[PATCH] D98144: [CodeGenPrepare] Fix isIVIncrement (PR49466)

[Ta-Wei Tu via Phabricator via llvm-commits]

TaWeiTu created this revision.
TaWeiTu added a reviewer: mkazantsev.
Herald added a subscriber: hiraditya.
TaWeiTu requested review of this revision.
Herald added a project: LLVM.
Herald added a subscriber: llvm-commits.

In the NFC commit 8d835f42a57f15c0b9053bd7c41ea95821a40e5f <https://reviews.llvm.org/rG8d835f42a57f15c0b9053bd7c41ea95821a40e5f>, the check for `!L` is 
moved to a separate function `getIVIncrement` which, instead of using `BO->getParent()`, 
uses `PN->getParent()`. However, these two basic blocks are not necessarily the same.

https://bugs.llvm.org/show_bug.cgi?id=49466 demonstrates a case where `PN` is contained in
a loop while `BO` is not, causing the null-pointer dereference in `L->getLoopLatch()`.

This patch checks whether both `BO` and `PN` belong to the same loop before entering `getIVIncrement`.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D98144

Files:
  llvm/lib/CodeGen/CodeGenPrepare.cpp


Index: llvm/lib/CodeGen/CodeGenPrepare.cpp
===================================================================
--- llvm/lib/CodeGen/CodeGenPrepare.cpp
+++ llvm/lib/CodeGen/CodeGenPrepare.cpp
@@ -1332,7 +1332,7 @@
 
 static bool isIVIncrement(const BinaryOperator *BO, const LoopInfo *LI) {
   auto *PN = dyn_cast<PHINode>(BO->getOperand(0));
-  if (!PN)
+  if (!PN || LI->getLoopFor(BO->getParent()) != LI->getLoopFor(PN->getParent()))
     return false;
   if (auto IVInc = getIVIncrement(PN, LI))
     return IVInc->first == BO;
@@ -1347,6 +1347,7 @@
     if (!isIVIncrement(BO, LI))
       return false;
     const Loop *L = LI->getLoopFor(BO->getParent());
+    assert(L && "L should not be null after isIVIncrement()\n");
     // IV increment may have other users than the IV. We do not want to make
     // dominance queries to analyze the legality of moving it towards the cmp,
     // so just check that there is no other users.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D98144.328865.patch
Type: text/x-patch
Size: 937 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20210307/765cd487/attachment.bin>