[PATCH] D21566: Widen EHScope::ClenupBitFields::FixupDepth to avoid overflowing it (PR23490)

[Hans Wennborg via cfe-commits]

hans created this revision.
hans added a reviewer: rjmccall.
hans added a subscriber: cfe-commits.

It currently only takes 2048 gotos to overflow the FixupDepth bitfield, causing silent miscompilation. Apparently some parser generators run into this (see PR).

I don't know that that data structure is terribly size sensitive anyway, and since there's no room to widen the bitfield, let's just use a separate word for it.

http://reviews.llvm.org/D21566

Files:
  lib/CodeGen/CGCleanup.h
  test/CodeGen/fixup-depth-overflow.c

Index: test/CodeGen/fixup-depth-overflow.c
===================================================================
--- /dev/null
+++ test/CodeGen/fixup-depth-overflow.c
@@ -0,0 +1,26 @@
+// RUN: %clang_cc1 -O1 -disable-llvm-optzns -emit-llvm -o - %s | FileCheck %s
+
+#define M if (x) goto L1;
+#define M10 M M M M M M M M M M
+#define M100 M10 M10 M10 M10 M10 M10 M10 M10 M10 M10
+#define M1000 M100 M100 M100 M100 M100 M100 M100 M100 M100 M100
+
+void f(int x) {
+  int h;
+
+  // Many gotos to not-yet-emitted labels would cause EHScope's FixupDepth
+  // to overflow (PR23490).
+  M1000 M1000 M1000
+
+  if (x == 5) {
+    // This will cause us to emit a clean-up of the stack variable. If the
+    // FixupDepths are broken, fixups will erroneously get threaded through it.
+    int i;
+  }
+
+L1:
+  return;
+}
+
+// CHECK-LABEL: define void @f
+// CHECK-NOT: cleanup
Index: lib/CodeGen/CGCleanup.h
===================================================================
--- lib/CodeGen/CGCleanup.h
+++ lib/CodeGen/CGCleanup.h
@@ -58,7 +58,7 @@
     friend class EHCatchScope;
     unsigned : NumCommonBits;
 
-    unsigned NumHandlers : 32 - NumCommonBits;
+    unsigned NumHandlers;
   };
 
   class CleanupBitFields {
@@ -90,14 +90,14 @@
     /// The number of fixups required by enclosing scopes (not including
     /// this one).  If this is the top cleanup scope, all the fixups
     /// from this index onwards belong to this scope.
-    unsigned FixupDepth : 32 - 18 - NumCommonBits; // currently 12
+    unsigned FixupDepth;
   };
 
   class FilterBitFields {
     friend class EHFilterScope;
     unsigned : NumCommonBits;
 
-    unsigned NumFilters : 32 - NumCommonBits;
+    unsigned NumFilters;
   };
 
   union {
@@ -188,6 +188,7 @@
                EHScopeStack::stable_iterator enclosingEHScope)
     : EHScope(Catch, enclosingEHScope) {
     CatchBits.NumHandlers = numHandlers;
+    assert(CatchBits.NumHandlers == numHandlers && "NumHandlers overflow?");
   }
 
   unsigned getNumHandlers() const {
@@ -300,6 +301,7 @@
     CleanupBits.FixupDepth = fixupDepth;
 
     assert(CleanupBits.CleanupSize == cleanupSize && "cleanup size overflow");
+    assert(CleanupBits.FixupDepth == fixupDepth && "fixup depth overflow");
   }
 
   void Destroy() {
@@ -451,6 +453,7 @@
   EHFilterScope(unsigned numFilters)
     : EHScope(Filter, EHScopeStack::stable_end()) {
     FilterBits.NumFilters = numFilters;
+    assert(FilterBits.NumFilters == numFilters && "NumFilters overflow");
   }
 
   static size_t getSizeForNumFilters(unsigned numFilters) {


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D21566.61428.patch
Type: text/x-patch
Size: 2558 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-commits/attachments/20160621/56d934cd/attachment.bin>