[PATCH] [RegAllocGreedy] Rematerialization crashes while updating operands in bundled MIs

[Dmitri Shtilman]

Scary indeed!

I addressed your comments. This hasn't been triggered by an in-tree target,
so at this point I don't have any tests that I could add.

The loop in InlineSpiller::foldMemoryOperand() is actually guarded by

  // Don't attempt folding in bundles.
  MachineInstr *MI = Ops.front().first;
  if (Ops.back().first != MI || MI->isBundled())
    return false;

so we're unlikely to run into similar issues in this loop.
But I agree it's good to have an extra assert here just to be sure.

Thanks,
Dmitri


http://reviews.llvm.org/D9904

Files:
  lib/CodeGen/InlineSpiller.cpp

Index: lib/CodeGen/InlineSpiller.cpp
===================================================================
--- lib/CodeGen/InlineSpiller.cpp
+++ lib/CodeGen/InlineSpiller.cpp
@@ -921,7 +921,7 @@
 
   // Replace operands
   for (unsigned i = 0, e = Ops.size(); i != e; ++i) {
-    MachineOperand &MO = MI->getOperand(Ops[i].second);
+    MachineOperand &MO = Ops[i].first->getOperand(Ops[i].second);
     if (MO.isReg() && MO.isUse() && MO.getReg() == VirtReg.reg) {
       MO.setReg(NewVReg);
       MO.setIsKill();
@@ -1100,6 +1100,7 @@
   SmallVector<unsigned, 8> FoldOps;
   for (unsigned i = 0, e = Ops.size(); i != e; ++i) {
     unsigned Idx = Ops[i].second;
+    assert(MI == Ops[i].first && "Instruction conflict during operand folding");
     MachineOperand &MO = MI->getOperand(Idx);
     if (MO.isImplicit()) {
       ImpReg = MO.getReg();

EMAIL PREFERENCES
  http://reviews.llvm.org/settings/panel/emailpreferences/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: D9904.26275.patch
Type: text/x-patch
Size: 849 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20150521/30831e62/attachment.bin>