[ValueTracking] Limit scan when checking poison UB (PR50155)

The current code can scan an unlimited number of instructions,
if the containing basic block is very large. The test case from
PR50155 contains a basic block with approximately 100k instructions.

To avoid this, limit the number of instructions we inspect. At
the same time, drop the limit on the number of basic blocks, as
this will be implicitly limited by the number of instructions as
well.
This commit is contained in:
Nikita Popov 2021-04-30 22:38:40 +02:00
parent bf61690e92
commit 2cd7868605
1 changed files with 13 additions and 2 deletions

View File

@ -5382,6 +5382,9 @@ static bool programUndefinedIfUndefOrPoison(const Value *V,
return false; return false;
} }
// Limit number of instructions we look at, to avoid scanning through large
// blocks. The current limit is chosen arbitrarily.
unsigned ScanLimit = 32;
BasicBlock::const_iterator End = BB->end(); BasicBlock::const_iterator End = BB->end();
if (!PoisonOnly) { if (!PoisonOnly) {
@ -5390,6 +5393,11 @@ static bool programUndefinedIfUndefOrPoison(const Value *V,
// well-defined operands. // well-defined operands.
for (auto &I : make_range(Begin, End)) { for (auto &I : make_range(Begin, End)) {
if (isa<DbgInfoIntrinsic>(I))
continue;
if (--ScanLimit == 0)
break;
SmallPtrSet<const Value *, 4> WellDefinedOps; SmallPtrSet<const Value *, 4> WellDefinedOps;
getGuaranteedWellDefinedOps(&I, WellDefinedOps); getGuaranteedWellDefinedOps(&I, WellDefinedOps);
for (auto *Op : WellDefinedOps) { for (auto *Op : WellDefinedOps) {
@ -5415,9 +5423,12 @@ static bool programUndefinedIfUndefOrPoison(const Value *V,
for_each(V->users(), Propagate); for_each(V->users(), Propagate);
Visited.insert(BB); Visited.insert(BB);
unsigned Iter = 0; while (true) {
while (Iter++ < MaxAnalysisRecursionDepth) {
for (auto &I : make_range(Begin, End)) { for (auto &I : make_range(Begin, End)) {
if (isa<DbgInfoIntrinsic>(I))
continue;
if (--ScanLimit == 0)
return false;
if (mustTriggerUB(&I, YieldsPoison)) if (mustTriggerUB(&I, YieldsPoison))
return true; return true;
if (!isGuaranteedToTransferExecutionToSuccessor(&I)) if (!isGuaranteedToTransferExecutionToSuccessor(&I))