[InstComb] Fold inttoptr (add (ptrtoint %B), %O) -> GEP for ICMP users. #153421

fhahn · 2025-08-13T14:43:50Z

Replace inttoptr (add (ptrtoint %B), %O) with (getelementptr i8, %B, %o)
if all users are ICmp instruction, which in turn means only the address
value is compared. We should be able to do this, if the src pointer,
the integer type and the destination pointer types have the same
bitwidth and address space.

A common source of such (inttoptr (add (ptrtoint %B), %O)) is from
various iterations in libc++.

In practice this triggers in a number of files in Clang and various open
source projects, including cppcheck, diamond, llama and more.

Alive2 Proof with constant offset: https://alive2.llvm.org/ce/z/K_5N_B

llvmbot · 2025-08-13T14:44:24Z

@llvm/pr-subscribers-llvm-transforms

Author: Florian Hahn (fhahn)

Changes

Full diff: https://github.com/llvm/llvm-project/pull/153421.diff

2 Files Affected:

(modified) llvm/lib/Transforms/InstCombine/InstCombineCasts.cpp (+16)
(modified) llvm/test/Transforms/InstCombine/fold-bin-operand.ll (+151-1)

diff --git a/llvm/lib/Transforms/InstCombine/InstCombineCasts.cpp b/llvm/lib/Transforms/InstCombine/InstCombineCasts.cpp
index a43a6ee1f58b0..2edabcec2aecf 100644
--- a/llvm/lib/Transforms/InstCombine/InstCombineCasts.cpp
+++ b/llvm/lib/Transforms/InstCombine/InstCombineCasts.cpp
@@ -2073,6 +2073,22 @@ Instruction *InstCombinerImpl::visitIntToPtr(IntToPtrInst &CI) {
     return new IntToPtrInst(P, CI.getType());
   }
 
+  // Replace (inttoptr (add (ptrtoint %Base), %Offset)) with
+  //(getelementptr i8, %Base, %Offset) if all users are ICmps.
+  Value *Base;
+  Value *Offset;
+  if (match(CI.getOperand(0),
+            m_Add(m_PtrToInt(m_Value(Base)), m_Value(Offset))) &&
+      all_of(CI.users(), IsaPred<ICmpInst>)) {
+    Type *BasePtrTy = Base->getType();
+    if (CI.getType()->getPointerAddressSpace() ==
+            BasePtrTy->getPointerAddressSpace() &&
+        DL.getTypeSizeInBits(BasePtrTy) ==
+            DL.getTypeSizeInBits(CI.getSrcTy())) {
+      return GetElementPtrInst::Create(Builder.getInt8Ty(), Base, Offset);
+    }
+  }
+
   if (Instruction *I = commonCastTransforms(CI))
     return I;
 
diff --git a/llvm/test/Transforms/InstCombine/fold-bin-operand.ll b/llvm/test/Transforms/InstCombine/fold-bin-operand.ll
index f28262b2a77e0..f596bc5d226be 100644
--- a/llvm/test/Transforms/InstCombine/fold-bin-operand.ll
+++ b/llvm/test/Transforms/InstCombine/fold-bin-operand.ll
@@ -1,6 +1,6 @@
 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
 ; RUN: opt < %s -passes=instcombine -S | FileCheck %s
-target datalayout = "E-p:64:64:64-a0:0:8-f32:32:32-f64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-v64:64:64-v128:128:128"
+target datalayout = "E-p:64:64:64-p1:64:64:64-a0:0:8-f32:32:32-f64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-v64:64:64-v128:128:128"
 
 define i1 @f(i1 %x) {
 ; CHECK-LABEL: @f(
@@ -30,6 +30,156 @@ define i32 @g(i32 %x) {
   ret i32 %b
 }
 
