[PATCH] Fix crash in Dependence Analysis module

Karthik Bhat kv.bhat at samsung.com
Mon Mar 9 03:31:12 PDT 2015


Hi hfinkel, spop,

Hi All,
This crash in Dependency analysis is because we assume here that in case of UsefulGEP both source and destination have the same number of operands which may not be true.  This incorrect assumption results in crash while populating Pairs. Fix the same.
Consider the case -
  struct s{
    int A[10][10];
    int C[10][10][10]; 
  } S;
  void dep_constraint_crash_test(int k,int N)  {
     for( int i=0;i<N;i++)
       for( int j=0;j<N;j++)
         S.A[0][0] = S.C[0][0][k];
  }
In this case the GEP corresponding to store has 2 operands and that corresponding to load has 3 operands. This was resulting in a crash during dependency analysis.
Please let me know your inputs on the patch.

Thanks and Regards
Karthik Bhat

REPOSITORY
  rL LLVM

http://reviews.llvm.org/D8162

Files:
  lib/Analysis/DependenceAnalysis.cpp
  test/Analysis/DependenceAnalysis/UsefulGEP.ll

Index: lib/Analysis/DependenceAnalysis.cpp
===================================================================
--- lib/Analysis/DependenceAnalysis.cpp
+++ lib/Analysis/DependenceAnalysis.cpp
@@ -3346,9 +3346,9 @@
     DEBUG(dbgs() << "    SrcPtrSCEV = " << *SrcPtrSCEV << "\n");
     DEBUG(dbgs() << "    DstPtrSCEV = " << *DstPtrSCEV << "\n");
 
-    UsefulGEP =
-      isLoopInvariant(SrcPtrSCEV, LI->getLoopFor(Src->getParent())) &&
-      isLoopInvariant(DstPtrSCEV, LI->getLoopFor(Dst->getParent()));
+    UsefulGEP = isLoopInvariant(SrcPtrSCEV, LI->getLoopFor(Src->getParent())) &&
+                isLoopInvariant(DstPtrSCEV, LI->getLoopFor(Dst->getParent())) &&
+                (SrcGEP->getNumOperands() == DstGEP->getNumOperands());
   }
   unsigned Pairs = UsefulGEP ? SrcGEP->idx_end() - SrcGEP->idx_begin() : 1;
   SmallVector<Subscript, 4> Pair(Pairs);
@@ -3773,9 +3773,9 @@
       SrcGEP->getPointerOperandType() == DstGEP->getPointerOperandType()) {
     const SCEV *SrcPtrSCEV = SE->getSCEV(SrcGEP->getPointerOperand());
     const SCEV *DstPtrSCEV = SE->getSCEV(DstGEP->getPointerOperand());
-    UsefulGEP =
-      isLoopInvariant(SrcPtrSCEV, LI->getLoopFor(Src->getParent())) &&
-      isLoopInvariant(DstPtrSCEV, LI->getLoopFor(Dst->getParent()));
+    UsefulGEP = isLoopInvariant(SrcPtrSCEV, LI->getLoopFor(Src->getParent())) &&
+                isLoopInvariant(DstPtrSCEV, LI->getLoopFor(Dst->getParent())) &&
+                (SrcGEP->getNumOperands() == DstGEP->getNumOperands());
   }
   unsigned Pairs = UsefulGEP ? SrcGEP->idx_end() - SrcGEP->idx_begin() : 1;
   SmallVector<Subscript, 4> Pair(Pairs);
Index: test/Analysis/DependenceAnalysis/UsefulGEP.ll
===================================================================
--- test/Analysis/DependenceAnalysis/UsefulGEP.ll
+++ test/Analysis/DependenceAnalysis/UsefulGEP.ll
@@ -0,0 +1,51 @@
+; RUN: opt < %s -analyze -basicaa -da
+;; Check this doesn't crash.
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+;; struct s {
+;;   int A[10][10];
+;;   int C[10][10][10]; 
+;; } S;
+
+;; void dep_constraint_crash_test(int k,int N) {
+;;   for( int i=0;i<N;i++)
+;;     for( int j=0;j<N;j++)
+;;       S.A[0][0] = S.C[0][0][k];
+;; }
+
+
+%struct.s = type { [10 x [10 x i32]], [10 x [10 x [10 x i32]]] }
+
+ at S = common global %struct.s zeroinitializer
+
+define void @dep_constraint_crash_test(i32 %k, i32 %N) {
+entry:
+  %cmp12 = icmp sgt i32 %N, 0
+  br i1 %cmp12, label %for.cond1.preheader.lr.ph, label %for.end6
+
+for.cond1.preheader.lr.ph:                        
+  %idxprom = sext i32 %k to i64
+  %arrayidx = getelementptr inbounds %struct.s, %struct.s* @S, i64 0, i32 1, i64 0, i64 0, i64 %idxprom
+  br label %for.body3.preheader
+
+for.body3.preheader:                              
+  %i.013 = phi i32 [ 0, %for.cond1.preheader.lr.ph ], [ %inc5, %for.inc4 ]
+  br label %for.body3
+
+for.body3:                                        
+  %j.011 = phi i32 [ %inc, %for.body3 ], [ 0, %for.body3.preheader ]
+  %0 = load i32, i32* %arrayidx
+  store i32 %0, i32* getelementptr inbounds (%struct.s* @S, i64 0, i32 0, i64 0, i64 0)
+  %inc = add nuw nsw i32 %j.011, 1
+  %exitcond = icmp eq i32 %inc, %N
+  br i1 %exitcond, label %for.inc4, label %for.body3
+
+for.inc4:                                         
+  %inc5 = add nuw nsw i32 %i.013, 1
+  %exitcond14 = icmp eq i32 %inc5, %N
+  br i1 %exitcond14, label %for.end6, label %for.body3.preheader
+
+for.end6:                                         
+  ret void
+}

EMAIL PREFERENCES
  http://reviews.llvm.org/settings/panel/emailpreferences/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: D8162.21476.patch
Type: text/x-patch
Size: 3566 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20150309/683d741e/attachment.bin>


More information about the llvm-commits mailing list