From 5f9683f54fd2655db302ba4c0434ac8b2a3c9cd3 Mon Sep 17 00:00:00 2001
From: Karthik Bhat <kv.bhat@samsung.com>
Date: Tue, 10 Mar 2015 13:31:03 +0000
Subject: [PATCH] Fix a crash in Dependency Analysis. This crash in Dependency
 analysis is because we assume here that in case of UsefulGEP both source and
 destination have the same number of operands which may not be true. This
 incorrect assumption results in crash while populating Pairs. Fix the same.

This crash was observed during lnt regression for code such as-
  struct s{
    int A[10][10];
    int C[10][10][10];
  } S;
  void dep_constraint_crash_test(int k,int N)  {
     for( int i=0;i<N;i++)
       for( int j=0;j<N;j++)
         S.A[0][0] = S.C[0][0][k];
  }
Review: http://reviews.llvm.org/D8162



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231784 91177308-0d34-0410-b5e6-96231b3b80d8
---
 lib/Analysis/DependenceAnalysis.cpp           | 12 ++---
 test/Analysis/DependenceAnalysis/UsefulGEP.ll | 51 +++++++++++++++++++
 2 files changed, 57 insertions(+), 6 deletions(-)
 create mode 100644 test/Analysis/DependenceAnalysis/UsefulGEP.ll

diff --git a/lib/Analysis/DependenceAnalysis.cpp b/lib/Analysis/DependenceAnalysis.cpp
index b3a6f6f47c0..3dcfcb839ad 100644
--- a/lib/Analysis/DependenceAnalysis.cpp
+++ b/lib/Analysis/DependenceAnalysis.cpp
@@ -3346,9 +3346,9 @@ DependenceAnalysis::depends(Instruction *Src, Instruction *Dst,
     DEBUG(dbgs() << "    SrcPtrSCEV = " << *SrcPtrSCEV << "\n");
     DEBUG(dbgs() << "    DstPtrSCEV = " << *DstPtrSCEV << "\n");
 
-    UsefulGEP =
-      isLoopInvariant(SrcPtrSCEV, LI->getLoopFor(Src->getParent())) &&
-      isLoopInvariant(DstPtrSCEV, LI->getLoopFor(Dst->getParent()));
+    UsefulGEP = isLoopInvariant(SrcPtrSCEV, LI->getLoopFor(Src->getParent())) &&
+                isLoopInvariant(DstPtrSCEV, LI->getLoopFor(Dst->getParent())) &&
+                (SrcGEP->getNumOperands() == DstGEP->getNumOperands());
   }
   unsigned Pairs = UsefulGEP ? SrcGEP->idx_end() - SrcGEP->idx_begin() : 1;
   SmallVector<Subscript, 4> Pair(Pairs);
@@ -3773,9 +3773,9 @@ const  SCEV *DependenceAnalysis::getSplitIteration(const Dependence &Dep,
       SrcGEP->getPointerOperandType() == DstGEP->getPointerOperandType()) {
     const SCEV *SrcPtrSCEV = SE->getSCEV(SrcGEP->getPointerOperand());
     const SCEV *DstPtrSCEV = SE->getSCEV(DstGEP->getPointerOperand());
-    UsefulGEP =
-      isLoopInvariant(SrcPtrSCEV, LI->getLoopFor(Src->getParent())) &&
-      isLoopInvariant(DstPtrSCEV, LI->getLoopFor(Dst->getParent()));
+    UsefulGEP = isLoopInvariant(SrcPtrSCEV, LI->getLoopFor(Src->getParent())) &&
+                isLoopInvariant(DstPtrSCEV, LI->getLoopFor(Dst->getParent())) &&
+                (SrcGEP->getNumOperands() == DstGEP->getNumOperands());
   }
   unsigned Pairs = UsefulGEP ? SrcGEP->idx_end() - SrcGEP->idx_begin() : 1;
   SmallVector<Subscript, 4> Pair(Pairs);
diff --git a/test/Analysis/DependenceAnalysis/UsefulGEP.ll b/test/Analysis/DependenceAnalysis/UsefulGEP.ll
new file mode 100644
index 00000000000..83c43cfca64
--- /dev/null
+++ b/test/Analysis/DependenceAnalysis/UsefulGEP.ll
@@ -0,0 +1,51 @@
+; RUN: opt < %s -analyze -basicaa -da
+;; Check this doesn't crash.
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+;; struct s {
+;;   int A[10][10];
+;;   int C[10][10][10]; 
+;; } S;
+
+;; void dep_constraint_crash_test(int k,int N) {
+;;   for( int i=0;i<N;i++)
+;;     for( int j=0;j<N;j++)
+;;       S.A[0][0] = S.C[0][0][k];
+;; }
+
+
+%struct.s = type { [10 x [10 x i32]], [10 x [10 x [10 x i32]]] }
+
+@S = common global %struct.s zeroinitializer
+
+define void @dep_constraint_crash_test(i32 %k, i32 %N) {
+entry:
+  %cmp12 = icmp sgt i32 %N, 0
+  br i1 %cmp12, label %for.cond1.preheader.lr.ph, label %for.end6
+
+for.cond1.preheader.lr.ph:                        
+  %idxprom = sext i32 %k to i64
+  %arrayidx = getelementptr inbounds %struct.s, %struct.s* @S, i64 0, i32 1, i64 0, i64 0, i64 %idxprom
+  br label %for.body3.preheader
+
+for.body3.preheader:                              
+  %i.013 = phi i32 [ 0, %for.cond1.preheader.lr.ph ], [ %inc5, %for.inc4 ]
+  br label %for.body3
+
+for.body3:                                        
+  %j.011 = phi i32 [ %inc, %for.body3 ], [ 0, %for.body3.preheader ]
+  %0 = load i32, i32* %arrayidx
+  store i32 %0, i32* getelementptr inbounds (%struct.s* @S, i64 0, i32 0, i64 0, i64 0)
+  %inc = add nuw nsw i32 %j.011, 1
+  %exitcond = icmp eq i32 %inc, %N
+  br i1 %exitcond, label %for.inc4, label %for.body3
+
+for.inc4:                                         
+  %inc5 = add nuw nsw i32 %i.013, 1
+  %exitcond14 = icmp eq i32 %inc5, %N
+  br i1 %exitcond14, label %for.end6, label %for.body3.preheader
+
+for.end6:                                         
+  ret void
+}
-- 
2.34.1