[PATCH] D122382: [SelectionDAG] Don't create illegally-typed nodes while constant folding

[Fraser Cormack via Phabricator via llvm-commits]

frasercrmck created this revision.
frasercrmck added reviewers: RKSimon, spatel, craig.topper.
Herald added subscribers: luke957, StephenFan, ecnelises, luismarques, apazos, sameer.abuasal, pengfei, s.egerton, Jim, jocewei, PkmX, the_o, brucehoult, MartinMosbeck, rogfer01, atanasyan, edward-jones, zzheng, jrtc27, niosHD, sabuasal, simoncook, johnrusso, rbar, asb, hiraditya, sdardis.
Herald added a project: All.
frasercrmck requested review of this revision.
Herald added subscribers: llvm-commits, pcwang-thead, MaskRay.
Herald added a project: LLVM.

This patch fixes a (seemingly very rare) crash during vector constant
folding.

Normally, during legalization, if we create an illegally-typed node during
a failed attempt at constant folding it's cleaned up before being
visited, due to it having no uses.

If, however, an illegally-typed node is created during one round of
legalization and isn't cleaned up, it's possible for a second round of
legalization to create new illegally-typed nodes which add extra uses to
the old illegal nodes. This means that we can end up visiting the old
nodes before they're known to be dead, at which point we crash.

I'm not happy about this fix. Creating illegal types at all seems like a
bad idea, but we all-too-often rely on illegal constants being
successfully folded and being fixed up afterwards. However, we can't
rely on constant folding actually happening, and we don't have a
foolproof way of peering into the future.

Perhaps the correct fix is to revisit the node-iteration order during
legalization, ensuring we visit all uses of nodes before the nodes
themselves. Or alternatively we could try and clean up dead nodes
immediately after failing constant folding.


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D122382

Files:
  llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp
  llvm/test/CodeGen/Mips/msa/i5-b.ll
  llvm/test/CodeGen/Mips/msa/immediates.ll
  llvm/test/CodeGen/RISCV/rvv/constant-folding-crash.ll
  llvm/test/CodeGen/X86/vector-shuffle-v1.ll

-------------- next part --------------
A non-text attachment was scrubbed...
Name: D122382.417880.patch
Type: text/x-patch
Size: 13002 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20220324/a5ee9c6d/attachment.bin>