[PATCH] D61807: [Polly] Don't crash on invalid delinearization result.

[Eli Friedman via Phabricator via llvm-commits]

efriedma created this revision.
efriedma added reviewers: grosser, Meinersbur.
Herald added a reviewer: bollu.
Herald added a subscriber: javed.absar.
Herald added a project: LLVM.

In certain cases, it's possible for delinearization to decide one of the array dimensions should be some function of an induction variable inside the scop.  Make sure if this happens, we refuse to use those dimensions for delinearization.

Usually, we end up rejecting the scop before it actually crashes, but it looks like it's possible to slip past other checks in certain cases involving smax expressions.

Fixes a crash that started showing up this week on the polly AOSP builder.  As far as I can tell, this is a longstanding issue, though; it was just exposed by better SCEV analysis of smin expressions.


Repository:
  rPLO Polly

https://reviews.llvm.org/D61807

Files:
  lib/Analysis/ScopDetection.cpp
  test/ScopInfo/multidim_invalid_dimension.ll


Index: test/ScopInfo/multidim_invalid_dimension.ll
===================================================================
--- /dev/null
+++ test/ScopInfo/multidim_invalid_dimension.ll
@@ -0,0 +1,27 @@
+; RUN: opt %loadPolly -polly-scops -analyze < %s | FileCheck %s
+target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
+target triple = "aarch64-unknown-linux-gnueabi"
+
+; Make sure we don't crash trying delinearize the memory access
+; CHECK: region: 'bb4 => bb14'
+; CHECK-NEXT: Invalid Scop!
+define void @f(i8* %arg, i32 %arg1, i32 %arg2, i32 %arg3) {
+bb:
+  br label %bb4
+
+bb4:
+  %tmp = phi i32 [ %arg2, %bb ], [ %tmp12, %bb4 ]
+  %tmp5 = icmp sgt i32 %tmp, 0
+  %tmp6 = select i1 %tmp5, i32 %tmp, i32 0
+  %tmp7 = mul nsw i32 %tmp6, %arg3
+  %tmp8 = sext i32 %tmp7 to i64
+  %tmp9 = getelementptr inbounds i8, i8* %arg, i64 %tmp8
+  %tmp10 = bitcast i8* %tmp9 to i32*
+  %tmp11 = load i32, i32* %tmp10, align 4
+  %tmp12 = add nsw i32 %tmp, 1
+  %tmp13 = icmp slt i32 %tmp, %arg1
+  br i1 %tmp13, label %bb4, label %bb14
+
+bb14:
+  ret void
+}
Index: lib/Analysis/ScopDetection.cpp
===================================================================
--- lib/Analysis/ScopDetection.cpp
+++ lib/Analysis/ScopDetection.cpp
@@ -913,7 +913,9 @@
   Value *BaseValue = BasePointer->getValue();
   Region &CurRegion = Context.CurRegion;
   for (const SCEV *DelinearizedSize : Sizes) {
-    if (!isAffine(DelinearizedSize, Scope, Context)) {
+    // Don't pass down the scope to isAfffine; array dimensions must be
+    // invariant across the entire scop.
+    if (!isAffine(DelinearizedSize, nullptr, Context)) {
       Sizes.clear();
       break;
     }


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D61807.199095.patch
Type: text/x-patch
Size: 1680 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20190510/742478ff/attachment.bin>