<div dir="ltr">Michael,<div><br></div><div>It seems that this change has introduced buffer overrun:</div><div><br></div><div><a href="http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-fast/builds/11708">http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-fast/builds/11708</a><br></div><div><br></div><div><div>Can you take a look?</div><div><br></div><div>=================================================================</div><div>==16604==ERROR: AddressSanitizer: container-overflow on address 0x6030000075b0 at pc 0x000004056540 bp 0x7ffe0b808250 sp 0x7ffe0b808248</div><div>READ of size 8 at 0x6030000075b0 thread T0</div><div> #0 0x405653f in llvm::UnrollLoop(llvm::Loop*, unsigned int, unsigned int, bool, bool, unsigned int, llvm::LoopInfo*, llvm::ScalarEvolution*, llvm::DominatorTree*, llvm::AssumptionCache*, bool) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/Transforms/Utils/LoopUnroll.cpp:566:31</div><div> #1 0x3bf36ab in tryToUnrollLoop(llvm::Loop*, llvm::DominatorTree&, llvm::LoopInfo*, llvm::ScalarEvolution*, llvm::TargetTransformInfo const&, llvm::AssumptionCache&, bool, llvm::Optional<unsigned int>, llvm::Optional<unsigned int>, llvm::Optional<bool>, llvm::Optional<bool>) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/Transforms/Scalar/LoopUnrollPass.cpp:761:8</div><div> #2 0x3bed313 in (anonymous namespace)::LoopUnroll::runOnLoop(llvm::Loop*, llvm::LPPassManager&) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/Transforms/Scalar/LoopUnrollPass.cpp:803:12</div><div> #3 0x26dd7ca in llvm::LPPassManager::runOnFunction(llvm::Function&) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/Analysis/LoopPass.cpp:198:20</div><div> #4 0x333671c in llvm::FPPassManager::runOnFunction(llvm::Function&) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/IR/LegacyPassManager.cpp:1550:23</div><div> #5 0x3336cb5 in llvm::FPPassManager::runOnModule(llvm::Module&) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/IR/LegacyPassManager.cpp:1571:16</div><div> #6 0x3337be2 in runOnModule /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/IR/LegacyPassManager.cpp:1627:23</div><div> #7 0x3337be2 in llvm::legacy::PassManagerImpl::run(llvm::Module&) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/IR/LegacyPassManager.cpp:1730</div><div> #8 0x7c6d61 in main /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/tools/opt/opt.cpp:636:3</div><div> #9 0x7f5dc4bd3ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)</div><div> #10 0x6b3669 in _start (/mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm_build_asan/bin/opt+0x6b3669)</div><div><br></div><div>0x6030000075b0 is located 16 bytes inside of 32-byte region [0x6030000075a0,0x6030000075c0)</div><div>allocated by thread T0 here:</div><div> #0 0x789ed0 in operator new(unsigned long) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/projects/compiler-rt/lib/asan/asan_new_delete.cc:62</div><div> #1 0x327c46e in __allocate /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/libcxx_build_asan/include/c++/v1/new:168:10</div><div> #2 0x327c46e in allocate /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/libcxx_build_asan/include/c++/v1/memory:1736</div><div> #3 0x327c46e in allocate /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/libcxx_build_asan/include/c++/v1/memory:1488</div><div> #4 0x327c46e in __split_buffer /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/libcxx_build_asan/include/c++/v1/__split_buffer:311</div><div> #5 0x327c46e in void std::__1::vector<llvm::DomTreeNodeBase<llvm::BasicBlock>*, std::__1::allocator<llvm::DomTreeNodeBase<llvm::BasicBlock>*> >::__push_back_slow_path<llvm::DomTreeNodeBase<llvm::BasicBlock>*>(llvm::DomTreeNodeBase<llvm::BasicBlock>*&&) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/libcxx_build_asan/include/c++/v1/vector:1573</div><div> #6 0x32707f3 in push_back /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/libcxx_build_asan/include/c++/v1/vector:1614:9</div><div> #7 0x32707f3 in addChild /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/include/llvm/Support/GenericDomTree.h:99</div><div> #8 0x32707f3 in void llvm::Calculate<llvm::Function, llvm::BasicBlock*>(llvm::DominatorTreeBase<llvm::GraphTraits<llvm::BasicBlock*>::NodeType>&, llvm::Function&) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/include/llvm/Support/GenericDomTreeConstruction.h:276</div><div> #9 0x274a998 in void llvm::DominatorTreeBase<llvm::BasicBlock>::recalculate<llvm::Function>(llvm::Function&) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/include/llvm/Support/GenericDomTree.h:729:7</div><div> #10 0x327c06c in llvm::DominatorTreeWrapperPass::runOnFunction(llvm::Function&) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/IR/Dominators.cpp:344:3</div><div> #11 0x333671c in llvm::FPPassManager::runOnFunction(llvm::Function&) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/IR/LegacyPassManager.cpp:1550:23</div><div> #12 0x3336cb5 in llvm::FPPassManager::runOnModule(llvm::Module&) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/IR/LegacyPassManager.cpp:1571:16</div><div> #13 0x3337be2 in runOnModule /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/IR/LegacyPassManager.cpp:1627:23</div><div> #14 0x3337be2 in llvm::legacy::PassManagerImpl::run(llvm::Module&) /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/IR/LegacyPassManager.cpp:1730</div><div> #15 0x7c6d61 in main /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/tools/opt/opt.cpp:636:3</div><div> #16 0x7f5dc4bd3ec4 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21ec4)</div><div><br></div><div>SUMMARY: AddressSanitizer: container-overflow /mnt/b/sanitizer-buildbot3/sanitizer-x86_64-linux-fast/build/llvm/lib/Transforms/Utils/LoopUnroll.cpp:566:31 in llvm::UnrollLoop(llvm::Loop*, unsigned int, unsigned int, bool, bool, unsigned int, llvm::LoopInfo*, llvm::ScalarEvolution*, llvm::DominatorTree*, llvm::AssumptionCache*, bool)</div><div>Shadow bytes around the buggy address:</div></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr">On Wed, Apr 6, 2016 at 2:52 PM Michael Zolotukhin via llvm-commits <<a href="mailto:llvm-commits@lists.llvm.org">llvm-commits@lists.llvm.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Author: mzolotukhin<br>
Date: Wed Apr 6 16:47:12 2016<br>
New Revision: 265605<br>
<br>
URL: <a href="http://llvm.org/viewvc/llvm-project?rev=265605&view=rev" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-project?rev=265605&view=rev</a><br>
Log:<br>
[LoopUnroll] Fix the way we update DT after complete unrolling.<br>
<br>
Updating dominators for exit-blocks of the unrolled loops is not enough,<br>
as shown in PR27157. The proper way is to update dominators for all<br>
dominance-children of original loop blocks.<br>
<br>
Added:<br>
llvm/trunk/test/Transforms/LoopUnroll/pr27157.ll<br>
Modified:<br>
llvm/trunk/lib/Transforms/Utils/LoopUnroll.cpp<br>
<br>
Modified: llvm/trunk/lib/Transforms/Utils/LoopUnroll.cpp<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Transforms/Utils/LoopUnroll.cpp?rev=265605&r1=265604&r2=265605&view=diff" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Transforms/Utils/LoopUnroll.cpp?rev=265605&r1=265604&r2=265605&view=diff</a><br>
==============================================================================<br>
--- llvm/trunk/lib/Transforms/Utils/LoopUnroll.cpp (original)<br>
+++ llvm/trunk/lib/Transforms/Utils/LoopUnroll.cpp Wed Apr 6 16:47:12 2016<br>
@@ -262,6 +262,7 @@ bool llvm::UnrollLoop(Loop *L, unsigned<br>
bool CompletelyUnroll = Count == TripCount;<br>
SmallVector<BasicBlock *, 4> ExitBlocks;<br>
L->getExitBlocks(ExitBlocks);<br>
+ std::vector<BasicBlock*> OriginalLoopBlocks = L->getBlocks();<br>
<br>
// Go through all exits of L and see if there are any phi-nodes there. We just<br>
// conservatively assume that they're inserted to preserve LCSSA form, which<br>
@@ -551,20 +552,24 @@ bool llvm::UnrollLoop(Loop *L, unsigned<br>
Term->eraseFromParent();<br>
}<br>
}<br>
- // Update dominators of loop exit blocks.<br>
