[llvm] r338481 - [x86] Fix a really subtle miscompile due to a somewhat glaring bug in
Chandler Carruth via llvm-commits
llvm-commits at lists.llvm.org
Tue Jul 31 20:08:23 PDT 2018
+tstellar at redhat.com <tstellar at redhat.com> - We almost certainly want to
pull this into whatever the next release is. =[
+Craig Topper <craig.topper at gmail.com> for reference....
On Tue, Jul 31, 2018 at 8:02 PM Chandler Carruth via llvm-commits <
llvm-commits at lists.llvm.org> wrote:
> Author: chandlerc
> Date: Tue Jul 31 20:01:58 2018
> New Revision: 338481
>
> URL: http://llvm.org/viewvc/llvm-project?rev=338481&view=rev
> Log:
> [x86] Fix a really subtle miscompile due to a somewhat glaring bug in
> EFLAGS copy lowering.
>
> If you have a branch of LLVM, you may want to cherrypick this. It is
> extremely unlikely to hit this case empirically, but it will likely
> manifest as an "impossible" branch being taken somewhere, and will be
> ... very hard to debug.
>
> Hitting this requires complex conditions living across complex control
> flow combined with some interesting memory (non-stack) initialized with
> the results of a comparison. Also, because you have to arrange for an
> EFLAGS copy to be in *just* the right place, almost anything you do to
> the code will hide the bug. I was unable to reduce anything remotely
> resembling a "good" test case from the place where I hit it, and so
> instead I have constructed synthetic MIR testing that directly exercises
> the bug in question (as well as the good behavior for completeness).
>
> The issue is that we would mistakenly assume any SETcc with a valid
> condition and an initial operand that was a register and a virtual
> register at that to be a register *defining* SETcc...
>
> It isn't though....
>
> This would in turn cause us to test some other bizarre register,
> typically the base pointer of some memory. Now, testing this register
> and using that to branch on doesn't make any sense. It even fails the
> machine verifier (if you are running it) due to the wrong register
> class. But it will make it through LLVM, assemble, and it *looks*
> fine... But wow do you get a very unsual and surprising branch taken in
> your actual code.
>
> The fix is to actually check what kind of SETcc instruction we're
> dealing with. Because there are a bunch of them, I just test the
> may-store bit in the instruction. I've also added an assert for sanity
> that ensure we are, in fact, *defining* the register operand. =D
>
> Modified:
> llvm/trunk/lib/Target/X86/X86FlagsCopyLowering.cpp
> llvm/trunk/test/CodeGen/X86/flags-copy-lowering.mir
>
> Modified: llvm/trunk/lib/Target/X86/X86FlagsCopyLowering.cpp
> URL:
> http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Target/X86/X86FlagsCopyLowering.cpp?rev=338481&r1=338480&r2=338481&view=diff
>
> ==============================================================================
> --- llvm/trunk/lib/Target/X86/X86FlagsCopyLowering.cpp (original)
> +++ llvm/trunk/lib/Target/X86/X86FlagsCopyLowering.cpp Tue Jul 31 20:01:58
> 2018
> @@ -730,9 +730,12 @@ CondRegArray X86FlagsCopyLoweringPass::c
> for (MachineInstr &MI :
> llvm::reverse(llvm::make_range(MBB.begin(), TestPos))) {
> X86::CondCode Cond = X86::getCondFromSETOpc(MI.getOpcode());
> - if (Cond != X86::COND_INVALID && MI.getOperand(0).isReg() &&
> - TRI->isVirtualRegister(MI.getOperand(0).getReg()))
> + if (Cond != X86::COND_INVALID && !MI.mayStore() &&
> MI.getOperand(0).isReg() &&
> + TRI->isVirtualRegister(MI.getOperand(0).getReg())) {
> + assert(MI.getOperand(0).isDef() &&
> + "A non-storing SETcc should always define a register!");
> CondRegs[Cond] = MI.getOperand(0).getReg();
> + }
>
> // Stop scanning when we see the first definition of the EFLAGS as
> prior to
> // this we would potentially capture the wrong flag state.
>
> Modified: llvm/trunk/test/CodeGen/X86/flags-copy-lowering.mir
> URL:
> http://llvm.org/viewvc/llvm-project/llvm/trunk/test/CodeGen/X86/flags-copy-lowering.mir?rev=338481&r1=338480&r2=338481&view=diff
>
> ==============================================================================
> --- llvm/trunk/test/CodeGen/X86/flags-copy-lowering.mir (original)
> +++ llvm/trunk/test/CodeGen/X86/flags-copy-lowering.mir Tue Jul 31
> 20:01:58 2018
> @@ -90,6 +90,18 @@
> call void @foo()
> ret i64 0
> }
> +
> + define i32 @test_existing_setcc(i64 %a, i64 %b) {
> + entry:
> + call void @foo()
> + ret i32 0
> + }
> +
> + define i32 @test_existing_setcc_memory(i64 %a, i64 %b) {
> + entry:
> + call void @foo()
> + ret i32 0
> + }
> ...
> ---
> name: test_branch
> @@ -936,3 +948,110 @@ body: |
> ; CHECK: %8:gr64 = CMOVE64rr %0, %1, implicit killed $eflags
>
> ...
