[llvm] r351769 - GlobalISel: Fix out of bounds crashes in verifier

[Matt Arsenault via llvm-commits]

Author: arsenm
Date: Mon Jan 21 16:29:37 2019
New Revision: 351769

URL: http://llvm.org/viewvc/llvm-project?rev=351769&view=rev
Log:
GlobalISel: Fix out of bounds crashes in verifier

Added:
    llvm/trunk/test/Verifier/test_g_add.mir
    llvm/trunk/test/Verifier/test_g_trunc.mir
Modified:
    llvm/trunk/lib/CodeGen/MachineVerifier.cpp

Modified: llvm/trunk/lib/CodeGen/MachineVerifier.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/CodeGen/MachineVerifier.cpp?rev=351769&r1=351768&r2=351769&view=diff
==============================================================================
--- llvm/trunk/lib/CodeGen/MachineVerifier.cpp (original)
+++ llvm/trunk/lib/CodeGen/MachineVerifier.cpp Mon Jan 21 16:29:37 2019
@@ -940,9 +940,12 @@ void MachineVerifier::visitMachineInstrB
     if (isFunctionSelected)
       report("Unexpected generic instruction in a Selected function", MI);
 
+    unsigned NumOps = MI->getNumOperands();
+
     // Check types.
     SmallVector<LLT, 4> Types;
-    for (unsigned I = 0; I < MCID.getNumOperands(); ++I) {
+    for (unsigned I = 0, E = std::min(MCID.getNumOperands(), NumOps);
+         I != E; ++I) {
       if (!MCID.OpInfo[I].isGenericType())
         continue;
       // Generic instructions specify type equality constraints between some of
@@ -973,6 +976,10 @@ void MachineVerifier::visitMachineInstrB
       if (MO->isReg() && TargetRegisterInfo::isPhysicalRegister(MO->getReg()))
         report("Generic instruction cannot have physical register", MO, I);
     }
+
+    // Avoid out of bounds in checks below. This was already reported earlier.
+    if (MI->getNumOperands() < MCID.getNumOperands())
+      return;
   }
 
   StringRef ErrorInfo;
@@ -1033,8 +1040,6 @@ void MachineVerifier::visitMachineInstrB
     // instructions aren't guaranteed to have the right number of operands or
     // types attached to them at this point
     assert(MCID.getNumOperands() == 2 && "Expected 2 operands G_*{EXT,TRUNC}");
-    if (MI->getNumOperands() < MCID.getNumOperands())
-      break;
     LLT DstTy = MRI->getType(MI->getOperand(0).getReg());
     LLT SrcTy = MRI->getType(MI->getOperand(1).getReg());
     if (!DstTy.isValid() || !SrcTy.isValid())

Added: llvm/trunk/test/Verifier/test_g_add.mir
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Verifier/test_g_add.mir?rev=351769&view=auto
==============================================================================
--- llvm/trunk/test/Verifier/test_g_add.mir (added)
+++ llvm/trunk/test/Verifier/test_g_add.mir Mon Jan 21 16:29:37 2019
@@ -0,0 +1,28 @@
+#RUN: not llc -o - -global-isel -run-pass=none -verify-machineinstrs %s 2>&1 | FileCheck %s
+# REQUIRES: global-isel, aarch64-registered-target
+
+---
+name:            test_add
+legalized:       true
+regBankSelected: false
+selected:        false
+tracksRegLiveness: true
+liveins:
+body:             |
+  bb.0:
+
+    %0:_(s32) = G_CONSTANT i32 0
+    %1:_(s32) = G_CONSTANT i32 1
+
+    ; CHECK: Bad machine code: Too few operands
+    %2:_(s32) = G_ADD
+
+    ; CHECK: Bad machine code: Too few operands
+    %3:_(s32) = G_ADD %0
+    %4:_(s32) = G_ADD %0, %1
+
+    ; CHECK: Bad machine code: Too few operands
+    ; CHECK: Bad machine code: Explicit definition marked as use
+    G_ADD %0, %1
+
+...

Added: llvm/trunk/test/Verifier/test_g_trunc.mir
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Verifier/test_g_trunc.mir?rev=351769&view=auto
==============================================================================
--- llvm/trunk/test/Verifier/test_g_trunc.mir (added)
+++ llvm/trunk/test/Verifier/test_g_trunc.mir Mon Jan 21 16:29:37 2019
@@ -0,0 +1,23 @@
+# RUN: not llc -o - -global-isel -run-pass=none -verify-machineinstrs %s 2>&1 | FileCheck %s
+# REQUIRES: global-isel, aarch64-registered-target
+
+---
+name:            test_trunc
+legalized:       true
+regBankSelected: false
+selected:        false
+tracksRegLiveness: true
+liveins:
+body:             |
+  bb.0:
+
+    ; CHECK: Bad machine code: Too few operands
+    %0:_(s32) = G_TRUNC
+
+    %1:_(s64) = G_IMPLICIT_DEF
+
+    ; CHECK: Bad machine code: Too few operands
+    ; CHECK: Bad machine code: Explicit definition marked as use
+    G_TRUNC %1
+
+...