   if (PI == PE)
2907     return false;
2908   Pred1 = *PI++;
2909   if (PI == PE)
2910     return false;
2911   Pred2 = *PI++;
2912   if (PI != PE)
2913     return false;
2914   if (Pred1 == Pred2)
2915     return false;
2916 
2917   // Try to thread one of the guards of the block.
2918   // TODO: Look up deeper than to immediate predecessor?
2919   auto *Parent = Pred1->getSinglePredecessor();
2920   if (!Parent || Parent != Pred2->getSinglePredecessor())
2921     return false;
2922 
2923   if (auto *BI = dyn_cast<BranchInst>(Parent->getTerminator()))
2924     for (auto &I : *BB)
2925       if (isGuard(&I) && ThreadGuard(BB, cast<IntrinsicInst>(&I), BI))
2926         return true;
2927 
2928   return false;
2929 }
2930 
2931 /// Try to propagate the guard from BB which is the lower block of a diamond
2932 /// to one of its branches, in case if diamond's condition implies guard's
2933 /// condition.
2934 bool JumpThreadingPass::ThreadGuard(BasicBlock *BB, IntrinsicInst *Guard,
2935                                     BranchInst *BI) {
2936   assert(BI->getNumSuccessors() == 2 && "Wrong number of successors?");
2937   assert(BI->isConditional() && "Unconditional branch has 2 successors?");
2938   Value *GuardCond = Guard->getArgOperand(0);
2939   Value *BranchCond = BI->getCondition();
2940   BasicBlock *TrueDest = BI->getSuccessor(0);
2941   BasicBlock *FalseDest = BI->getSuccessor(1);
2942 
2943   auto &DL = BB->getModule()->getDataLayout();
2944   bool TrueDestIsSafe = false;
2945   bool FalseDestIsSafe = false;
2946 
2947   // True dest is safe if BranchCond => GuardCond.
2948   auto Impl = isImpliedCondition(BranchCond, GuardCond, DL);
2949   if (Impl && *Impl)
2950     TrueDestIsSafe = true;
2951   else {
2952     // False dest is safe if !BranchCond => GuardCond.
2953     Impl = isImpliedCondition(BranchCond, GuardCond, DL, /* LHSIsTrue */ false);
2954     if (Impl && *Impl)
2955       FalseDestIsSafe = true;
2956   }
2957 
2958   if (!TrueDestIsSafe && !FalseDestIsSafe)
2959     return false;
2960 
2961   BasicBlock *PredUnguardedBlock = TrueDestIsSafe ? TrueDest : FalseDest;
2962   BasicBlock *PredGuardedBlock = FalseDestIsSafe ? TrueDest : FalseDest;
2963 
2964   ValueToValueMapTy UnguardedMapping, GuardedMapping;
2965   Instruction *AfterGuard = Guard->getNextNode();
2966   unsigned Cost = getJumpThreadDuplicationCost(BB, AfterGuard, BBDupThreshold);
2967   if (Cost > BBDupThreshold)
2968     return false;
2969   // Duplicate all instructions before the guard and the guard itself to the
2970   // branch where implication is not proved.
2971   BasicBlock *GuardedBlock = DuplicateInstructionsInSplitBetween(
2972       BB, PredGuardedBlock, AfterGuard, GuardedMapping, *DTU);
2973   assert(GuardedBlock && "Could not create the guarded block?");
2974   // Duplicate all instructions before the guard in the unguarded branch.
2975   // Since we have successfully duplicated the guarded block and this block
2976   // has fewer instructions, we expect it to succeed.
2977   BasicBlock *UnguardedBlock = DuplicateInstructionsInSplitBetween(
2978       BB, PredUnguardedBlock, Guard, UnguardedMapping, *DTU);
2979   assert(UnguardedBlock && "Could not create the unguarded block?");
2980   LLVM_DEBUG(dbgs() << "Moved guard " << *Guard << " to block "
2981                     << GuardedBlock->getName() << "\n");
2982   // Some instructions before the guard may still have uses. For them, we need
2983   // to create Phi nodes merging their copies in both guarded and unguarded
2984   // branches. Those instructions that have no uses can be just removed.
2985   SmallVector<Instruction *, 4> ToRemove;
2986   for (auto BI = BB->begin(); &*BI != AfterGuard; ++BI)
2987     if (!isa<PHINode>(&*BI))
2988       ToRemove.push_back(&*BI);
2989 
2990   Instruction *InsertionPoint = &*BB->getFirstInsertionPt();
2991   assert(InsertionPoint && "Empty block?");
2992   // Substitute with Phis & remove.
2993   for (auto *Inst : reverse(ToRemove)) {
2994     if (!Inst->use_empty()) {
2995       PHINode *NewPN = PHINode::Create(Inst->getType(), 2);
2996       NewPN->addIncoming(UnguardedMapping[Inst], UnguardedBlock);
2997       NewPN->addIncoming(GuardedMapping[Inst], GuardedBlock);
2998       NewPN->insertBefore(InsertionPoint);
2999       Inst->replaceAllUsesWith(NewPN);
3000     }
3001     Inst->eraseFromParent();
3002   }
3003   return true;
3004 }
3005