From: Hal Finkel <hfinkel@anl.gov>
Date: Thu, 21 May 2015 23:45:49 +0000 (+0000)
Subject: [PPC] Correct iterator bug in PPCTLSDynamicCall
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=afcd3e68a80fea682a2b16d33997e6c8a683e3d1;p=oota-llvm.git

[PPC] Correct iterator bug in PPCTLSDynamicCall

Unfortunately, I can't reduce a small test case for this (although compiling
mpfr-3.1.2 with -O2 -mcpu=a2 would fairly reliably trigger a crash), but the
problem is fairly clear (at least once you know you're looking for one). If the
TLS instruction being replaced was at the end of the block, we'd increment the
iterator past it (so it would then point to MBB.end()), and then we'd increment
it again as part of the for statement, thus overrunning the end of the list.
Don't do that.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237974 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/lib/Target/PowerPC/PPCTLSDynamicCall.cpp b/lib/Target/PowerPC/PPCTLSDynamicCall.cpp
index 270fc712be1..2dc0d825c80 100644
--- a/lib/Target/PowerPC/PPCTLSDynamicCall.cpp
+++ b/lib/Target/PowerPC/PPCTLSDynamicCall.cpp
@@ -55,14 +55,16 @@ protected:
       bool Is64Bit = MBB.getParent()->getSubtarget<PPCSubtarget>().isPPC64();
 
       for (MachineBasicBlock::iterator I = MBB.begin(), IE = MBB.end();
-           I != IE; ++I) {
+           I != IE;) {
         MachineInstr *MI = I;
 
         if (MI->getOpcode() != PPC::ADDItlsgdLADDR &&
             MI->getOpcode() != PPC::ADDItlsldLADDR &&
             MI->getOpcode() != PPC::ADDItlsgdLADDR32 &&
-            MI->getOpcode() != PPC::ADDItlsldLADDR32)
+            MI->getOpcode() != PPC::ADDItlsldLADDR32) {
+          ++I;
           continue;
+        }
 
         DEBUG(dbgs() << "TLS Dynamic Call Fixup:\n    " << *MI;);