+define i1 @inttoptr_add_ptrtoint_used_by_single_icmp(ptr %src, ptr %p2) {
+; CHECK-LABEL: @inttoptr_add_ptrtoint_used_by_single_icmp(
+; CHECK-NEXT:    [[P2:%.*]] = getelementptr i8, ptr [[SRC:%.*]], i64 10
+; CHECK-NEXT:    [[C:%.*]] = icmp eq ptr [[P2]], [[P:%.*]]
+; CHECK-NEXT:    ret i1 [[C]]
+;
+  %i = ptrtoint ptr %src to i64
+  %a = add i64 %i, 10
+  %p = inttoptr i64 %a to ptr
+  %c = icmp eq ptr %p, %p2
+  ret i1 %c
+}
+
+define i1 @inttoptr_add_ptrtoint_used_by_single_icmp_different_src_address_spaces(ptr addrspace(1) %src, ptr %p2) {
+; CHECK-LABEL: @inttoptr_add_ptrtoint_used_by_single_icmp_different_src_address_spaces(
+; CHECK-NEXT:    [[I:%.*]] = ptrtoint ptr addrspace(1) [[SRC:%.*]] to i64
+; CHECK-NEXT:    [[A:%.*]] = add i64 [[I]], 10
+; CHECK-NEXT:    [[P:%.*]] = inttoptr i64 [[A]] to ptr
+; CHECK-NEXT:    [[C:%.*]] = icmp eq ptr [[P2:%.*]], [[P]]
+; CHECK-NEXT:    ret i1 [[C]]
+;
+  %i = ptrtoint ptr addrspace(1) %src to i64
+  %a = add i64 %i, 10
+  %p = inttoptr i64 %a to ptr
+  %c = icmp eq ptr %p, %p2
+  ret i1 %c
+}
+
+define i1 @inttoptr_add_ptrtoint_used_by_single_icmp_different_dst_address_spaces(ptr %src, ptr addrspace(1) %p2) {
+; CHECK-LABEL: @inttoptr_add_ptrtoint_used_by_single_icmp_different_dst_address_spaces(
+; CHECK-NEXT:    [[I:%.*]] = ptrtoint ptr [[SRC:%.*]] to i64
+; CHECK-NEXT:    [[A:%.*]] = add i64 [[I]], 10
+; CHECK-NEXT:    [[P:%.*]] = inttoptr i64 [[A]] to ptr addrspace(1)
+; CHECK-NEXT:    [[C:%.*]] = icmp eq ptr addrspace(1) [[P2:%.*]], [[P]]
+; CHECK-NEXT:    ret i1 [[C]]
+;
+  %i = ptrtoint ptr %src to i64
+  %a = add i64 %i, 10
+  %p = inttoptr i64 %a to ptr addrspace(1)
+  %c = icmp eq ptr addrspace(1) %p, %p2
+  ret i1 %c
+}
+
+define i1 @inttoptr_add_ptrtoint_used_by_single_icmp_int_type_does_not_match_ptr_ty(ptr %src, ptr %p2) {
+; CHECK-LABEL: @inttoptr_add_ptrtoint_used_by_single_icmp_int_type_does_not_match_ptr_ty(
+; CHECK-NEXT:    [[TMP1:%.*]] = ptrtoint ptr [[SRC:%.*]] to i64
+; CHECK-NEXT:    [[I:%.*]] = trunc i64 [[TMP1]] to i8
+; CHECK-NEXT:    [[A:%.*]] = add i8 [[I]], 10
+; CHECK-NEXT:    [[TMP2:%.*]] = zext i8 [[A]] to i64
+; CHECK-NEXT:    [[P:%.*]] = inttoptr i64 [[TMP2]] to ptr
+; CHECK-NEXT:    [[C:%.*]] = icmp eq ptr [[P2:%.*]], [[P]]
+; CHECK-NEXT:    ret i1 [[C]]
+;
+  %i = ptrtoint ptr %src to i8
+  %a = add i8 %i, 10
+  %p = inttoptr i8 %a to ptr
+  %c = icmp eq ptr %p, %p2
+  ret i1 %c
+}
+
+define i1 @multiple_inttoptr_add_ptrtoint_used_by_single_icmp(ptr %src) {
+; CHECK-LABEL: @multiple_inttoptr_add_ptrtoint_used_by_single_icmp(
+; CHECK-NEXT:    ret i1 false
+;
+  %i = ptrtoint ptr %src to i64
+  %a = add i64 %i, 10
+  %p = inttoptr i64 %a to ptr
+  %a.2 = add i64 %i, 11
+  %p.2 = inttoptr i64 %a.2 to ptr
+  %c = icmp eq ptr %p, %p.2
+  ret i1 %c
+}
+
