[PATCH] D67207: [JumpThreading] Fix the AssertVH handling for debug builds.

[Serguei Katkov via Phabricator via llvm-commits]

skatkov created this revision.
skatkov added reviewers: wmi, efriedma, yamauchi, brzycki.
Herald added a subscriber: hiraditya.
Herald added a project: LLVM.

A temporary created AssertVH should be destroyed before the Value is deleted.

The bug has been introduced in https://reviews.llvm.org/D44177.


https://reviews.llvm.org/D67207

Files:
  llvm/lib/Transforms/Scalar/JumpThreading.cpp


Index: llvm/lib/Transforms/Scalar/JumpThreading.cpp
===================================================================
--- llvm/lib/Transforms/Scalar/JumpThreading.cpp
+++ llvm/lib/Transforms/Scalar/JumpThreading.cpp
@@ -423,13 +423,21 @@
           BB.getFirstNonPHIOrDbg()->isTerminator() &&
           // Don't alter Loop headers and latches to ensure another pass can
           // detect and transform nested loops later.
-          !LoopHeaders.count(&BB) && !LoopHeaders.count(BI->getSuccessor(0)) &&
-          TryToSimplifyUncondBranchFromEmptyBlock(&BB, DTU)) {
-        // BB is valid for cleanup here because we passed in DTU. F remains
-        // BB's parent until a DTU->getDomTree() event.
-        LVI->eraseBlock(&BB);
-        Changed = true;
-      }
+          !LoopHeaders.count(&BB) && !LoopHeaders.count(BI->getSuccessor(0)))
+        // This if should be separated from condition above because in debug
+        // build the key for LoopHeader is AssertVH. As a result in
+        // LoopHeaders.count check new temporary AssertVH will be created.
+        // At the same time the function TryToSimplifyUncondBranchFromEmptyBlock
+        // can remove the block causing the check for alive AssertVH will be
+        // failed and error will be triggered. So we need the temporary
+        // AssertVH is destroyed before TryToSimplifyUncondBranchFromEmptyBlock
+        // is invoked.
+        if (TryToSimplifyUncondBranchFromEmptyBlock(&BB, DTU)) {
+          // BB is valid for cleanup here because we passed in DTU. F remains
+          // BB's parent until a DTU->getDomTree() event.
+          LVI->eraseBlock(&BB);
+          Changed = true;
+        }
     }
     EverChanged |= Changed;
   } while (Changed);


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D67207.218831.patch
Type: text/x-patch
Size: 1745 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20190905/a9385ee5/attachment.bin>