[CodeGen] Fix partial phi input removal in TailDuplicator. (#158265)

ivafanas · web-flow · commit ffcaeca90a3c · 2025-09-13T10:45:54.000+09:00
Tail duplicator removes the first PHI income from the predecessor basic block, while it should remove all operands for this block. PHI instructions happen to have duplicated values for the same predecessor block: * `UnreachableMachineBlockElim` assumes that PHI instruction might have duplicates: https://github.com/llvm/llvm-project/blob/7289f2cd0c371b2539faa628ec0eea58fa61892c/llvm/lib/CodeGen/UnreachableBlockElim.cpp#L160 * `AArch64` directly states that PHI instruction might have duplicates: https://github.com/llvm/llvm-project/blob/7289f2cd0c371b2539faa628ec0eea58fa61892c/llvm/lib/Target/AArch64/AArch64ConditionalCompares.cpp#L244 * And `Hexagon`: https://github.com/llvm/llvm-project/blob/7289f2cd0c371b2539faa628ec0eea58fa61892c/llvm/lib/Target/Hexagon/HexagonConstPropagation.cpp#L844 We have caught the bug on custom out-of-tree backend. `TailDuplicator` should remove all operands corresponding to the removing block. Please note, that bug likely does not affect in-tree backends, because: * It happens only in scenario of **partial** tail duplication (i.e. tail block is duplicated in some predecessors, but not in all of them) * It happens in **Pre-RA** tail duplication only (Post-RA does not contain PHIs, obviously) * The only backend (I know) uses Pre-RA tail duplication is X86. It uses tail duplication via `early-tailduplication` pass which declines partial tail duplication via `canCompletelyDuplicateBB` check, because it uses `TailDuplicator::tailDuplicateBlocks` public API. So, bug happens only in the case of pre-ra partial tail duplication if backend uses `TailDuplicator::tailDuplicate` public API directly. That's why I can not add reproducer test for in-tree backends.
diff --git a/llvm/lib/CodeGen/TailDuplicator.cpp b/llvm/lib/CodeGen/TailDuplicator.cpp
@@ -375,9 +375,14 @@ void TailDuplicator::processPHI(
   if (!Remove)
     return;
 
-  // Remove PredBB from the PHI node.
-  MI->removeOperand(SrcOpIdx + 1);
-  MI->removeOperand(SrcOpIdx);
+  // MI might have multiple entries for PredBB. Need to remove them all.
+  for (unsigned N = MI->getNumOperands(); N > 2; N -= 2) {
+    if (MI->getOperand(N - 1).getMBB() == PredBB) {
+      MI->removeOperand(N - 1);
+      MI->removeOperand(N - 2);
+    }
+  }
+
   if (MI->getNumOperands() == 1 && !TailBB->hasAddressTaken())
     MI->eraseFromParent();
   else if (MI->getNumOperands() == 1)
