[llvm-bugs] [Bug 32721] New: IfConversion creating bad CFG when merging triangle

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=32721

            Bug ID: 32721
           Summary: IfConversion creating bad CFG when merging triangle
           Product: new-bugs
           Version: unspecified
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: new bugs
          Assignee: unassignedbugs at nondot.org
          Reporter: mikael.holmen at ericsson.com
                CC: llvm-bugs at lists.llvm.org

Created attachment 18319
  --> https://bugs.llvm.org/attachment.cgi?id=18319&action=edit
Reproducer

Repriduce with

llc -mtriple thumbv7-apple-ios ifcvt_triangle_false_return.mir
-run-pass=if-converter -o - -debug

This yields

  bb.0:
    successors: %bb.1(0x80000000)


  bb.1:
    successors: %bb.2(0x40000000), %bb.1(0x00000000)

    BX_RET 14, _, implicit killed %r0

  bb.2:

Looking at bb.1, we have a single unconditional return, but bb.1 still has two
successors? This seems wrong to me.

The situation occurs since BX_RET is a return instruction that ARM's
analyzeBranch
implementation returns true for so the IfConversion call to
RemoveExtraEdges(BBI)
won't do anything, and thus leave the CFG is a bad state.

There are some calls to removeSuccessor() here and there in IfConversion.cpp:

    // RemoveExtraEdges won't work if the block has an unanalyzable branch, so
    // explicitly remove CvtBBI as a successor.
    BBI.BB->removeSuccessor(&CvtMBB, true);

but none of them catch this case.

(Originally found when compiling for my out-of-tree backend, so I created a MIR
test case and modified it to expose the problem also on ARM.)

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20170420/977605a9/attachment.html>