> +---
> +name: test_existing_setcc
> +# CHECK-LABEL: name: test_existing_setcc
> +liveins:
> + - { reg: '$rdi', virtual-reg: '%0' }
> + - { reg: '$rsi', virtual-reg: '%1' }
> +body: |
> + bb.0:
> + successors: %bb.1, %bb.2, %bb.3
> + liveins: $rdi, $rsi
> +
> + %0:gr64 = COPY $rdi
> + %1:gr64 = COPY $rsi
> + CMP64rr %0, %1, implicit-def $eflags
> + %2:gr8 = SETAr implicit $eflags
> + %3:gr8 = SETAEr implicit $eflags
> + %4:gr64 = COPY $eflags
> + ; CHECK: CMP64rr %0, %1, implicit-def $eflags
> + ; CHECK-NEXT: %[[A_REG:[^:]*]]:gr8 = SETAr implicit $eflags
> + ; CHECK-NEXT: %[[AE_REG:[^:]*]]:gr8 = SETAEr implicit $eflags
> + ; CHECK-NOT: COPY{{( killed)?}} $eflags
> +
> + ADJCALLSTACKDOWN64 0, 0, 0, implicit-def dead $rsp, implicit-def dead
> $eflags, implicit-def dead $ssp, implicit $rsp, implicit $ssp
> + CALL64pcrel32 @foo, csr_64, implicit $rsp, implicit $ssp, implicit
> $rdi, implicit-def $rsp, implicit-def $ssp, implicit-def $eax
> + ADJCALLSTACKUP64 0, 0, implicit-def dead $rsp, implicit-def dead
> $eflags, implicit-def dead $ssp, implicit $rsp, implicit $ssp
> +
> + $eflags = COPY %4
> + JA_1 %bb.1, implicit $eflags
> + JB_1 %bb.2, implicit $eflags
> + JMP_1 %bb.3
> + ; CHECK-NOT: $eflags =
> + ;
> + ; CHECK: TEST8rr %[[A_REG]], %[[A_REG]], implicit-def $eflags
> + ; CHECK-NEXT: JNE_1 %bb.1, implicit killed $eflags
> + ; CHECK-SAME: {{$[[:space:]]}}
> + ; CHECK-NEXT: bb.4:
> + ; CHECK-NEXT: successors: {{.*$}}
> + ; CHECK-SAME: {{$[[:space:]]}}
> + ; CHECK-NEXT: TEST8rr %[[AE_REG]], %[[AE_REG]], implicit-def $eflags
> + ; CHECK-NEXT: JE_1 %bb.2, implicit killed $eflags
> + ; CHECK-NEXT: JMP_1 %bb.3
> +
> + bb.1:
> + %5:gr32 = MOV32ri64 42
> + $eax = COPY %5
> + RET 0, $eax
> +
> + bb.2:
> + %6:gr32 = MOV32ri64 43
> + $eax = COPY %6
> + RET 0, $eax
> +
> + bb.3:
> + %7:gr32 = MOV32r0 implicit-def dead $eflags
> + $eax = COPY %7
> + RET 0, $eax
> +
> +...
> +---
> +name: test_existing_setcc_memory
> +# CHECK-LABEL: name: test_existing_setcc_memory
> +liveins:
> + - { reg: '$rdi', virtual-reg: '%0' }
> + - { reg: '$rsi', virtual-reg: '%1' }
> +body: |
> + bb.0:
> + successors: %bb.1, %bb.2
> + liveins: $rdi, $rsi
> +
> + %0:gr64 = COPY $rdi
> + %1:gr64 = COPY $rsi
> + CMP64rr %0, %1, implicit-def $eflags
> + SETEm %0, 1, $noreg, -16, $noreg, implicit $eflags
> + %2:gr64 = COPY $eflags
> + ; CHECK: CMP64rr %0, %1, implicit-def $eflags
> + ; We cannot reuse this SETE because it stores the flag directly to
> memory,
> + ; so we have two SETEs here. FIXME: It'd be great if something could
> fold
> + ; these automatically. If not, maybe we want to unfold SETcc
> instructions
> + ; writing to memory so we can reuse them.
> + ; CHECK-NEXT: SETEm {{.*}} implicit $eflags
> + ; CHECK-NEXT: %[[E_REG:[^:]*]]:gr8 = SETEr implicit $eflags
> + ; CHECK-NOT: COPY{{( killed)?}} $eflags
> +
> + ADJCALLSTACKDOWN64 0, 0, 0, implicit-def dead $rsp, implicit-def dead
> $eflags, implicit-def dead $ssp, implicit $rsp, implicit $ssp
> + CALL64pcrel32 @foo, csr_64, implicit $rsp, implicit $ssp, implicit
> $rdi, implicit-def $rsp, implicit-def $ssp, implicit-def $eax
> + ADJCALLSTACKUP64 0, 0, implicit-def dead $rsp, implicit-def dead
> $eflags, implicit-def dead $ssp, implicit $rsp, implicit $ssp
> +
> + $eflags = COPY %2
> + JE_1 %bb.1, implicit $eflags
> + JMP_1 %bb.2
> + ; CHECK-NOT: $eflags =
> + ;
> + ; CHECK: TEST8rr %[[E_REG]], %[[E_REG]], implicit-def $eflags
> + ; CHECK-NEXT: JNE_1 %bb.1, implicit killed $eflags
> + ; CHECK-NEXT: JMP_1 %bb.2
> +
> + bb.1:
> + %3:gr32 = MOV32ri64 42
> + $eax = COPY %3
> + RET 0, $eax
> +
> + bb.2:
> + %4:gr32 = MOV32ri64 43
> + $eax = COPY %4
> + RET 0, $eax
> +
> +...
>
>
> _______________________________________________
> llvm-commits mailing list
> llvm-commits at lists.llvm.org
> http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-commits
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20180731/d9d33ec0/attachment.html>
More information about the llvm-commits
mailing list