[llvm-dev] InlineFunction.cpp: IFI.InlinedCallSites and intrinsics

[Jeroen Dobbelaere via llvm-dev]

Hi Arthur,

I think that the problem is only visible with the full restrict patches where we sometimes remove an intrinsic
after those calls were tracked.

I am not aware of other places, after the tracking of those calls, where intrinsics might be removed.

I can prepare a [nfc] fix for this.

Thanks,

Jeroen Dobbelaere

From: Arthur Eubanks <aeubanks at google.com>
Sent: Friday, July 9, 2021 17:40
To: Jeroen Dobbelaere <dobbel at synopsys.com>
Cc: llvm-dev at lists.llvm.org; chandlerc at google.com; Alina Sbirlea <asbirlea at google.com>
Subject: Re: [llvm-dev] InlineFunction.cpp: IFI.InlinedCallSites and intrinsics

I don't see any reason to add intrinsics into `IFI.InlinedCallSites`. Seems like all users expect it to only contain actual function calls.

Is the use after free specific to your patches, or is it observable currently in ToT LLVM?

On Fri, Jul 9, 2021 at 2:32 AM Jeroen Dobbelaere via llvm-dev <llvm-dev at lists.llvm.org<mailto:llvm-dev at lists.llvm.org>> wrote:
Hi all,

I have been investigating a 'use after free' in the inliner. (This is with the full restrict patches)

The problem is related to an intrinsic call that is removed, but later on is used anyway because
the instruction was being tracked in the 'IFI.InlinedCallSites':

https://github.com/llvm/llvm-project/blob/1db2551cc1a356a67c0967f424d6158e2ea127e3/llvm/lib/Transforms/Utils/InlineFunction.cpp#L2448<https://urldefense.com/v3/__https:/github.com/llvm/llvm-project/blob/1db2551cc1a356a67c0967f424d6158e2ea127e3/llvm/lib/Transforms/Utils/InlineFunction.cpp*L2448__;Iw!!A4F2R9G_pg!P4AfwVV0qdm2EvNlGfQ_aS5TTlh5osJgXFIt0sZKWtNOdyZ-FR28t5FQCR0SRZTzOnhofPef$>

As similar code here:
https://github.com/llvm/llvm-project/blob/1db2551cc1a356a67c0967f424d6158e2ea127e3/llvm/lib/Transforms/Utils/InlineFunction.cpp#L1350<https://urldefense.com/v3/__https:/github.com/llvm/llvm-project/blob/1db2551cc1a356a67c0967f424d6158e2ea127e3/llvm/lib/Transforms/Utils/InlineFunction.cpp*L1350__;Iw!!A4F2R9G_pg!P4AfwVV0qdm2EvNlGfQ_aS5TTlh5osJgXFIt0sZKWtNOdyZ-FR28t5FQCR0SRZTzOlILHK40$>

avoids updating 'IFI.InlinedCalls' for intrinsics, I am wondering if the same logic should be added to the former.
Or is there a good reason that intrinsics must be included in 'IFI.InlinedCallSites' ?

Thanks,

Jeroen Dobbelaere

_______________________________________________
LLVM Developers mailing list
llvm-dev at lists.llvm.org<mailto:llvm-dev at lists.llvm.org>
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev<https://urldefense.com/v3/__https:/lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev__;!!A4F2R9G_pg!P4AfwVV0qdm2EvNlGfQ_aS5TTlh5osJgXFIt0sZKWtNOdyZ-FR28t5FQCR0SRZTzOvJjA3up$>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-dev/attachments/20210709/592e98e8/attachment.html>