Fix a crash in which a multiplication was being reported as being both negative

and positive: positive, because it could be directly computed to be positive;
negative, because the nsw flags means it is either negative or undefined (the
multiplication always overflowed).


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@145104 91177308-0d34-0410-b5e6-96231b3b80d8

lib/Analysis/ValueTracking.cpp

@@ -248,9 +248,14 @@ void llvm::ComputeMaskedBits(Value *V, const APInt &Mask,
                 APInt::getHighBitsSet(BitWidth, LeadZ);
     KnownZero &= Mask;
 
-    if (isKnownNonNegative)
+    // Only make use of no-wrap flags if we failed to compute the sign bit
+    // directly.  This matters if the multiplication always overflows, in
+    // which case we prefer to follow the result of the direct computation,
+    // though as the program is invoking undefined behaviour we can choose
+    // whatever we like here.
+    if (isKnownNonNegative && !KnownOne.isNegative())
       KnownZero.setBit(BitWidth - 1);
-    else if (isKnownNegative)
+    else if (isKnownNegative && !KnownZero.isNegative())
       KnownOne.setBit(BitWidth - 1);
 
     return;

test/Transforms/InstSimplify/2011-11-23-MaskedBitsCrash.ll

@@ -0,0 +1,17 @@
+; RUN: opt < %s -instsimplify
+
+; The mul can be proved to always overflow (turning a negative value
+; into a positive one) and thus results in undefined behaviour.  At
+; the same time we were deducing from the nsw flag that that mul could
+; be assumed to have a negative value (since if not it has an undefined
+; value, which can be taken to be negative).  We were reporting the mul
+; as being both positive and negative, firing an assertion!
+define i1 @test1(i32 %a) {
+entry:
+  %0 = or i32 %a, 1
+  %1 = shl i32 %0, 31
+  %2 = mul nsw i32 %1, 4
+  %3 = and i32 %2, -4
+  %4 = icmp ne i32 %3, 0
+  ret i1 %4
+}