Bug in unroller's phi entries

[nunoplopes]

; Transforms/LoopFusion/cannot_fuse.ll

define float @test(float* nocapture %a, i32 %n) {
entry:
  %conv = zext i32 %n to i64
  %cmp32 = icmp eq i32 %n, 0
  br i1 %cmp32, label %for.cond.cleanup7, label %for.body

for.body:                                         ; preds = %for.body, %entry
  %i.034 = phi i64 [ %inc, %for.body ], [ 0, %entry ]
  %sum1.033 = phi float [ %add, %for.body ], [ 0.000000e+00, %entry ]
  %idxprom = trunc i64 %i.034 to i32
  %arrayidx = getelementptr inbounds float, float* %a, i32 %idxprom
  %0 = load float, float* %arrayidx, align 4
  %add = fadd float %sum1.033, %0
  %inc = add nuw nsw i64 %i.034, 1
  %cmp = icmp ult i64 %inc, %conv
  br i1 %cmp, label %for.body, label %for.body8

for.body8:                                        ; preds = %for.body, %for.body8
  %i2.031 = phi i64 [ %inc14, %for.body8 ], [ 0, %for.body ]
  %idxprom9 = trunc i64 %i2.031 to i32
  %arrayidx10 = getelementptr inbounds float, float* %a, i32 %idxprom9
  %1 = load float, float* %arrayidx10, align 4
  %div = fdiv float %1, %add
  store float %div, float* %arrayidx10, align 4
  %inc14 = add nuw nsw i64 %i2.031, 1
  %cmp5 = icmp ult i64 %inc14, %conv
  br i1 %cmp5, label %for.body8, label %for.cond.cleanup7

for.cond.cleanup7:                                ; preds = %for.body8, %entry
  %sum1.0.lcssa36 = phi float [ 0.000000e+00, %entry ], [ %add, %for.body8 ]
  ret float %sum1.0.lcssa36
}

unroller produces this:

%for.body8:
  %add#phi#0 = phi float [ %add, %for.body ], [ %add#2, %for.body#2 ]

%for.cond.cleanup7:
  %sum1.0.lcssa36 = phi float [ 0.000000, %entry ], [ %add#phi#0, %for.body8 ], [ %add, %for.body8#2 ]

Both entries of %for.body8* should point to the phi.

[regehr]

cc @zhengyang92

[nunoplopes]

Another case that the unroller gets wrong (unroll=2):

; Minimized from Transforms/LoopInterchange/pr43326.ll

define void @pr43326(i32 %a.promoted, [1 x [1 x i32]]* %e, i8* %b) {
for.body.lr.ph:
  br label %for.body

for.body:
  %inc1312 = phi i32 [ %a.promoted, %for.body.lr.ph ], [ %inc13, %for.inc12 ]
  br label %for.body3

for.body3:
  %xor.lcssa9 = phi i32 [ 0, %for.body ], [ %xor5, %for.end ]
  %dec7 = phi i8 [ 0, %for.body ], [ %dec, %for.end ]
  br label %for.body7

for.body7:
  %xor5 = phi i32 [ %xor.lcssa9, %for.body3 ], [ %xor5, %for.inc ]
  %inc4 = phi i32 [ 0, %for.body3 ], [ %inc, %for.inc ]
  %arrayidx9 = getelementptr inbounds [1 x [1 x i32]], [1 x [1 x i32]]* %e, i64 0, i32 %inc4, i8 %dec7
  br label %for.inc

for.inc:
  %inc = add nsw i32 %inc4, 1
  br i1 false, label %for.body7, label %for.end

for.end:
  %dec = add i8 %dec7, 1
  br i1 false, label %for.body3, label %for.end11

for.end11:
  %dec.lcssa = phi i8 [ 0, %for.end ]
  br label %for.inc12

for.inc12:
  %inc13 = add nsw i32 %inc1312, 1
  %tobool.not = icmp eq i32 %inc1312, 0
  br i1 %tobool.not, label %for.cond.for.end14_crit_edge, label %for.body

for.cond.for.end14_crit_edge:
  store i8 %dec.lcssa, i8* %b, align 1
  ret void
}

The unroller produces this (wrong);

%for.inc.split#2:
  %0#2 = add nsw i32 %inc4#2, 1
  br i1 0, label %for.body7#1#2#2, label %for.end11#2

%for.end11#2:
  %dec.lcssa#2 = phi i8 [ 0, %for.inc.split ], [ 0, %for.inc.split#1#2 ]
  br label %for.inc12#2

[regehr]

I'd really like to turn on the unroller in some mutation fuzzing runs but I've been reluctant to do it until we have these known bugs fixed. alas Zhengyang is fighting to finish up a paper before going to an internship, argh.

[nunoplopes]

Another case from LLVM's test suite:

./opt-alive-test.sh -S -passes=loop-simplify ~/llvm/llvm/test/Transforms/LoopFusion/cannot_fuse.ll -tv-src-unroll=2 -tv-tgt-unroll=2 -tv-disable-undef-input -tv-disable-poison-input

the last phi is wrong:

%for.body8:
  %add#phi#0 = phi float [ %add, %for.body ], [ %add#2, %for.body#2 ]

%for.body8#2:
  ; no %add, should use the one above as it dominates this BB

%for.cond.cleanup7:
  %sum1.0.lcssa36 = phi float [ 0.000000, %entry ], [ %add#phi#0, %for.body8 ], [ %add, %for.body8#2 ]
  ret float %sum1.0.lcssa36