From 22c45e1b0aed9ed8396037b4bedde332abf5da10 Mon Sep 17 00:00:00 2001 From: Elena Demikhovsky Date: Wed, 7 Sep 2016 20:54:33 +0000 Subject: [PATCH] Shift-left (ISD::SHL) operation crashes on "DAG Legalization" phase. https://llvm.org/bugs/show_bug.cgi?id=29058. While node legalization we tried to legalize its operands. If an operand node is replaced during legalization the user node may be destroyed. Differential Revision: https://reviews.llvm.org/D24244 git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@280862 91177308-0d34-0410-b5e6-96231b3b80d8 --- lib/CodeGen/SelectionDAG/LegalizeDAG.cpp | 48 +++++++++++++---------- test/CodeGen/X86/shl-crash-on-legalize.ll | 33 ++++++++++++++++ 2 files changed, 60 insertions(+), 21 deletions(-) create mode 100644 test/CodeGen/X86/shl-crash-on-legalize.ll diff --git a/lib/CodeGen/SelectionDAG/LegalizeDAG.cpp b/lib/CodeGen/SelectionDAG/LegalizeDAG.cpp index 71e9197b41c..9c560541d13 100644 --- a/lib/CodeGen/SelectionDAG/LegalizeDAG.cpp +++ b/lib/CodeGen/SelectionDAG/LegalizeDAG.cpp @@ -1067,35 +1067,41 @@ void SelectionDAGLegalize::LegalizeOp(SDNode *Node) { case ISD::SRL: case ISD::SRA: case ISD::ROTL: - case ISD::ROTR: + case ISD::ROTR: { // Legalizing shifts/rotates requires adjusting the shift amount // to the appropriate width. - if (!Node->getOperand(1).getValueType().isVector()) { - SDValue SAO = - DAG.getShiftAmountOperand(Node->getOperand(0).getValueType(), - Node->getOperand(1)); - HandleSDNode Handle(SAO); - LegalizeOp(SAO.getNode()); - NewNode = DAG.UpdateNodeOperands(Node, Node->getOperand(0), - Handle.getValue()); + SDValue Op0 = Node->getOperand(0); + SDValue Op1 = Node->getOperand(1); + if (!Op1.getValueType().isVector()) { + SDValue SAO = DAG.getShiftAmountOperand(Op0.getValueType(), Op1); + // The getShiftAmountOperand() may create a new operand node or + // return the existing one. If new operand is created we need + // to update the parent node. + // Do not try to legalize SAO here! It will be automatically legalized + // in the next round. + if (SAO != Op1) + NewNode = DAG.UpdateNodeOperands(Node, Op0, SAO); } - break; + } + break; case ISD::SRL_PARTS: case ISD::SRA_PARTS: - case ISD::SHL_PARTS: + case ISD::SHL_PARTS: { // Legalizing shifts/rotates requires adjusting the shift amount // to the appropriate width. - if (!Node->getOperand(2).getValueType().isVector()) { - SDValue SAO = - DAG.getShiftAmountOperand(Node->getOperand(0).getValueType(), - Node->getOperand(2)); - HandleSDNode Handle(SAO); - LegalizeOp(SAO.getNode()); - NewNode = DAG.UpdateNodeOperands(Node, Node->getOperand(0), - Node->getOperand(1), - Handle.getValue()); + SDValue Op0 = Node->getOperand(0); + SDValue Op1 = Node->getOperand(1); + SDValue Op2 = Node->getOperand(2); + if (!Op2.getValueType().isVector()) { + SDValue SAO = DAG.getShiftAmountOperand(Op0.getValueType(), Op2); + // The getShiftAmountOperand() may create a new operand node or + // return the existing one. If new operand is created we need + // to update the parent node. + if (SAO != Op2) + NewNode = DAG.UpdateNodeOperands(Node, Op0, Op1, SAO); } - break; + } + break; } if (NewNode != Node) { diff --git a/test/CodeGen/X86/shl-crash-on-legalize.ll b/test/CodeGen/X86/shl-crash-on-legalize.ll new file mode 100644 index 00000000000..2029bae8c46 --- /dev/null +++ b/test/CodeGen/X86/shl-crash-on-legalize.ll @@ -0,0 +1,33 @@ +; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py +;RUN: llc < %s | FileCheck %s + +; This test case failed on legalization of "shl" node. PR29058. + +target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128" +target triple = "x86_64-unknown-linux-gnu" + +@structMember = external local_unnamed_addr global i64, align 8 + +; Function Attrs: norecurse nounwind uwtable +define i32 @_Z3foov() local_unnamed_addr #0 { +; CHECK-LABEL: _Z3foov: +; CHECK: # BB#0: # %entry +; CHECK-NEXT: movq %rax, {{.*}}(%rip) +; CHECK-NEXT: retq +entry: + %bool_1 = icmp ne i8 undef, 0 + %bool_2 = icmp eq i8 undef, 0 + %0 = select i1 %bool_2, i32 2147483646, i32 undef + %or_1 = select i1 %bool_1, i32 undef, i32 -1 + %shl_1 = shl i32 %0, %or_1 + %conv = zext i32 %shl_1 to i64 + store i64 %conv, i64* @structMember, align 8 + %tmp = select i1 %bool_2, i32 2147483646, i32 undef + %lnot = icmp eq i8 undef, 0 + %or_2 = select i1 %lnot, i32 -1, i32 undef + %shl_2 = shl i32 %tmp, %or_2 + ret i32 %shl_2 +} + +attributes #0 = { norecurse nounwind uwtable "correctly-rounded-divide-sqrt-fp-math"="false" "disable-tail-calls"="false" "less-precise-fpmad"="false" "no-frame-pointer-elim"="false" "no-infs-fp-math"="false" "no-jump-tables"="false" "no-nans-fp-math"="false" "no-signed-zeros-fp-math"="false" "stack-protector-buffer-size"="8" "target-cpu"="x86-64" "target-features"="+fxsr,+mmx,+sse,+sse2,+x87" "unsafe-fp-math"="false" "use-soft-float"="false" } +