[llvm-bugs] [Bug 38071] New: R600TargetLowering::LowerOperation uses helper function with wrong subtarget, resulting in incorrect data being read

via llvm-bugs llvm-bugs at lists.llvm.org
Thu Jul 5 07:50:57 PDT 2018


            Bug ID: 38071
           Summary: R600TargetLowering::LowerOperation uses helper
                    function with wrong subtarget, resulting in incorrect
                    data being read
           Product: new-bugs
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: new bugs
          Assignee: unassignedbugs at nondot.org
          Reporter: david.stenberg at ericsson.com
                CC: llvm-bugs at lists.llvm.org

After the introduction of https://reviews.llvm.org/D46365, we encountered the
following runtime error when running UBSan on the lit tests:

    ******************** TEST 'LLVM ::
CodeGen/AMDGPU/r600.work-item-intrinsics.ll' FAILED ********************
    : 'RUN: at line 1';   ./build-sanu/bin/llc -march=r600 -mcpu=redwood
    < ./test/CodeGen/AMDGPU/r600.work-item-intrinsics.ll |
    ./build-sanu/bin/FileCheck -check-prefix=EG -check-prefix=FUNC
    Exit Code: 1

    Command Output (stderr):
    ../include/llvm/ADT/Triple.h:292:33: runtime error: load of value 1342,
which is not a valid value for type 'llvm::Triple::OSType'
    ./test/CodeGen/AMDGPU/r600.work-item-intrinsics.ll:62:15: error: expected
string not found in input
    ; FUNC-LABEL: {{^}}test_implicit:
    <stdin>:141:10: note: scanning from here
    tidig_z: ; @tidig_z
    <stdin>:147:11: note: possible intended match here
     ALU clause starting at 4:

LLVM was built using clang 5.0 and with the following cmake variables:

Before the above mentioned commit, the R600Subtarget was a subclass of
AMDGPUSubtarget, but with that commit both subtargets instead inherit from a
common base class, AMDGPUCommonSubtarget. R600TargetLowering still inherits
from AMDGPUTargetLowering.

In R600TargetLowering::LowerOperation(), the getImplicitParameterOffset()
function in AMDGPUTargetLowering is called:

    case Intrinsic::r600_implicitarg_ptr: {
      MVT PtrVT = getPointerTy(DAG.getDataLayout(), AMDGPUASI.PARAM_I_ADDRESS);
      uint32_t ByteOffset = getImplicitParameterOffset(MF, FIRST_IMPLICIT);

which in turn casts the R600Subtarget subtarget to AMDGPUSubtarget (not the
common base class), and calls getExplicitKernelArgOffset():

    uint32_t AMDGPUTargetLowering::getImplicitParameterOffset(
        const MachineFunction &MF, const ImplicitParameter Param) const {
      const AMDGPUMachineFunction *MFI = MF.getInfo<AMDGPUMachineFunction>();
      const AMDGPUSubtarget &ST = MF.getSubtarget<AMDGPUSubtarget>();
      unsigned ExplicitArgOffset =
      unsigned Alignment = ST.getAlignmentForImplicitArgPtr();
      uint64_t ArgOffset = alignTo(MFI->getExplicitKernArgSize(), Alignment) +
      switch (Param) {
      case GRID_DIM:
        return ArgOffset;
      case GRID_OFFSET:
        return ArgOffset + 4;
      llvm_unreachable("unexpected implicit parameter type");

Down a few frames, the following function that triggers the runtime error is

      bool isMesa3DOS() const {
        return TargetTriple.getOS() == Triple::Mesa3D;

The R600Subtarget does not have a TargetTriple member in the same location as
AMDGPUSubtarget (in fact it does not have such a member at all), so incorrect
data is read.

You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20180705/3afdce2e/attachment-0001.html>

More information about the llvm-bugs mailing list