[PATCH] Fix miscompile due to StackColoring incorrectly merging stack slots

[Shuxin Yang]

On 5/15/13 11:54 AM, Mark Seaborn wrote:
> On 15 May 2013 11:34, Shuxin Yang <shuxin.llvm at gmail.com 
> <mailto:shuxin.llvm at gmail.com>> wrote:
>
>     On 5/15/13 11:23 AM, Mark Seaborn wrote:
>
>         Fix miscompile due to StackColoring incorrectly merging stack
>         slots
>
>         IR optimisation passes can result in a basic block that contains:
>
>           llvm.lifetime.start(%buf)
>           ...
>           llvm.lifetime.end(%buf)
>           ...
>           llvm.lifetime.start(%buf)
>
>     Just curious, why "buf" was dead, and is resurrected later on?
>
>
I see thanks. Look like we should not be serious with "lifetime.end":-).

> Do you mean, which IR optimisation passes can cause this to happen?
Kind of.  I helped investigate a StackColoing bug before. In that case, 
front-end placed the lifetime.end at wrong place.


> I did not track down exactly which IR transformations produced this.  
> I'd expect that any pass which duplicates code could do this, e.g. 
> loop unrolling.  I suspect there is an IR pass which merges alloca 
> stack slots, too, because in the case where I encountered this bug I 
> was seeing separate allocas having been merged.
>
> An example of this happening from loop unrolling is:
>
> void use_buffer(char *buf);
>
> static inline void foo(void) {
>   char buf[1000];
>   use_buffer(buf);
> }
>
> void test() {
>   int i;
>   for (i = 0; i < 2; i++) {
>     foo();
>   }
> }
>
> This produces:
>
> $ clang lifetime_unroll.c -S -o - -emit-llvm -O2
> define void @test() nounwind uwtable {
>   %buf.i = alloca [1000 x i8], align 16
>   %1 = getelementptr inbounds [1000 x i8]* %buf.i, i64 0, i64 0
>   call void @llvm.lifetime.start(i64 -1, i8* %1) nounwind
>   call void @use_buffer(i8* %1) nounwind
>   call void @llvm.lifetime.end(i64 -1, i8* %1) nounwind
>   call void @llvm.lifetime.start(i64 -1, i8* %1) nounwind
>   call void @use_buffer(i8* %1) nounwind
>   call void @llvm.lifetime.end(i64 -1, i8* %1) nounwind
>   ret void
> }
>
> Cheers,
> Mark
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20130515/c53b417a/attachment.html>