<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Apr 24, 2012, at 11:48 AM, Douglas Gregor <<a href="mailto:dgregor@apple.com">dgregor@apple.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><meta http-equiv="Content-Type" content="text/html charset=us-ascii"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On Apr 24, 2012, at 11:46 AM, Chandler Carruth <<a href="mailto:chandlerc@gmail.com">chandlerc@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div class="gmail_extra">Hey Bill & Doug (cc-ed because it impacts only Clang / C++11 thus far),</div><div class="gmail_extra"><br></div><div class="gmail_extra">This commit (despite going to LLVM) fixes a crash-on-valid in C++11 mode. We hit this pretty early during stress testing of C++11 codegen, open source packages like aspell trigger it.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">Is this a good candidate for back-porting to the 3.1 branch?</div></blockquote><div><br></div>I think it's a good candidate for the 3.1 branch, but I can't approve it. Evan or Chris?</div></div></blockquote><div><br></div>I approve.</div><div><br></div><div>Evan</div><div><br><blockquote type="cite"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>- Doug</div><div><br><blockquote type="cite"><div class="gmail_extra">-Chandler<br><br><div class="gmail_quote">
On Tue, Apr 24, 2012 at 11:42 AM, Chandler Carruth <span dir="ltr"><<a href="mailto:chandlerc@gmail.com" target="_blank">chandlerc@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Author: chandlerc<br>
Date: Tue Apr 24 13:42:47 2012<br>
New Revision: 155466<br>
<br>
URL: <a href="http://llvm.org/viewvc/llvm-project?rev=155466&view=rev" target="_blank">http://llvm.org/viewvc/llvm-project?rev=155466&view=rev</a><br>
Log:<br>
Fix a crash on valid (if UB) bitcode that is produced for some global<br>
constants in C++11 mode. I have no idea why it required such particular<br>
circumstances to get here, the code seems clearly to rely upon unchecked<br>
assumptions.<br>
<br>
Specifically, when we decide to form an index into a struct type, we may<br>
have gone through (at least one) zero-length array indexing round, which<br>
would have left the offset un-adjusted, and thus not necessarily valid<br>
for use when indexing the struct type.<br>
<br>
This is just an canonicalization step, so the correct thing is to refuse<br>
to canonicalize nonsensical GEPs of this form. Implemented, and test<br>
case added.<br>
<br>
Fixes PR12642. Pair debugged and coded with Richard Smith. =] I credit<br>
him with most of the debugging, and preventing me from writing the wrong<br>
code.<br>
<br>
Modified:<br>
llvm/trunk/lib/Analysis/ConstantFolding.cpp<br>
llvm/trunk/test/Transforms/GlobalOpt/constantfold-initializers.ll<br>
<br>
Modified: llvm/trunk/lib/Analysis/ConstantFolding.cpp<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Analysis/ConstantFolding.cpp?rev=155466&r1=155465&r2=155466&view=diff" target="_blank">http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Analysis/ConstantFolding.cpp?rev=155466&r1=155465&r2=155466&view=diff</a><br>
==============================================================================<br>
--- llvm/trunk/lib/Analysis/ConstantFolding.cpp (original)<br>
+++ llvm/trunk/lib/Analysis/ConstantFolding.cpp Tue Apr 24 13:42:47 2012<br>
@@ -681,6 +681,7 @@<br>
// This makes it easy to determine if the getelementptr is "inbounds".<br>
// Also, this helps GlobalOpt do SROA on GlobalVariables.<br>
Type *Ty = Ptr->getType();<br>
+ assert(Ty->isPointerTy() && "Forming regular GEP of non-pointer type");<br>
SmallVector<Constant*, 32> NewIdxs;<br>
do {<br>
if (SequentialType *ATy = dyn_cast<SequentialType>(Ty)) {<br>
@@ -711,10 +712,17 @@<br>
}<br>
Ty = ATy->getElementType();<br>
} else if (StructType *STy = dyn_cast<StructType>(Ty)) {<br>
- // Determine which field of the struct the offset points into. The<br>
- // getZExtValue is at least as safe as the StructLayout API because we<br>
- // know the offset is within the struct at this point.<br>
+ // If we end up with an offset that isn't valid for this struct type, we<br>
+ // can't re-form this GEP in a regular form, so bail out. The pointer<br>
+ // operand likely went through casts that are necessary to make the GEP<br>
+ // sensible.<br>
const StructLayout &SL = *TD->getStructLayout(STy);<br>
+ if (Offset.uge(SL.getSizeInBytes()))<br>
+ break;<br>
+<br>
+ // Determine which field of the struct the offset points into. The<br>
+ // getZExtValue is fine as we've already ensured that the offset is<br>
+ // within the range representable by the StructLayout API.<br>
unsigned ElIdx = SL.getElementContainingOffset(Offset.getZExtValue());<br>
NewIdxs.push_back(ConstantInt::get(Type::getInt32Ty(Ty->getContext()),<br>
ElIdx));<br>
<br>
Modified: llvm/trunk/test/Transforms/GlobalOpt/constantfold-initializers.ll<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Transforms/GlobalOpt/constantfold-initializers.ll?rev=155466&r1=155465&r2=155466&view=diff" target="_blank">http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Transforms/GlobalOpt/constantfold-initializers.ll?rev=155466&r1=155465&r2=155466&view=diff</a><br>
==============================================================================<br>
--- llvm/trunk/test/Transforms/GlobalOpt/constantfold-initializers.ll (original)<br>
+++ llvm/trunk/test/Transforms/GlobalOpt/constantfold-initializers.ll Tue Apr 24 13:42:47 2012<br>
@@ -12,6 +12,11 @@<br>
@xs = global [2 x i32] zeroinitializer, align 4<br>
; CHECK: @xs = global [2 x i32] [i32 1, i32 1]<br>
<br>
+; PR12642<br>
+%PR12642.struct = type { i8 }<br>
+@PR12642.s = global <{}> zeroinitializer, align 1<br>
+@PR12642.p = constant %PR12642.struct* bitcast (i8* getelementptr (i8* bitcast (<{}>* @PR12642.s to i8*), i64 1) to %PR12642.struct*), align 8<br>
+<br>
define internal void @test1() {<br>
entry:<br>
store i32 1, i32* getelementptr inbounds ([2 x i32]* @xs, i64 0, i64 0)<br>
<br>
<br>
_______________________________________________<br>
llvm-commits mailing list<br>
<a href="mailto:llvm-commits@cs.uiuc.edu">llvm-commits@cs.uiuc.edu</a><br>
<a href="http://lists.cs.uiuc.edu/mailman/listinfo/llvm-commits" target="_blank">http://lists.cs.uiuc.edu/mailman/listinfo/llvm-commits</a><br>
</blockquote></div><br></div>
</blockquote></div><br></div></blockquote></div><br></body></html>