[llvm] r355904 - [CGP] Fix UB when GEP is bound to trivial PHINode

[Eugene Leviant via llvm-commits]

Author: evgeny777
Date: Tue Mar 12 03:10:29 2019
New Revision: 355904

URL: http://llvm.org/viewvc/llvm-project?rev=355904&view=rev
Log:
[CGP] Fix UB when GEP is bound to trivial PHINode

Differential revision: https://reviews.llvm.org/D59140

Added:
    llvm/trunk/test/CodeGen/AArch64/cgp-trivial-phi-node.ll
Modified:
    llvm/trunk/lib/CodeGen/CodeGenPrepare.cpp

Modified: llvm/trunk/lib/CodeGen/CodeGenPrepare.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/CodeGen/CodeGenPrepare.cpp?rev=355904&r1=355903&r2=355904&view=diff
==============================================================================
--- llvm/trunk/lib/CodeGen/CodeGenPrepare.cpp (original)
+++ llvm/trunk/lib/CodeGen/CodeGenPrepare.cpp Tue Mar 12 03:10:29 2019
@@ -6849,6 +6849,7 @@ bool CodeGenPrepare::optimizeInst(Instru
     // to introduce PHI nodes too late to be cleaned up.  If we detect such a
     // trivial PHI, go ahead and zap it here.
     if (Value *V = SimplifyInstruction(P, {*DL, TLInfo})) {
+      LargeOffsetGEPMap.erase(P);
       P->replaceAllUsesWith(V);
       P->eraseFromParent();
       ++NumPHIsElim;

Added: llvm/trunk/test/CodeGen/AArch64/cgp-trivial-phi-node.ll
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/CodeGen/AArch64/cgp-trivial-phi-node.ll?rev=355904&view=auto
==============================================================================
--- llvm/trunk/test/CodeGen/AArch64/cgp-trivial-phi-node.ll (added)
+++ llvm/trunk/test/CodeGen/AArch64/cgp-trivial-phi-node.ll Tue Mar 12 03:10:29 2019
@@ -0,0 +1,33 @@
+; Checks that case when GEP is bound to trivial PHI node is correctly handled.
+; RUN: opt %s -mtriple=aarch64-linux-gnu -codegenprepare -S -o - | FileCheck %s
+
+; CHECK:      define void @crash([65536 x i32]** %s, i32 %n) {
+; CHECK-NEXT: entry:
+; CHECK-NEXT:   %struct = load [65536 x i32]*, [65536 x i32]** %s
+; CHECK-NEXT:   %gep0 = getelementptr [65536 x i32], [65536 x i32]* %struct, i64 0, i32 20000
+; CHECK-NEXT:   store i32 %n, i32* %gep0
+; CHECK-NEXT:   ret void
+; CHECK-NEXT: }
+
+define void @crash([65536 x i32]** %s, i32 %n) {
+entry:
+  %struct = load [65536 x i32]*, [65536 x i32]** %s
+  %cmp = icmp slt i32 0, %n
+  br i1 %cmp, label %baz, label %bar
+baz:
+  br label %bar
+
+foo:
+  %gep0 = getelementptr [65536 x i32], [65536 x i32]* %phi2, i64 0, i32 20000
+  br label %st
+
+st:
+  store i32 %n, i32* %gep0
+  br label %out
+
+bar:
+  %phi2 = phi [65536 x i32]* [ %struct, %baz ], [ %struct, %entry ]
+  br label %foo
+out:
+  ret void
+}