[llvm-bugs] [Bug 38071] New: R600TargetLowering::LowerOperation uses helper function with wrong subtarget, resulting in incorrect data being read

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=38071

            Bug ID: 38071
           Summary: R600TargetLowering::LowerOperation uses helper
                    function with wrong subtarget, resulting in incorrect
                    data being read
           Product: new-bugs
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: new bugs
          Assignee: unassignedbugs at nondot.org
          Reporter: david.stenberg at ericsson.com
                CC: llvm-bugs at lists.llvm.org

After the introduction of https://reviews.llvm.org/D46365, we encountered the
following runtime error when running UBSan on the lit tests:

    ******************** TEST 'LLVM ::
CodeGen/AMDGPU/r600.work-item-intrinsics.ll' FAILED ********************
    Script:
    --
    : 'RUN: at line 1';   ./build-sanu/bin/llc -march=r600 -mcpu=redwood
-verify-machineinstrs
    < ./test/CodeGen/AMDGPU/r600.work-item-intrinsics.ll |
    ./build-sanu/bin/FileCheck -check-prefix=EG -check-prefix=FUNC
    ./test/CodeGen/AMDGPU/r600.work-item-intrinsics.ll
    --
    Exit Code: 1

    Command Output (stderr):
    --
    ../include/llvm/ADT/Triple.h:292:33: runtime error: load of value 1342,
which is not a valid value for type 'llvm::Triple::OSType'
    ./test/CodeGen/AMDGPU/r600.work-item-intrinsics.ll:62:15: error: expected
string not found in input
    ; FUNC-LABEL: {{^}}test_implicit:
                  ^
    <stdin>:141:10: note: scanning from here
    tidig_z: ; @tidig_z
             ^
    <stdin>:147:11: note: possible intended match here
     ALU clause starting at 4:
              ^

LLVM was built using clang 5.0 and with the following cmake variables:
"-DCMAKE_BUILD_TYPE=RelWithDebInfo
 -DLLVM_ENABLE_ASSERTIONS=ON
 -DCMAKE_CXX_FLAGS='-stdlib=libc++'".

Before the above mentioned commit, the R600Subtarget was a subclass of
AMDGPUSubtarget, but with that commit both subtargets instead inherit from a
common base class, AMDGPUCommonSubtarget. R600TargetLowering still inherits
from AMDGPUTargetLowering.

In R600TargetLowering::LowerOperation(), the getImplicitParameterOffset()
function in AMDGPUTargetLowering is called:

    case Intrinsic::r600_implicitarg_ptr: {
      MVT PtrVT = getPointerTy(DAG.getDataLayout(), AMDGPUASI.PARAM_I_ADDRESS);
      uint32_t ByteOffset = getImplicitParameterOffset(MF, FIRST_IMPLICIT);

which in turn casts the R600Subtarget subtarget to AMDGPUSubtarget (not the
common base class), and calls getExplicitKernelArgOffset():

    uint32_t AMDGPUTargetLowering::getImplicitParameterOffset(
        const MachineFunction &MF, const ImplicitParameter Param) const {
      const AMDGPUMachineFunction *MFI = MF.getInfo<AMDGPUMachineFunction>();
      const AMDGPUSubtarget &ST = MF.getSubtarget<AMDGPUSubtarget>();
      unsigned ExplicitArgOffset =
ST.getExplicitKernelArgOffset(MF.getFunction());
      unsigned Alignment = ST.getAlignmentForImplicitArgPtr();
      uint64_t ArgOffset = alignTo(MFI->getExplicitKernArgSize(), Alignment) +
                           ExplicitArgOffset;
      switch (Param) {
      case GRID_DIM:
        return ArgOffset;
      case GRID_OFFSET:
        return ArgOffset + 4;
      }
      llvm_unreachable("unexpected implicit parameter type");
    }

Down a few frames, the following function that triggers the runtime error is
called:

      bool isMesa3DOS() const {
        return TargetTriple.getOS() == Triple::Mesa3D;
      }

The R600Subtarget does not have a TargetTriple member in the same location as
AMDGPUSubtarget (in fact it does not have such a member at all), so incorrect
data is read.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20180705/3afdce2e/attachment-0001.html>