llvm-project/llvm/lib/Transforms
Chandler Carruth 2de93afee3 Fix a really terrifying but improbable bug in mem2reg. If you have seen
extremely subtle miscompilations (such as a load getting replaced with
the value stored *below* the load within a basic block) related to
promoting an alloca to an SSA value, there is the dim possibility that
you hit this. Please let me know if you won this unfortunate lottery.

The first half of mem2reg's core logic (as it is used both in the
standalone mem2reg pass and in SROA) builds up a mapping from
'Instruction *' to the index of that instruction within its basic block.
This allows quickly establishing which store dominate a particular load
even for large basic blocks. We cache this information throughout the
run of mem2reg over a function in order to amortize the cost of
computing it.

This is not in and of itself a strange pattern in LLVM. However, it
introduces a very important constraint: absolutely no instruction can be
deleted from the program without updating the mapping. Otherwise a newly
allocated instruction might get the same pointer address, and then end
up with a wrong index. Yes, LLVM routinely suffers from a *single
threaded* variant of the ABA problem. Most places in LLVM don't find
avoiding this an imposition because they don't both delete and create
new instructions iteratively, but mem2reg *loves* to do this... All the
time. Fortunately, the mem2reg code was really careful about updating
this cache to handle this eventuallity... except when it comes to the
debug declare intrinsic. Oops. The fix is to invalidate that pointer in
the cache when we delete it, the same as we do when deleting alloca
instructions and other instructions.

I've also caused the same bug in new code while working on a fix to
PR16867, so this seems to be a really unfortunate pattern. Hopefully in
subsequent patches the deletion of dead instructions can be consolidated
sufficiently to make it less likely that we'll see future occurences of
this bug.

Sorry for not having a test case, but I have literally no idea how to
reliably trigger this kind of thing. It may be single-threaded, but it
remains an ABA problem. It would require a really amazing number of
stars to align.

llvm-svn: 188367
2013-08-14 08:56:41 +00:00
..
Hello Move all of the header files which are involved in modelling the LLVM IR 2013-01-02 11:36:10 +00:00
IPO Also remove logic in LateVectorize 2013-08-13 16:12:04 +00:00
InstCombine Fix always creating GEP with i32 indices 2013-08-14 00:24:38 +00:00
Instrumentation dfsan: fix lint warnings 2013-08-13 16:52:41 +00:00
ObjCARC [objc-arc] Track if we encountered an additive overflow while computing {TopDown,BottomUp}PathCounts and do nothing if it occurred. 2013-08-09 23:22:27 +00:00
Scalar Revert r187191, which broke opt -mem2reg on the testcases included in PR16867. 2013-08-13 22:51:58 +00:00
Utils Fix a really terrifying but improbable bug in mem2reg. If you have seen 2013-08-14 08:56:41 +00:00
Vectorize BBVectorize: Add initial stores to the write set when tracking uses 2013-08-13 23:34:32 +00:00
CMakeLists.txt Extracted ObjCARC.cpp into its own library libLLVMObjCARCOpts in preparation for refactoring the ARC Optimizer. 2013-01-28 01:35:51 +00:00
LLVMBuild.txt Extracted ObjCARC.cpp into its own library libLLVMObjCARCOpts in preparation for refactoring the ARC Optimizer. 2013-01-28 01:35:51 +00:00
Makefile Extracted ObjCARC.cpp into its own library libLLVMObjCARCOpts in preparation for refactoring the ARC Optimizer. 2013-01-28 01:35:51 +00:00