+define i1 @multiple_inttoptr_add_ptrtoint_used_by_single_icmp_non_constant_offset(ptr %src, i64 %off.1, i64 %off.2) {
+; CHECK-LABEL: @multiple_inttoptr_add_ptrtoint_used_by_single_icmp_non_constant_offset(
+; CHECK-NEXT:    [[C:%.*]] = icmp eq i64 [[OFF_1:%.*]], [[OFF_2:%.*]]
+; CHECK-NEXT:    ret i1 [[C]]
+;
+  %i = ptrtoint ptr %src to i64
+  %a = add i64 %i, %off.1
+  %p = inttoptr i64 %a to ptr
+  %a.2 = add i64 %i, %off.2
+  %p.2 = inttoptr i64 %a.2 to ptr
+  %c = icmp eq ptr %p, %p.2
+  ret i1 %c
+}
+
+define i1 @inttoptr_add_ptrtoint_used_by_single_icmp_in_different_bb(i1 %bc, ptr %src, ptr %p2) {
+; CHECK-LABEL: @inttoptr_add_ptrtoint_used_by_single_icmp_in_different_bb(
+; CHECK-NEXT:    br i1 [[BC:%.*]], label [[THEN:%.*]], label [[ELSE:%.*]]
+; CHECK:       then:
+; CHECK-NEXT:    [[P2:%.*]] = getelementptr i8, ptr [[SRC:%.*]], i64 10
+; CHECK-NEXT:    [[C:%.*]] = icmp eq ptr [[P2]], [[P:%.*]]
+; CHECK-NEXT:    ret i1 [[C]]
+; CHECK:       else:
+; CHECK-NEXT:    ret i1 false
+;
+  %i = ptrtoint ptr %src to i64
+  %a = add i64 %i, 10
+  %p = inttoptr i64 %a to ptr
+  br i1 %bc, label %then, label %else
+
+then:
+  %c = icmp eq ptr %p, %p2
+  ret i1 %c
+
+else:
+  ret i1 false
+}
+
+define i1 @inttoptr_add_ptrtoint_used_by_multiple_icmps(ptr %src, ptr %p2, ptr %p3) {
+; CHECK-LABEL: @inttoptr_add_ptrtoint_used_by_multiple_icmps(
+; CHECK-NEXT:    [[P2:%.*]] = getelementptr i8, ptr [[SRC:%.*]], i64 10
+; CHECK-NEXT:    [[C_1:%.*]] = icmp eq ptr [[P2]], [[P:%.*]]
+; CHECK-NEXT:    [[C_2:%.*]] = icmp eq ptr [[P2]], [[P3:%.*]]
+; CHECK-NEXT:    [[XOR:%.*]] = xor i1 [[C_1]], [[C_2]]
+; CHECK-NEXT:    ret i1 [[XOR]]
+;
+  %i = ptrtoint ptr %src to i64
+  %a = add i64 %i, 10
+  %p = inttoptr i64 %a to ptr
+  %c.1 = icmp eq ptr %p, %p2
+  %c.2 = icmp eq ptr %p, %p3
+  %xor = xor i1 %c.1, %c.2
+  ret i1 %xor
+}
+
+declare void @foo(ptr)
+
+define i1 @inttoptr_add_ptrtoint_used_by_multiple_icmps_and_other_user(ptr %src, ptr %p2, ptr %p3) {
+; CHECK-LABEL: @inttoptr_add_ptrtoint_used_by_multiple_icmps_and_other_user(
+; CHECK-NEXT:    [[TMP1:%.*]] = ptrtoint ptr [[SRC:%.*]] to i64
+; CHECK-NEXT:    [[TMP2:%.*]] = add i64 [[TMP1]], 10
+; CHECK-NEXT:    [[P:%.*]] = inttoptr i64 [[TMP2]] to ptr
+; CHECK-NEXT:    [[C_1:%.*]] = icmp eq ptr [[P2:%.*]], [[P]]
+; CHECK-NEXT:    [[C_2:%.*]] = icmp eq ptr [[P3:%.*]], [[P]]
+; CHECK-NEXT:    [[XOR:%.*]] = xor i1 [[C_1]], [[C_2]]
+; CHECK-NEXT:    call void @foo(ptr [[P]])
+; CHECK-NEXT:    ret i1 [[XOR]]
+;
+  %i = ptrtoint ptr %src to i64
+  %a = add i64 %i, 10
+  %p = inttoptr i64 %a to ptr
+  %c.1 = icmp eq ptr %p, %p2
+  %c.2 = icmp eq ptr %p, %p3
+  %xor = xor i1 %c.1, %c.2
+  call void @foo(ptr %p)
+  ret i1 %xor
+}
+
 define i32 @h(i1 %A, i32 %B) {
 ; CHECK-LABEL: @h(
 ; CHECK-NEXT:  EntryBlock:

