Skip to content

Commit 105b1b0

Browse files
ivafanasAnthony Tran
authored andcommitted
[CodeGen][CodeLayout] Fix segfault on access to deleted block in MBP. (llvm#142357)
Problem 1: There is a typo which reassigns `BlockWorkList` to `EHPadWorkList` on attempt to remove `RemBB` from work lists. Problem 2: `Chain->UnscheduledPredecessors == 0` is an incorrect way to check whether `RemBB` is enqueued or not. The root cause is a postponed deletion of `WorkList` from already scheduled blocks in `selectBestCandidateBlock`. Bug happens in the following scenario: * `FunctionChain` is being processed with non-zero `UnscheduledPredecessors` * Block `B'` is added to the `BlockWorkList` * Block `B'` is chosen as the best successor (`selectBestSuccessor`) for some another block and added into `Chain` * Block `B'` is removed by tail duplicator. `RemovalCallback` erroneously won't erase `B'` from `BlockWorkList`, because `UnscheduledPredecessors` value of `FunctionChain` is not zero (and it is allowed to be non-zero). Proposed solution is to always cleanup worklists on block deletion by tail duplicator.
1 parent d34720c commit 105b1b0

File tree

1 file changed

+5
-10
lines changed

1 file changed

+5
-10
lines changed

llvm/lib/CodeGen/MachineBlockPlacement.cpp

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3228,13 +3228,9 @@ bool MachineBlockPlacement::maybeTailDuplicateBlock(
32283228
// Signal to outer function
32293229
Removed = true;
32303230

3231-
// Conservative default.
3232-
bool InWorkList = true;
32333231
// Remove from the Chain and Chain Map
32343232
if (auto It = BlockToChain.find(RemBB); It != BlockToChain.end()) {
3235-
BlockChain *Chain = It->second;
3236-
InWorkList = Chain->UnscheduledPredecessors == 0;
3237-
Chain->remove(RemBB);
3233+
It->second->remove(RemBB);
32383234
BlockToChain.erase(It);
32393235
}
32403236

@@ -3244,11 +3240,10 @@ bool MachineBlockPlacement::maybeTailDuplicateBlock(
32443240
}
32453241

32463242
// Handle the Work Lists
3247-
if (InWorkList) {
3248-
SmallVectorImpl<MachineBasicBlock *> &RemoveList = BlockWorkList;
3249-
if (RemBB->isEHPad())
3250-
RemoveList = EHPadWorkList;
3251-
llvm::erase(RemoveList, RemBB);
3243+
if (RemBB->isEHPad()) {
3244+
llvm::erase(EHPadWorkList, RemBB);
3245+
} else {
3246+
llvm::erase(BlockWorkList, RemBB);
32523247
}
32533248

32543249
// Handle the filter set

0 commit comments

Comments
 (0)