[LLVMbugs] [Bug 23209] New: expandMOVImm for AArch64 can in rare cases assign an immediate to SP instead the desired WZR pseudo register

[bugzilla-daemon at llvm.org]

https://llvm.org/bugs/show_bug.cgi?id=23209

            Bug ID: 23209
           Summary: expandMOVImm for AArch64 can in rare cases assign an
                    immediate to SP instead the desired WZR pseudo
                    register
           Product: libraries
           Version: 3.6
          Hardware: Macintosh
                OS: MacOS X
            Status: NEW
          Severity: normal
          Priority: P
         Component: Backend: AArch64
          Assignee: unassignedbugs at nondot.org
          Reporter: por at cryptomathic.com
                CC: llvmbugs at cs.uiuc.edu
    Classification: Unclassified

Hi,

I have seen a few cases of expandMOVImm on AArch64 generating an ORRWri
instruction writing to SP where WZR was intended, causing crashes at run-time.

The problem has been observed with LLVM 3.5.1 and LLVM 3.6.0.

The following patch seems to fix it for us:

-------------------------
Index: AArch64ExpandPseudoInsts.cpp
===================================================================
--- AArch64ExpandPseudoInsts.cpp    (revision 125567)
+++ AArch64ExpandPseudoInsts.cpp    (revision 125568)
@@ -398,6 +398,31 @@
   // Try a MOVI instruction (aka ORR-immediate with the zero register).
   uint64_t UImm = Imm << (64 - BitSize) >> (64 - BitSize);
   uint64_t Encoding;
+  const unsigned DstReg0 = MI.getOperand(0).getReg();
+
+  // explicit tests for MOV ZR,imm which *can* be generated by morpher and
must be removed,
+  // it's logically a no-op, but since ZR (x31) is an alias for SP (x31) in
many instructions like ORR
+  // it will clobber the SP...
+  if (BitSize == 32) {
+      // moving an immediate to WZR is a logical no-op, remove it
+      if (DstReg0 == AArch64::WZR) {
+          MI.eraseFromParent();
+          return true;
+      }
+      assert(DstReg0 != AArch64::WSP && "Mov imm to WSP forbidden");
+      assert(DstReg0 != AArch64::WZR && "Mov imm to WZR forbidden");
+      assert(AArch64::GPR32spRegClass.contains(DstReg0) && "Mov dest not 32
bit SP reg class");
+  } else {
+      // moving an immediate to XZR is a logical no-op, remove it
+      if (DstReg0 == AArch64::XZR) {
+          MI.eraseFromParent();
+          return true;
+      }
+      assert(DstReg0 != AArch64::SP && "Mov imm to SP forbidden");
+      assert(DstReg0 != AArch64::XZR && "Mov imm to XZR forbidden");
+      assert(AArch64::GPR64spRegClass.contains(DstReg0) && "Mov dest not 64
bit SP reg class");
+  }
+  
   if (AArch64_AM::processLogicalImmediate(UImm, BitSize, Encoding)) {
     unsigned Opc = (BitSize == 32 ? AArch64::ORRWri : AArch64::ORRXri);
     MachineInstrBuilder MIB =
----------------------------

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20150413/a41c7a0a/attachment.html>