[llvm] r231759 - Fix an issue in the verifier where we could try to read information out of a malformed statepoint intrinsic.

[Owen Anderson]

Author: resistor
Date: Tue Mar 10 00:58:21 2015
New Revision: 231759

URL: http://llvm.org/viewvc/llvm-project?rev=231759&view=rev
Log:
Fix an issue in the verifier where we could try to read information out of a malformed statepoint intrinsic.

In this situation we would always have already flagged an error on the statepoint intrinsic,
but then we carry on to parse other, related GC intrinsics, and could end up crashing during that
verification when they try to access data from the malformed statepoint.

Added:
    llvm/trunk/test/Verifier/invalid-statepoint.ll
Modified:
    llvm/trunk/lib/IR/Verifier.cpp

Modified: llvm/trunk/lib/IR/Verifier.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/IR/Verifier.cpp?rev=231759&r1=231758&r2=231759&view=diff
==============================================================================
--- llvm/trunk/lib/IR/Verifier.cpp (original)
+++ llvm/trunk/lib/IR/Verifier.cpp Tue Mar 10 00:58:21 2015
@@ -2969,8 +2969,12 @@ void Verifier::visitIntrinsicFunctionCal
 
     // Check that BaseIndex and DerivedIndex fall within the 'gc parameters'
     // section of the statepoint's argument
-    const int NumCallArgs =
+    Assert(StatepointCS.arg_size() > 0,
+           "gc.statepoint: insufficient arguments");
+    const unsigned NumCallArgs =
       cast<ConstantInt>(StatepointCS.getArgument(1))->getZExtValue();
+    Assert(StatepointCS.arg_size() > NumCallArgs+3,
+           "gc.statepoint: mismatch in number of call arguments");
     const int NumDeoptArgs =
       cast<ConstantInt>(StatepointCS.getArgument(NumCallArgs + 3))->getZExtValue();
     const int GCParamArgsStart = NumCallArgs + NumDeoptArgs + 4;

Added: llvm/trunk/test/Verifier/invalid-statepoint.ll
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Verifier/invalid-statepoint.ll?rev=231759&view=auto
==============================================================================
--- llvm/trunk/test/Verifier/invalid-statepoint.ll (added)
+++ llvm/trunk/test/Verifier/invalid-statepoint.ll Tue Mar 10 00:58:21 2015
@@ -0,0 +1,20 @@
+; RUN: not opt -verify 2>&1 < %s | FileCheck %s
+
+; CHECK: gc.statepoint: mismatch in number of call arguments 
+
+declare zeroext i1 @return0i1()
+
+; Function Attrs: nounwind
+declare i32 @llvm.experimental.gc.statepoint.p0f0i1f(i1 ()*, i32, i32, ...) #0
+
+; Function Attrs: nounwind
+declare i32 addrspace(1)* @llvm.experimental.gc.relocate.p1i32(i32, i32, i32) #0
+
+define i32 addrspace(1)* @0(i32 addrspace(1)* %dparam) {
+  %a00 = load i32, i32 addrspace(1)* %dparam
+  %to0 = call i32 (i1 ()*, i32, i32, ...)* @llvm.experimental.gc.statepoint.p0f0i1f(i1 ()* @return0i1, i32 9, i32 0, i2 0, i32 addrspace(1)* %dparam)
+  %relocate = call i32 addrspace(1)* @llvm.experimental.gc.relocate.p1i32(i32 %to0, i32 0, i32 4)
+  ret i32 addrspace(1)* %relocate
+}
+
+attributes #0 = { nounwind }