[llvm] [Attributor] Fix an issue that could potentially cause `AccessList` and `OffsetBins` out of sync (PR #106187)

[Shilei Tian via llvm-commits]

https://github.com/shiltian created https://github.com/llvm/llvm-project/pull/106187

The implementation of `AAPointerInfo::RangeList::set_difference` doesn't
consider the case where two ranges have the same offset but different sizes.
This could causes `AccessList` and `OffsetBins` out of sync because a range has
been already updated in `AccessList` but missing in `ToRemove`.

I do have a reproducer but the reproducer itself is 248kb. `llvm-reduce` can't
further reduce it. Not sure how I can make a smaller reproducer.

Fix SWDEV-479757.

>From 3c514420c3f915707528c5e44a67418819e2bb9e Mon Sep 17 00:00:00 2001
From: Shilei Tian <i at tianshilei.me>
Date: Tue, 27 Aug 2024 01:29:19 -0400
Subject: [PATCH] [Attributor] Fix an issue that could potentially cause
 `AccessList` and `OffsetBins` out of  sync

The implementation of `AAPointerInfo::RangeList::set_difference` doesn't
consider the case where two ranges have the same offset but different sizes.
This could causes `AccessList` and `OffsetBins` out of sync because a range has
been already updated in `AccessList` but missing in `ToRemove`.

I do have a reproducer but the reproducer itself is 248kb. `llvm-reduce` can't
further reduce it. Not sure how I can make a smaller reproducer.

Fix SWDEV-479757.
---
 llvm/include/llvm/Transforms/IPO/Attributor.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/llvm/include/llvm/Transforms/IPO/Attributor.h b/llvm/include/llvm/Transforms/IPO/Attributor.h
index 718cf704cbdf1a..e4e94ad40acb8d 100644
--- a/llvm/include/llvm/Transforms/IPO/Attributor.h
+++ b/llvm/include/llvm/Transforms/IPO/Attributor.h
@@ -5818,7 +5818,10 @@ struct AAPointerInfo : public AbstractAttribute {
     static void set_difference(const RangeList &L, const RangeList &R,
                                RangeList &D) {
       std::set_difference(L.begin(), L.end(), R.begin(), R.end(),
-                          std::back_inserter(D), RangeTy::OffsetLessThan);
+                          std::back_inserter(D),
+                          [](const RangeTy &L, const RangeTy &R) {
+                            return (L.Offset < R.Offset) || (L != R);
+                          });
     }
 
     unsigned size() const { return Ranges.size(); }