[llvm] [SelectionDAG] Mark frame index as "aliased" at argument copy elison (PR #89712)
Björn Pettersson via llvm-commits
llvm-commits at lists.llvm.org
Tue Apr 23 00:26:48 PDT 2024
https://github.com/bjope created https://github.com/llvm/llvm-project/pull/89712
This is a fix for miscompiles reported in
https://github.com/llvm/llvm-project/issues/89060
After argument copy elison the IR value for the eliminated alloca
is aliasing with the fixed stack object. This patch is making sure
that we mark the fixed stack object as being aliased with IR values
to avoid that for example schedulers are reordering accesses to
the fixed stack object. This could otherwise happen when there is a
mix of MemOperands refering the shared fixed stack slow via both
the IR value for the elided alloca, and via a fixed stack pseudo
source value (as would be the case when lowering the arguments).
>From 55c971bb4f2f8b3d8d8ab726b73c87876cbd7146 Mon Sep 17 00:00:00 2001
From: Bjorn Pettersson <bjorn.a.pettersson at ericsson.com>
Date: Tue, 23 Apr 2024 08:52:19 +0200
Subject: [PATCH 1/2] Pre-commit reproducer for argument copy elison related
bug
Adding test case related to
https://github.com/llvm/llvm-project/issues/89060
It shows that after argument copy elison the scheduler may reorder
a load of the input argument and a store to the same fixed stack
entry (the fixed stack entry that is reused for the local variable).
---
llvm/test/CodeGen/Hexagon/arg-copy-elison.ll | 41 ++++++++++++++++++++
1 file changed, 41 insertions(+)
create mode 100644 llvm/test/CodeGen/Hexagon/arg-copy-elison.ll
diff --git a/llvm/test/CodeGen/Hexagon/arg-copy-elison.ll b/llvm/test/CodeGen/Hexagon/arg-copy-elison.ll
new file mode 100644
index 00000000000000..2479d0ed5463fc
--- /dev/null
+++ b/llvm/test/CodeGen/Hexagon/arg-copy-elison.ll
@@ -0,0 +1,41 @@
+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py UTC_ARGS: --version 4
+; RUN: llc -mtriple hexagon-- -O3 -o - %s | FileCheck %s
+
+; Reproducer for https://github.com/llvm/llvm-project/issues/89060
+;
+; Problem was a bug in argument copy elison. Given that the %alloca is
+; eliminated, the same frame index will be used for accessing %alloca and %a
+; on the fixed stack. Care must be taken when setting up
+; MachinePointerInfo/MemOperands for those accesses to either make sure that
+; we always refer to the fixed stack slot the same way (not using the
+; ir.alloca name), or make sure that we still detect that they alias each
+; other if using different kinds of MemOperands to identify the same fixed
+; stack entry.
+;
+define i32 @f(i32, i32, i32, i32, i32, i32, i32, i32, i32, i32, i32, i32, i32, i32 %q1, i32 %a, i32 %q2) {
+; CHECK-LABEL: f:
+; CHECK: .cfi_startproc
+; CHECK-NEXT: // %bb.0:
+; CHECK-NEXT: {
+; CHECK-NEXT: r0 = memw(r29+#36)
+; CHECK-NEXT: memw(r29+#32) = ##666
+; CHECK-NEXT: }
+; CHECK-NEXT: {
+; CHECK-NEXT: r1 = memw(r29+#28)
+; CHECK-NEXT: r2 = memw(r29+#32)
+; CHECK-NEXT: }
+; CHECK-NEXT: {
+; CHECK-NEXT: r0 = sub(r1,r0)
+; CHECK-NEXT: }
+; CHECK-NEXT: {
+; CHECK-NEXT: r0 = xor(r0,r2)
+; CHECK-NEXT: jumpr r31
+; CHECK-NEXT: }
+ %alloca = alloca i32
+ store i32 %a, ptr %alloca ; Should be elided.
+ store i32 666, ptr %alloca
+ %x = sub i32 %q1, %q2
+ %y = xor i32 %x, %a ; Results in a load of %a from fixed stack.
+ ; Using same frame index as elided %alloca.
