[llvm] [Attributor] Fix an issue that could potentially cause `AccessList` and `OffsetBins` out of sync (PR #106187)

[Shilei Tian via llvm-commits]

https://github.com/shiltian updated https://github.com/llvm/llvm-project/pull/106187

>From cb98c623a9a215583cb4b20d03be0f58580b4412 Mon Sep 17 00:00:00 2001
From: Shilei Tian <i at tianshilei.me>
Date: Tue, 27 Aug 2024 01:29:19 -0400
Subject: [PATCH] [Attributor] Fix an issue that could potentially cause
 `AccessList` and `OffsetBins` out of  sync

The implementation of `AAPointerInfo::RangeList::set_difference` doesn't
consider the case where two ranges have the same offset but different sizes.
This could causes `AccessList` and `OffsetBins` out of sync because a range has
been already updated in `AccessList` but missing in `ToRemove`.

I do have a reproducer but the reproducer itself is 248kb. `llvm-reduce` can't
further reduce it. Not sure how I can make a smaller reproducer.

Fix SWDEV-479757.
---
 llvm/include/llvm/Transforms/IPO/Attributor.h | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/llvm/include/llvm/Transforms/IPO/Attributor.h b/llvm/include/llvm/Transforms/IPO/Attributor.h
index 718cf704cbdf1a..57aea2c6897e8c 100644
--- a/llvm/include/llvm/Transforms/IPO/Attributor.h
+++ b/llvm/include/llvm/Transforms/IPO/Attributor.h
@@ -5817,8 +5817,12 @@ struct AAPointerInfo : public AbstractAttribute {
     /// Copy ranges from \p L that are not in \p R, into \p D.
     static void set_difference(const RangeList &L, const RangeList &R,
                                RangeList &D) {
-      std::set_difference(L.begin(), L.end(), R.begin(), R.end(),
-                          std::back_inserter(D), RangeTy::OffsetLessThan);
+      std::set_difference(
+          L.begin(), L.end(), R.begin(), R.end(), std::back_inserter(D),
+          [](const RangeTy &L, const RangeTy &R) {
+            return (L.Offset < R.Offset) ||
+                   ((L.Offset == R.Offset) && (L.Size != R.Size));
+          });
     }
 
     unsigned size() const { return Ranges.size(); }