- // Immediate dominator of an exit block might change, because we add more<br>
+ // Update dominators of blocks we might reach through exits.<br>
+ // Immediate dominator of such block might change, because we add more<br>
// routes which can lead to the exit: we can now reach it from the copied<br>
- // iterations too. Thus, the new idom of the exit block will be the nearest<br>
+ // iterations too. Thus, the new idom of the block will be the nearest<br>
// common dominator of the previous idom and common dominator of all copies of<br>
- // the exiting block. This is equivalent to the nearest common dominator of<br>
+ // the previous idom. This is equivalent to the nearest common dominator of<br>
// the previous idom and the first latch, which dominates all copies of the<br>
- // exiting block.<br>
+ // previous idom.<br>
if (DT && Count > 1) {<br>
- for (auto Exit : ExitBlocks) {<br>
- BasicBlock *PrevIDom = DT->getNode(Exit)->getIDom()->getBlock();<br>
- BasicBlock *NewIDom =<br>
- DT->findNearestCommonDominator(PrevIDom, Latches[0]);<br>
- DT->changeImmediateDominator(Exit, NewIDom);<br>
+ for (auto *BB : OriginalLoopBlocks) {<br>
+ auto *BBDomNode = DT->getNode(BB);<br>
+ for (auto *ChildDomNode : BBDomNode->getChildren()) {<br>
+ auto *ChildBB = ChildDomNode->getBlock();<br>
+ if (L->contains(ChildBB))<br>
+ continue;<br>
+ BasicBlock *NewIDom = DT->findNearestCommonDominator(BB, Latches[0]);<br>
+ DT->changeImmediateDominator(ChildBB, NewIDom);<br>
+ }<br>
}<br>
}<br>
<br>
<br>
Added: llvm/trunk/test/Transforms/LoopUnroll/pr27157.ll<br>
URL: <a href="http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Transforms/LoopUnroll/pr27157.ll?rev=265605&view=auto" rel="noreferrer" target="_blank">http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Transforms/LoopUnroll/pr27157.ll?rev=265605&view=auto</a><br>
==============================================================================<br>
--- llvm/trunk/test/Transforms/LoopUnroll/pr27157.ll (added)<br>
+++ llvm/trunk/test/Transforms/LoopUnroll/pr27157.ll Wed Apr 6 16:47:12 2016<br>
@@ -0,0 +1,53 @@<br>
+; RUN: opt -loop-unroll -debug-only=loop-unroll -disable-output < %s<br>
+; REQUIRES: asserts<br>
+; Compile this test with debug flag on to verify domtree right after loop unrolling.<br>
+target datalayout = "E-m:e-i1:8:16-i8:8:16-i64:64-f128:64-v128:64-a:8:16-n32:64"<br>
+<br>
+; PR27157<br>
+define void @foo() {<br>
+entry:<br>
+ br label %loop_header<br>
+loop_header:<br>
+ %iv = phi i64 [ 0, %entry ], [ %iv_next, %loop_latch ]<br>
+ br i1 undef, label %loop_latch, label %loop_exiting_bb1<br>
+loop_exiting_bb1:<br>
+ br i1 false, label %loop_exiting_bb2, label %exit1.loopexit<br>
+loop_exiting_bb2:<br>
+ br i1 false, label %loop_latch, label %bb<br>
+bb:<br>
+ br label %exit1<br>
+loop_latch:<br>
+ %iv_next = add nuw nsw i64 %iv, 1<br>
+ %cmp = icmp ne i64 %iv_next, 2<br>
+ br i1 %cmp, label %loop_header, label %exit2<br>
+exit1.loopexit:<br>
+ br label %exit1<br>
+exit1:<br>
+ ret void<br>
+exit2:<br>
+ ret void<br>
+}<br>
+<br>
+define void @foo2() {<br>
+entry:<br>
+ br label %loop.header<br>
+loop.header:<br>
+ %iv = phi i32 [ 0, %entry ], [ %iv.inc, %latch ]<br>
+ %iv.inc = add i32 %iv, 1<br>
+ br i1 undef, label %diamond, label %latch<br>
+diamond:<br>
+ br i1 undef, label %left, label %right<br>
+left:<br>
+ br i1 undef, label %exit, label %merge<br>
+right:<br>
+ br i1 undef, label %exit, label %merge<br>
+merge:<br>
+ br label %latch<br>
+latch:<br>
+ %end.cond = icmp eq i32 %iv, 1<br>
+ br i1 %end.cond, label %exit1, label %loop.header<br>
+exit:<br>
+ ret void<br>
+exit1:<br>
+ ret void<br>
+}<br>
<br>
<br>
_______________________________________________<br>
llvm-commits mailing list<br>
<a href="mailto:llvm-commits@lists.llvm.org" target="_blank">llvm-commits@lists.llvm.org</a><br>
<a href="http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-commits" rel="noreferrer" target="_blank">http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-commits</a><br>
</blockquote></div><div dir="ltr">-- <br></div>Mike<br>Sent from phone