[PATCH] D49555: [GVNHoist] safeToHoistLdSt incorrectly checks whether a defining access dominates the insertion point

[Alexandros Lamprineas via Phabricator via llvm-commits]

labrinea created this revision.
labrinea added reviewers: llvm-commits, hiraditya, sebpop.

Bug fix for PR36787. The regression test is a reduced version of the original reproducer attached to the bug report. When reasoning if it's safe to hoist a load we want to make sure that the defining memory access dominates the new insertion point of the hoisted instruction. `safeToHoistLdSt` calls `firstInBB(InsertionPoint,DefiningAccess)` which returns false if `InsertionPoint == DefiningAccess`, and therefore it falsely thinks it's safe to hoist.


https://reviews.llvm.org/D49555

Files:
  lib/Transforms/Scalar/GVNHoist.cpp
  test/Transforms/GVNHoist/pr36787.ll


Index: test/Transforms/GVNHoist/pr36787.ll
===================================================================
--- /dev/null
+++ test/Transforms/GVNHoist/pr36787.ll
@@ -0,0 +1,76 @@
+; RUN: opt < %s -gvn-hoist -S | FileCheck %s
+
+ at g = external dso_local constant i8*
+
+declare i32 @gxx_personality(...)
+declare dso_local void @f0()
+declare dso_local void @f1()
+declare dso_local void @f2()
+
+; Make sure opt won't crash and that the load
+; is not hoisted from label6 to label4
+
+;CHECK-LABEL: @func
+
+define dso_local void @func() personality i8* bitcast (i32 (...)* @gxx_personality to i8*) {
+  invoke void @f0()
+          to label %3 unwind label %1
+
+; <label>:1:
+  %2 = landingpad { i8*, i32 }
+          catch i8* bitcast (i8** @g to i8*)
+          catch i8* null
+  br label %16
+
+; <label>:3:
+  br i1 undef, label %4, label %10
+
+;CHECK:       <label>:4
+;CHECK-NEXT:    %5 = load i32*, i32** undef, align 8
+;CHECK-NEXT:    invoke void @f1()
+
+; <label>:4:
+  %5 = load i32*, i32** undef, align 8
+  invoke void @f1()
+          to label %6 unwind label %1
+
+;CHECK:       <label>:6
+;CHECK-NEXT:    %7 = load i32*, i32** undef, align 8
+;CHECK-NEXT:    %8 = load i32*, i32** undef, align 8
+
+; <label>:6:
+  %7 = load i32*, i32** undef, align 8
+  %8 = load i32*, i32** undef, align 8
+  br i1 true, label %9, label %17
+
+; <label>:9:
+  invoke void @f0()
+          to label %10 unwind label %1
+
+; <label>:10:
+  invoke void @f2()
+          to label %11 unwind label %1
+
+; <label>:11:
+  %12 = invoke signext i32 undef(i32* null, i32 signext undef, i1 zeroext undef)
+          to label %13 unwind label %14
+
+; <label>:13:
+  unreachable
+
+; <label>:14:
+  %15 = landingpad { i8*, i32 }
+          catch i8* bitcast (i8** @g to i8*)
+          catch i8* null
+  br label %16
+
+; <label>:16:
+  unreachable
+
+; <label>:17:
+  ret void
+
+; uselistorder directives
+  uselistorder void ()* @f0, { 1, 0 }
+  uselistorder label %1, { 0, 3, 1, 2 }
+}
Index: lib/Transforms/Scalar/GVNHoist.cpp
===================================================================
--- lib/Transforms/Scalar/GVNHoist.cpp
+++ lib/Transforms/Scalar/GVNHoist.cpp
@@ -534,7 +534,7 @@
 
     if (NewBB == DBB && !MSSA->isLiveOnEntryDef(D))
       if (auto *UD = dyn_cast<MemoryUseOrDef>(D))
-        if (firstInBB(NewPt, UD->getMemoryInst()))
+        if (!firstInBB(UD->getMemoryInst(), NewPt))
           // Cannot move the load or store to NewPt above its definition in D.
           return false;
 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D49555.156292.patch
Type: text/x-patch
Size: 2513 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20180719/37aaf3cc/attachment.bin>