Bladeren bron

[GVN] Avoid casting a vector of size less than 8 bits to i8

Summary:
A reprise of D25849.

This crash was found through fuzzing some time ago and was documented in PR28879.

No check for load size has been added due to the following tests:
  - Transforms/GVN/invariant.group.ll
  - Transforms/GVN/pr10820.ll

These tests expect load sizes that are not a multiple of eight.

Thanks to @davide for the original patch.

Reviewers: nlopes, davide, RKSimon, reames, efriedma

Reviewed By: efriedma

Subscribers: davide, llvm-commits, Prazek

Differential Revision: https://reviews.llvm.org/D48330

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@335294 91177308-0d34-0410-b5e6-96231b3b80d8
Matthew Voss 7 jaren geleden
bovenliggende
commit
f257d99f7a
2 gewijzigde bestanden met toevoegingen van 41 en 1 verwijderingen
  1. 7 1
      lib/Transforms/Utils/VNCoercion.cpp
  2. 34 0
      test/Transforms/GVN/pr28879.ll

+ 7 - 1
lib/Transforms/Utils/VNCoercion.cpp

@@ -20,8 +20,14 @@ bool canCoerceMustAliasedValueToLoad(Value *StoredVal, Type *LoadTy,
       StoredVal->getType()->isStructTy() || StoredVal->getType()->isArrayTy())
     return false;
 
+  uint64_t StoreSize = DL.getTypeSizeInBits(StoredVal->getType());
+
+  // The store size must be byte-aligned to support future type casts.
+  if (llvm::alignTo(StoreSize, 8) != StoreSize)
+    return false;
+
   // The store has to be at least as big as the load.
-  if (DL.getTypeSizeInBits(StoredVal->getType()) < DL.getTypeSizeInBits(LoadTy))
+  if (StoreSize < DL.getTypeSizeInBits(LoadTy))
     return false;
 
   // Don't coerce non-integral pointers to integers or vice versa.

+ 34 - 0
test/Transforms/GVN/pr28879.ll

@@ -0,0 +1,34 @@
+; RUN: opt -gvn <%s -S -o - | FileCheck %s
+
+define void @f() {
+entry:
+  %a = alloca <7 x i1>, align 2
+  store <7 x i1> undef, <7 x i1>* %a, align 2
+; CHECK: store <7 x i1> undef, <7 x i1>*
+  %0 = getelementptr inbounds <7 x i1>, <7 x i1>* %a, i64 0, i64 0
+  %val = load i1, i1* %0, align 2
+; CHECK: load i1, i1* 
+  br i1 %val, label %cond.true, label %cond.false
+
+cond.true:
+  ret void
+
+cond.false:
+  ret void
+}
+
+define <7 x i1> @g(<7 x i1>* %a) {
+entry:
+  %vec = load <7 x i1>, <7 x i1>* %a
+; CHECK: load <7 x i1>, <7 x i1>*
+  %0 = getelementptr inbounds <7 x i1>, <7 x i1>* %a, i64 0, i64 0
+  %val = load i1, i1* %0, align 2
+; CHECK: load i1, i1*
+  br i1 %val, label %cond.true, label %cond.false
+
+cond.true:
+  ret <7 x i1> %vec
+
+cond.false:
+  ret <7 x i1> <i1 false, i1 false, i1 false, i1 false, i1 false, i1 false, i1 false>
+}