Skip to content

Commit 83aa93e

Browse files
committed
[VectorUtils] Do not try to add indices matching tombstone/empty values.
Keys matching the tombstone/empty special values cannot be inserted in a DenseMap. Under some circumstances, LV tries to add members to an interleave group that match the special values. Skip adding such members. This is unlikely to have any impact in practice, because interleave groups with such indices are very likely to not be vectorized, due to gaps. This issue has been surfaced by fuzzing, see https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11638
1 parent 3bd2457 commit 83aa93e

File tree

2 files changed

+65
-0
lines changed

2 files changed

+65
-0
lines changed

llvm/include/llvm/Analysis/VectorUtils.h

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -620,6 +620,11 @@ template <typename InstTy> class InterleaveGroup {
620620
return false;
621621
int32_t Key = *MaybeKey;
622622

623+
// Skip if the key is used for either the tombstone or empty special values.
624+
if (DenseMapInfo<int32_t>::getTombstoneKey() == Key ||
625+
DenseMapInfo<int32_t>::getEmptyKey() == Key)
626+
return false;
627+
623628
// Skip if there is already a member with the same index.
624629
if (Members.find(Key) != Members.end())
625630
return false;

llvm/test/Transforms/LoopVectorize/X86/interleaved-accesses-large-gap.ll

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,3 +38,63 @@ for.body: ; preds = %for.body, %entry
3838
for.cond.cleanup: ; preds = %for.body
3939
ret void
4040
}
41+
42+
; Make sure interleave groups with a key being the special 'empty' value for
43+
; the map do not cause a crash.
44+
define void @test_gap_empty_key() {
45+
; CHECK-LABEL: @test_gap_empty_key()
46+
; CHECK-NEXT: entry:
47+
; CHECK-NEXT: br label %for.body
48+
49+
; CHECK-LABEL: for.body:
50+
; CHECK: store i32
51+
; CHECK: store i32
52+
; CHECK-NOT: store
53+
;
54+
entry:
55+
br label %for.body
56+
57+
for.body:
58+
%iv = phi i64 [ 1, %entry ], [ %iv.next, %for.body ]
59+
%iv.next = add nsw i64 %iv, 1
60+
%arrayidx = getelementptr inbounds [3 x i32], [3 x i32]* undef, i64 0, i64 %iv.next
61+
%G2 = getelementptr i32, i32* %arrayidx, i64 %iv.next
62+
%G9 = getelementptr i32, i32* %G2, i32 -2147483647
63+
store i32 0, i32* %G2
64+
store i32 1, i32* %G9
65+
%cmp = icmp ule i64 %iv, 1000
66+
br i1 false, label %for.body, label %exit
67+
68+
exit:
69+
ret void
70+
}
71+
72+
; Make sure interleave groups with a key being the special 'tombstone' value for
73+
; the map do not cause a crash.
74+
define void @test_tombstone_key() {
75+
; CHECK-LABEL: @test_tombstone_key()
76+
; CHECK-NEXT: entry:
77+
; CHECK-NEXT: br label %for.body
78+
79+
; CHECK-LABEL: for.body:
80+
; CHECK: store i32
81+
; CHECK: store i32
82+
; CHECK-NOT: store
83+
;
84+
entry:
85+
br label %for.body
86+
87+
for.body:
88+
%iv = phi i64 [ 1, %entry ], [ %iv.next, %for.body ]
89+
%iv.next = add nsw i64 %iv, 1
90+
%arrayidx = getelementptr inbounds [3 x i32], [3 x i32]* undef, i64 0, i64 %iv.next
91+
%G2 = getelementptr i32, i32* %arrayidx, i64 %iv.next
92+
%G9 = getelementptr i32, i32* %G2, i32 -2147483648
93+
store i32 0, i32* %G2
94+
store i32 1, i32* %G9
95+
%cmp = icmp ule i64 %iv, 1000
96+
br i1 false, label %for.body, label %exit
97+
98+
exit:
99+
ret void
100+
}

0 commit comments

Comments
 (0)