[llvm] bf02ed2 - Prevent crash when TurnSwitchRangeIntoICmp receives default unreachable destination

[Hans Wennborg via llvm-commits]

Author: Samuel Eubanks
Date: 2022-06-16T16:11:24+02:00
New Revision: bf02ed240dfa5f88d9b764375e644cec6cf00396

URL: https://github.com/llvm/llvm-project/commit/bf02ed240dfa5f88d9b764375e644cec6cf00396
DIFF: https://github.com/llvm/llvm-project/commit/bf02ed240dfa5f88d9b764375e644cec6cf00396.diff

LOG: Prevent crash when TurnSwitchRangeIntoICmp receives default unreachable destination

TurnSwitchRangeIntoICmp crashes when given a switch with a default
destination of unreachable
Addresses issue #53208
https://github.com/llvm/llvm-project/issues/53208

Differential revision: https://reviews.llvm.org/D127712

Added: 
    

Modified: 
    llvm/lib/Transforms/Utils/SimplifyCFG.cpp
    llvm/test/Transforms/SimplifyCFG/switch-range-to-icmp.ll

Removed: 
    


################################################################################
diff  --git a/llvm/lib/Transforms/Utils/SimplifyCFG.cpp b/llvm/lib/Transforms/Utils/SimplifyCFG.cpp
index 76cadfe687bed..330344b55bcf6 100644
--- a/llvm/lib/Transforms/Utils/SimplifyCFG.cpp
+++ b/llvm/lib/Transforms/Utils/SimplifyCFG.cpp
@@ -5184,8 +5184,9 @@ static void createUnreachableSwitchDefault(SwitchInst *Switch,
   }
 }
 
-/// Turn a switch with two reachable destinations into an integer range
-/// comparison and branch.
+/// Turn a switch into an integer range comparison and branch.
+/// Switches with more than 2 destinations are ignored.
+/// Switches with 1 destination are also ignored.
 bool SimplifyCFGOpt::TurnSwitchRangeIntoICmp(SwitchInst *SI,
                                              IRBuilder<> &Builder) {
   assert(SI->getNumCases() > 1 && "Degenerate switch?");
@@ -5217,6 +5218,8 @@ bool SimplifyCFGOpt::TurnSwitchRangeIntoICmp(SwitchInst *SI,
     }
     return false; // More than two destinations.
   }
+  if (!DestB)
+    return false; // All destinations are the same and the default is unreachable
 
   assert(DestA && DestB &&
          "Single-destination switch should have been folded.");

diff  --git a/llvm/test/Transforms/SimplifyCFG/switch-range-to-icmp.ll b/llvm/test/Transforms/SimplifyCFG/switch-range-to-icmp.ll
index 5a6cb463bd6f1..3f31fb4f30ec6 100644
--- a/llvm/test/Transforms/SimplifyCFG/switch-range-to-icmp.ll
+++ b/llvm/test/Transforms/SimplifyCFG/switch-range-to-icmp.ll
@@ -145,3 +145,47 @@ unreach1:
 unreach2:
   unreachable
 }
+
+
+define void @pr53208_single_reachable_dest(i8 %sw, i32* %p0) {
+; CHECK-LABEL: @pr53208_single_reachable_dest(
+; CHECK-NEXT:  group2:
+; CHECK-NEXT:    call void @bar(i32* [[P0:%.*]])
+; CHECK-NEXT:    ret void
+;
+  switch i8 %sw, label %group3 [
+  i8 0, label %group1
+  i8 1, label %group1
+  i8 2, label %group1
+  i8 3, label %group1
+  i8 11, label %group1
+  i8 12, label %group1
+  i8 13, label %group1
+  i8 7, label %group1
+  i8 17, label %group1
+  i8 14, label %group1
+  i8 15, label %group1
+  i8 4, label %group2
+  i8 5, label %group2
+  i8 6, label %group2
+  i8 8, label %group2
+  i8 9, label %group2
+  i8 10, label %group2
+  ]
+
+group1:
+  br label %exit
+
+group2:
+  br label %exit
+
+group3:
+  br label %exit
+
+exit:
+  %phi = phi i32* [ null, %group3 ], [ %p0, %group2 ], [ null, %group1 ]
+  call void @bar(i32* %phi)
+  ret void
+}
+
+declare void @bar(i32* nonnull dereferenceable(4))