dtcxzyw

Can you share the original IR for libc++ or other projects? I'd expect that %B and the other operand of icmp share the same underlying object. If so, it should be handled by foldGEPICmp.

BTW, the title is misleading. It works only if the provenance doesn't matter: https://alive2.llvm.org/ce/z/9GK5la

dtcxzyw · 2025-08-13T15:35:57Z

llvm/lib/Transforms/InstCombine/InstCombineCasts.cpp

Use m_PtrToIntSameSize: https://alive2.llvm.org/ce/z/6fTkhq

Updated to use m_PtrToIntSameSize and removed the size check below, thanks!

dtcxzyw · 2025-08-13T16:14:18Z

I'd expect that %B and the other operand of icmp share the same underlying object. If so, it should be handled by foldGEPICmp.

It isn't always true. The base pointers may be loaded from a data structure (e.g., _M_start and _M_finish in libstdc++'s vector implementation).

fhahn

BTW, the title is misleading. It works only if the provenance doesn't matter: https://alive2.llvm.org/ce/z/9GK5la

Hmm, Try should imply that it is not always possible. Do you have any suggestions on how to clarify the title?

fhahn · 2025-08-13T20:35:14Z

llvm/lib/Transforms/InstCombine/InstCombineCasts.cpp

Updated to use m_PtrToIntSameSize and removed the size check below, thanks!

jcranmer-intel · 2025-08-13T21:04:07Z

Hmm, Try should imply that it is not always possible. Do you have any suggestions on how to clarify the title?

"Try to convert inttoptr(add(ptrtoint)) to GEP when provenance doesn't matter"?

fhahn · 2025-08-14T10:40:56Z

Try to convert inttoptr(add(ptrtoint)) to GEP when provenance doesn't matter"

I generally try to keep the length <= 72 chars, to avoid truncation in some clients. Updated to [InstComb] Fold inttoptr (add (ptrtoint %B), %O) -> GEP for ICMP users.

fhahn · 2025-08-14T10:46:50Z

For this to be really useful we need to allow a few more cases where the pointer is only used as integer: #153566

This allows vectorizing std::find in some cases.

fhahn · 2025-08-21T10:40:23Z

ping :)

dtcxzyw · 2025-08-21T12:41:24Z

llvm/lib/Transforms/InstCombine/InstCombineCasts.cpp

Suggested change

m_Add(m_PtrToIntSameSize(DL, m_Value(Base)), m_Value(Offset))) &&

m_c_Add(m_PtrToIntSameSize(DL, m_Value(Base)), m_Value(Offset))) &&

Please add some commuted tests.

