https://llvm.org/bugs/show_bug.cgi?id=25846
Bug ID: 25846
Summary: [Statepoint] Dangling pointer in RS4GC
Product: libraries
Version: trunk
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P
Component: Scalar Optimizations
Assignee: unassignedb...@nondot.org
Reporter: m...@manueljacob.de
CC: llvm-bugs@lists.llvm.org
Classification: Unclassified
Created attachment 15459
--> https://llvm.org/bugs/attachment.cgi?id=15459&action=edit
Example IR, exposing the bug
In RS4GC, ReplaceBaseInstWith() deletes an instruction without removing it from
the `States` mapping sometimes. I've attached a crashing example and two
patches, applying *one* of them is sufficient to make the dangling pointer show
up early. Otherwise the dangling pointer will get into the cache, crashing
`opt` at some later point nondeterministically.
You can reproduce it by: opt -spp-no-entry -spp-no-backedge -place-safepoints
-rewrite-statepoints-for-gc test.ll
Here's why I think it fails:
0) `States` before first call of ReplaceBaseInstWith():
%phi1 -> %phi1.base [won't change, omitted below]
%select1 -> %select1.base
%select2 -> %select2.base
1) ReplaceBaseInstWith() is called with BDV = %select2, BaseI = %select2.base,
Replacement = %select1.base, because simplify(%select2.base) = %select1.base
%select1 -> %select1.base
%select2 -> %select1.base
2) ReplaceBaseInstWith() is called with BDV = %select1, BaseI = %select1.base,
Replacement = %select1, because %select1.base is "identical" to %select1
%select1 -> %select1
%select2 -> %select1.base
Now deleting %select1.base is wrong because it's still in `States`.
The code assumes (`ReverseMap`) that `States`'s BDV -> base mapping is
injective, but it's not after 1). Therefore it's not sufficient to replace
only the BDV -> BaseI entry with BDV -> Replacement, since multiple BDVs (and
not only the one from `ReverseMap`) might map to BaseI.
Instructions:
%select1 = select i1 undef, i8 addrspace(1)* %in1, i8 addrspace(1)* %in2
%select1.base = select i1 undef, i8 addrspace(1)* %in1, i8 addrspace(1)* %in2,
!is_base_value !0
%select2 = select i1 undef, i8 addrspace(1)* %select1, i8 addrspace(1)*
%select1
%select2.base = select i1 undef, i8 addrspace(1)* %select1.base, i8
addrspace(1)* %select1.base, !is_base_value !0
--
You are receiving this mail because:
You are on the CC list for the bug.
_______________________________________________
llvm-bugs mailing list
llvm-bugs@lists.llvm.org
http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
