[llvm] r280862 - Shift-left (ISD::SHL) operation crashes on "DAG Legalization" phase.

[Elena Demikhovsky via llvm-commits]

Author: delena
Date: Wed Sep  7 15:54:33 2016
New Revision: 280862

URL: http://llvm.org/viewvc/llvm-project?rev=280862&view=rev
Log:
Shift-left (ISD::SHL) operation crashes on "DAG Legalization" phase.
https://llvm.org/bugs/show_bug.cgi?id=29058.

While node legalization we tried to legalize its operands.
If an operand node is replaced during legalization the user node may be destroyed.

Differential Revision: https://reviews.llvm.org/D24244


Added:
    llvm/trunk/test/CodeGen/X86/shl-crash-on-legalize.ll
Modified:
    llvm/trunk/lib/CodeGen/SelectionDAG/LegalizeDAG.cpp

Modified: llvm/trunk/lib/CodeGen/SelectionDAG/LegalizeDAG.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/CodeGen/SelectionDAG/LegalizeDAG.cpp?rev=280862&r1=280861&r2=280862&view=diff
==============================================================================
--- llvm/trunk/lib/CodeGen/SelectionDAG/LegalizeDAG.cpp (original)
+++ llvm/trunk/lib/CodeGen/SelectionDAG/LegalizeDAG.cpp Wed Sep  7 15:54:33 2016
@@ -1067,35 +1067,41 @@ void SelectionDAGLegalize::LegalizeOp(SD
     case ISD::SRL:
     case ISD::SRA:
     case ISD::ROTL:
-    case ISD::ROTR:
+    case ISD::ROTR: {
       // Legalizing shifts/rotates requires adjusting the shift amount
       // to the appropriate width.
-      if (!Node->getOperand(1).getValueType().isVector()) {
-        SDValue SAO =
-          DAG.getShiftAmountOperand(Node->getOperand(0).getValueType(),
-                                    Node->getOperand(1));
-        HandleSDNode Handle(SAO);
-        LegalizeOp(SAO.getNode());
-        NewNode = DAG.UpdateNodeOperands(Node, Node->getOperand(0),
-                                         Handle.getValue());
+      SDValue Op0 = Node->getOperand(0);
+      SDValue Op1 = Node->getOperand(1);
+      if (!Op1.getValueType().isVector()) {
+        SDValue SAO = DAG.getShiftAmountOperand(Op0.getValueType(), Op1);
+        // The getShiftAmountOperand() may create a new operand node or
+        // return the existing one. If new operand is created we need
+        // to update the parent node.
+        // Do not try to legalize SAO here! It will be automatically legalized
+        // in the next round.
+        if (SAO != Op1)
+          NewNode = DAG.UpdateNodeOperands(Node, Op0, SAO);
       }
-      break;
+    }
+    break;
     case ISD::SRL_PARTS:
     case ISD::SRA_PARTS:
-    case ISD::SHL_PARTS:
+    case ISD::SHL_PARTS: {
       // Legalizing shifts/rotates requires adjusting the shift amount
       // to the appropriate width.
-      if (!Node->getOperand(2).getValueType().isVector()) {
-        SDValue SAO =
-          DAG.getShiftAmountOperand(Node->getOperand(0).getValueType(),
-                                    Node->getOperand(2));
-        HandleSDNode Handle(SAO);
-        LegalizeOp(SAO.getNode());
-        NewNode = DAG.UpdateNodeOperands(Node, Node->getOperand(0),
-                                         Node->getOperand(1),
-                                         Handle.getValue());
+      SDValue Op0 = Node->getOperand(0);
+      SDValue Op1 = Node->getOperand(1);
+      SDValue Op2 = Node->getOperand(2);
+      if (!Op2.getValueType().isVector()) {
+        SDValue SAO = DAG.getShiftAmountOperand(Op0.getValueType(), Op2);
+        // The getShiftAmountOperand() may create a new operand node or
+        // return the existing one. If new operand is created we need
+        // to update the parent node.
+        if (SAO != Op2)
+          NewNode = DAG.UpdateNodeOperands(Node, Op0, Op1, SAO);
       }
-      break;
+    }
+    break;
     }
 
     if (NewNode != Node) {

Added: llvm/trunk/test/CodeGen/X86/shl-crash-on-legalize.ll
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/CodeGen/X86/shl-crash-on-legalize.ll?rev=280862&view=auto
==============================================================================
--- llvm/trunk/test/CodeGen/X86/shl-crash-on-legalize.ll (added)
+++ llvm/trunk/test/CodeGen/X86/shl-crash-on-legalize.ll Wed Sep  7 15:54:33 2016
@@ -0,0 +1,33 @@
+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
+;RUN: llc < %s | FileCheck %s
+
+; This test case failed on legalization of "shl" node. PR29058.
+
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+ at structMember = external local_unnamed_addr global i64, align 8
+
+; Function Attrs: norecurse nounwind uwtable
+define i32 @_Z3foov() local_unnamed_addr #0 {
+; CHECK-LABEL: _Z3foov:
+; CHECK:       # BB#0: # %entry
+; CHECK-NEXT:    movq %rax, {{.*}}(%rip)
+; CHECK-NEXT:    retq
+entry:
+  %bool_1 = icmp ne i8 undef, 0
+  %bool_2 = icmp eq i8 undef, 0
+  %0 = select i1 %bool_2, i32 2147483646, i32 undef
+  %or_1 = select i1 %bool_1, i32 undef, i32 -1
+  %shl_1 = shl i32 %0, %or_1
+  %conv = zext i32 %shl_1 to i64
+  store i64 %conv, i64* @structMember, align 8
+  %tmp = select i1 %bool_2, i32 2147483646, i32 undef
+  %lnot = icmp eq i8 undef, 0
+  %or_2 = select i1 %lnot, i32 -1, i32 undef
+  %shl_2 = shl i32 %tmp, %or_2
+  ret i32 %shl_2
+}
+
+attributes #0 = { norecurse nounwind uwtable "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "less-precise-fpmad"="false" "no-frame-pointer-elim"="false" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+fxsr,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" }
+