Done thanks

Precommit tests for #153421.

nikic · 2025-08-21T14:50:02Z

llvm/lib/Transforms/InstCombine/InstCombineCasts.cpp

Should this have a one use check on the add? Otherwise we can end up with both the add and the gep.

yeah added, thanks

Replace inttoptr (add (ptrtoint %B), %O) with (getelementptr i8, %B, %o) if all users are ICmp instruction, which in turn means only the address value is compared. We should be able to do this, if the src pointer, the integer type and the destination pointer types have the same bitwidth and address space. A common source of such (inttoptr (add (ptrtoint %B), %O)) is from various iterations in libc++. In practice this triggers in a number of files in Clang and various open source projects, including cppcheck, diamond, llama and more. Alive2 Proof with constant offset: https://alive2.llvm.org/ce/z/K_5N_B

…), %Offset)). Precommit tests for llvm/llvm-project#153421.

nikic

LGTM

…r ICMP users. (#153421) Replace inttoptr (add (ptrtoint %B), %O) with (getelementptr i8, %B, %o) if all users are ICmp instruction, which in turn means only the address value is compared. We should be able to do this, if the src pointer, the integer type and the destination pointer types have the same bitwidth and address space. A common source of such (inttoptr (add (ptrtoint %B), %O)) is from various iterations in libc++. In practice this triggers in a number of files in Clang and various open source projects, including cppcheck, diamond, llama and more. Alive2 Proof with constant offset: https://alive2.llvm.org/ce/z/K_5N_B PR: llvm/llvm-project#153421

Generalize the logic from llvm#153421 to support additional cases where the pointer is only used as integer. Alive2 Proof: https://alive2.llvm.org/ce/z/po58pP This enables vectorizing std::find for some cases, if additional assumptions are provided: https://godbolt.org/z/94oq3576E Depends on llvm#153421 (included in the PR).

…rm. (#153566) Generalize the logic from #153421 to support additional cases where the pointer is only used as integer. Alive2 Proof: https://alive2.llvm.org/ce/z/po58pP This enables vectorizing std::find for some cases, if additional assumptions are provided: https://godbolt.org/z/94oq3576E Depends on #15342. PR: #153566

…GEP transform. (#153566) Generalize the logic from llvm/llvm-project#153421 to support additional cases where the pointer is only used as integer. Alive2 Proof: https://alive2.llvm.org/ce/z/po58pP This enables vectorizing std::find for some cases, if additional assumptions are provided: https://godbolt.org/z/94oq3576E Depends on llvm/llvm-project#15342. PR: llvm/llvm-project#153566

…s. (llvm#153421) Replace inttoptr (add (ptrtoint %B), %O) with (getelementptr i8, %B, %o) if all users are ICmp instruction, which in turn means only the address value is compared. We should be able to do this, if the src pointer, the integer type and the destination pointer types have the same bitwidth and address space. A common source of such (inttoptr (add (ptrtoint %B), %O)) is from various iterations in libc++. In practice this triggers in a number of files in Clang and various open source projects, including cppcheck, diamond, llama and more. Alive2 Proof with constant offset: https://alive2.llvm.org/ce/z/K_5N_B PR: llvm#153421 (cherry picked from commit 1b0b59a)

…rm. (llvm#153566) Generalize the logic from llvm#153421 to support additional cases where the pointer is only used as integer. Alive2 Proof: https://alive2.llvm.org/ce/z/po58pP This enables vectorizing std::find for some cases, if additional assumptions are provided: https://godbolt.org/z/94oq3576E Depends on llvm#15342. PR: llvm#153566 (cherry picked from commit 8bc038d)

fhahn requested review from dtcxzyw and nikic August 13, 2025 14:43

llvmbot added llvm:instcombine Covers the InstCombine, InstSimplify and AggressiveInstCombine passes llvm:transforms labels Aug 13, 2025

fhahn changed the title ~~Ic inttoptr add~~ [InstComb] Try to convert inttoptr (add (ptrtoint %B), %O) to GEP. Aug 13, 2025

