[PATCH] D41112: [FuzzMutate] Correctly split landingpad blocks

[Igor Laevsky via Phabricator via llvm-commits]

igor-laevsky created this revision.
igor-laevsky added a reviewer: bogner.

When splitting block with landingpad instruction we will make a conditional branch back into it. This is wrong because landingpad blocks can only be branched from the exception handling instructions. 
In this change I added early bailout from the split operation for the landingpad blocks. That way we will split them but will not add conditional branch at the end. On the next iterations we may split the new block which will no longer be a landingpad and we will treat it as usual.


Repository:
  rL LLVM

https://reviews.llvm.org/D41112

Files:
  lib/FuzzMutate/Operations.cpp
  unittests/FuzzMutate/OperationsTest.cpp


Index: unittests/FuzzMutate/OperationsTest.cpp
===================================================================
--- unittests/FuzzMutate/OperationsTest.cpp
+++ unittests/FuzzMutate/OperationsTest.cpp
@@ -211,6 +211,35 @@
   EXPECT_FALSE(verifyModule(M, &errs()));
 }
 
+TEST(OperationsTest, SplitEHBlock) {
+  // Check that we will not try to branch back to the landingpad block using
+  // regular branch instruction
+
+  LLVMContext Ctx;
+  const char *SourceCode =
+      "declare i32* @f()"
+      "declare i32 @personality_function()"
+      "define i32* @test() personality i32 ()* @personality_function {\n"
+      "entry:\n"
+      "  %val = invoke i32* @f()\n"
+      "          to label %normal unwind label %exceptional\n"
+      "normal:\n"
+      "  ret i32* %val\n"
+      "exceptional:\n"
+      "  %landing_pad4 = landingpad token cleanup\n"
+      "  ret i32* undef\n"
+      "}";
+  auto M = parseAssembly(SourceCode, Ctx);
+
+  // Get the landingpad block
+  BasicBlock &BB = *std::next(M->getFunction("test")->begin(), 2);
+
+  fuzzerop::OpDescriptor Descr = fuzzerop::splitBlockDescriptor(1);
+
+  Descr.BuilderFunc({ConstantInt::getTrue(Ctx)},&*BB.getFirstInsertionPt());
+  ASSERT_TRUE(!verifyModule(*M, &errs()));
+}
+
 TEST(OperationsTest, SplitBlockWithPhis) {
   LLVMContext Ctx;
 
Index: lib/FuzzMutate/Operations.cpp
===================================================================
--- lib/FuzzMutate/Operations.cpp
+++ lib/FuzzMutate/Operations.cpp
@@ -142,9 +142,14 @@
   auto buildSplitBlock = [](ArrayRef<Value *> Srcs, Instruction *Inst) {
     BasicBlock *Block = Inst->getParent();
     BasicBlock *Next = Block->splitBasicBlock(Inst, "BB");
+
+    // If it was an exception handling block, we are done.
+    if (Block->isEHPad())
+      return nullptr;
+
+    // Loop back on this block by replacing the unconditional forward branch
+    // with a conditional with a backedge.
     if (Block != &Block->getParent()->getEntryBlock()) {
-      // Loop back on this block by replacing the unconditional forward branch
-      // with a conditional with a backedge.
       BranchInst::Create(Block, Next, Srcs[0], Block->getTerminator());
       Block->getTerminator()->eraseFromParent();
 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D41112.126533.patch
Type: text/x-patch
Size: 2229 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20171212/0940ea75/attachment.bin>