+ ret i32 %y
+}
>From 70a9448a66916f0b5559d48e8e57349c82055a66 Mon Sep 17 00:00:00 2001
From: Bjorn Pettersson <bjorn.a.pettersson at ericsson.com>
Date: Tue, 23 Apr 2024 09:22:46 +0200
Subject: [PATCH 2/2] [SelectionDAG] Mark frame index as "aliased" at argument
copy elison
This is a fix for miscompiles reported in
https://github.com/llvm/llvm-project/issues/89060
After argument copy elison the IR value for the eliminated alloca
is aliasing with the fixed stack object. This patch is making sure
that we mark the fixed stack object as being aliased with IR values
to avoid that for example schedulers are reordering accesses to
the fixed stack object. This could otherwise happen when there is a
mix of MemOperands refering the shared fixed stack slow via both
the IR value for the elided alloca, and via a fixed stack pseudo
source value (as would be the case when lowering the arguments).
---
llvm/include/llvm/CodeGen/MachineFrameInfo.h | 7 +++++++
llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp | 3 ++-
llvm/test/CodeGen/Hexagon/arg-copy-elison.ll | 6 ++----
3 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/llvm/include/llvm/CodeGen/MachineFrameInfo.h b/llvm/include/llvm/CodeGen/MachineFrameInfo.h
index 0fe73fec7ee67f..a2c78e9e093d01 100644
--- a/llvm/include/llvm/CodeGen/MachineFrameInfo.h
+++ b/llvm/include/llvm/CodeGen/MachineFrameInfo.h
@@ -701,6 +701,13 @@ class MachineFrameInfo {
return Objects[ObjectIdx+NumFixedObjects].isAliased;
}
+ /// Set "maybe pointed to by an LLVM IR value" for an object.
+ void setIsAliasedObjectIndex(int ObjectIdx, bool IsAliased) {
+ assert(unsigned(ObjectIdx+NumFixedObjects) < Objects.size() &&
+ "Invalid Object Idx!");
+ Objects[ObjectIdx+NumFixedObjects].isAliased = IsAliased;
+ }
+
/// Returns true if the specified index corresponds to an immutable object.
bool isImmutableObjectIndex(int ObjectIdx) const {
// Tail calling functions can clobber their function arguments.
diff --git a/llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp b/llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp
index 3f69f7ad54477e..319465865fb1d1 100644
--- a/llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp
+++ b/llvm/lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp
@@ -11128,7 +11128,7 @@ static void tryToElideArgumentCopy(
}
// Perform the elision. Delete the old stack object and replace its only use
- // in the variable info map. Mark the stack object as mutable.
+ // in the variable info map. Mark the stack object as mutable and aliased.
LLVM_DEBUG({
dbgs() << "Eliding argument copy from " << Arg << " to " << *AI << '\n'
<< " Replacing frame index " << OldIndex << " with " << FixedIndex
@@ -11136,6 +11136,7 @@ static void tryToElideArgumentCopy(
});
MFI.RemoveStackObject(OldIndex);
MFI.setIsImmutableObjectIndex(FixedIndex, false);
+ MFI.setIsAliasedObjectIndex(FixedIndex, true);
AllocaIndex = FixedIndex;
ArgCopyElisionFrameIndexMap.insert({OldIndex, FixedIndex});
for (SDValue ArgVal : ArgVals)
diff --git a/llvm/test/CodeGen/Hexagon/arg-copy-elison.ll b/llvm/test/CodeGen/Hexagon/arg-copy-elison.ll
index 2479d0ed5463fc..f7902e65c46953 100644
--- a/llvm/test/CodeGen/Hexagon/arg-copy-elison.ll
+++ b/llvm/test/CodeGen/Hexagon/arg-copy-elison.ll
@@ -18,14 +18,12 @@ define i32 @f(i32, i32, i32, i32, i32, i32, i32, i32, i32, i32, i32, i32, i32, i
; CHECK-NEXT: // %bb.0:
; CHECK-NEXT: {
; CHECK-NEXT: r0 = memw(r29+#36)
-; CHECK-NEXT: memw(r29+#32) = ##666
-; CHECK-NEXT: }
-; CHECK-NEXT: {
; CHECK-NEXT: r1 = memw(r29+#28)
-; CHECK-NEXT: r2 = memw(r29+#32)
; CHECK-NEXT: }
; CHECK-NEXT: {
; CHECK-NEXT: r0 = sub(r1,r0)
+; CHECK-NEXT: r2 = memw(r29+#32)
+; CHECK-NEXT: memw(r29+#32) = ##666
; CHECK-NEXT: }
; CHECK-NEXT: {
; CHECK-NEXT: r0 = xor(r0,r2)
More information about the llvm-commits
mailing list