dtcxzyw reviewed Aug 13, 2025

View reviewed changes

dtcxzyw mentioned this pull request Aug 13, 2025

Task submission dtcxzyw/llvm-opt-benchmark#1312

Open

zyw-bot mentioned this pull request Aug 13, 2025

pre-commit: PR153421 dtcxzyw/llvm-opt-benchmark#2669

Closed

fhahn force-pushed the ic-inttoptr-add branch from 7192930 to 89b8c4a Compare August 13, 2025 20:28

fhahn commented Aug 13, 2025

View reviewed changes

fhahn force-pushed the ic-inttoptr-add branch from 89b8c4a to 1ca1c3b Compare August 14, 2025 10:34

fhahn mentioned this pull request Aug 14, 2025

[InstComb] Allow more user for (add (ptrtoint %B), %O) to GEP transform. #153566

Merged

fhahn force-pushed the ic-inttoptr-add branch from 1ca1c3b to 3cdc4c7 Compare August 14, 2025 10:40

fhahn changed the title ~~[InstComb] Try to convert inttoptr (add (ptrtoint %B), %O) to GEP.~~ [InstComb] Fold inttoptr (add (ptrtoint %B), %O) -> GEP for ICMP users. Aug 14, 2025

dtcxzyw approved these changes Aug 21, 2025

View reviewed changes

dtcxzyw mentioned this pull request Aug 21, 2025

Fuzz PR153421 dtcxzyw/llvm-mutation-based-fuzz-service#85

Closed

fhahn added a commit that referenced this pull request Aug 21, 2025

[InstCombine] Add tests for (inttoptr (add (ptrtoint %Base), %Offset)).

cfef05e

Precommit tests for #153421.

fhahn force-pushed the ic-inttoptr-add branch from 3cdc4c7 to c283423 Compare August 21, 2025 14:45

nikic reviewed Aug 21, 2025

View reviewed changes

fhahn added 4 commits August 21, 2025 16:02

!fixup use m_PtrToIntSameSize

5ed4d71

!fixup use m_c_Add

c012a9c

!fixup check add has one use.

9d16660

fhahn force-pushed the ic-inttoptr-add branch from c283423 to 9d16660 Compare August 21, 2025 15:08

llvm-sync bot pushed a commit to arm/arm-toolchain that referenced this pull request Aug 21, 2025

Automerge: [InstCombine] Add tests for (inttoptr (add (ptrtoint %Base…

bd1b588

…), %Offset)). Precommit tests for llvm/llvm-project#153421.

nikic approved these changes Aug 21, 2025

View reviewed changes

fhahn merged commit 1b0b59a into llvm:main Aug 21, 2025
9 checks passed

fhahn deleted the ic-inttoptr-add branch September 5, 2025 09:00

	m_Add(m_PtrToIntSameSize(DL, m_Value(Base)), m_Value(Offset))) &&
	m_c_Add(m_PtrToIntSameSize(DL, m_Value(Base)), m_Value(Offset))) &&

[InstComb] Fold inttoptr (add (ptrtoint %B), %O) -> GEP for ICMP users. #153421

[InstComb] Fold inttoptr (add (ptrtoint %B), %O) -> GEP for ICMP users. #153421

Uh oh!

Conversation

fhahn commented Aug 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

llvmbot commented Aug 13, 2025

Uh oh!

dtcxzyw left a comment

Choose a reason for hiding this comment

Uh oh!

dtcxzyw Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

fhahn Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

dtcxzyw commented Aug 13, 2025

Uh oh!

fhahn left a comment

Choose a reason for hiding this comment

Uh oh!

fhahn Aug 13, 2025

Choose a reason for hiding this comment

Uh oh!

jcranmer-intel commented Aug 13, 2025

Uh oh!

fhahn commented Aug 14, 2025

Uh oh!

fhahn commented Aug 14, 2025

Uh oh!

fhahn commented Aug 21, 2025

Uh oh!

dtcxzyw Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

fhahn Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

nikic Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

fhahn Aug 21, 2025

Choose a reason for hiding this comment

Uh oh!

nikic left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

fhahn commented Aug 13, 2025 •

edited

Loading