Skip to content

[MachineBasicBlock] Fix use after free in SplitCriticalEdge #68786

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Oct 15, 2023
Merged

[MachineBasicBlock] Fix use after free in SplitCriticalEdge #68786

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2f753b4
[MachineBasicBlock] Fix use after free in SplitCriticalEdge
perlfu Oct 11, 2023
bd96a52
Address reviewer feedback:
perlfu Oct 12, 2023
6e2ba5a
Address reviewer nits:
perlfu Oct 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 27 additions & 31 deletions llvm/lib/CodeGen/MachineBasicBlock.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1097,6 +1097,30 @@ static bool jumpTableHasOtherUses(const MachineFunction &MF,
return false;
}

class SlotIndexUpdateDelegate : public MachineFunction::Delegate {
private:
MachineFunction &MF;
SlotIndexes *Indexes;

public:
SlotIndexUpdateDelegate(MachineFunction &MF, SlotIndexes *Indexes)
: MF(MF), Indexes(Indexes) {
MF.setDelegate(this);
}

~SlotIndexUpdateDelegate() { MF.resetDelegate(this); }

void MF_HandleInsertion(MachineInstr &MI) override {
if (Indexes)
Indexes->insertMachineInstrInMaps(MI);
}

void MF_HandleRemoval(MachineInstr &MI) override {
if (Indexes)
Indexes->removeMachineInstrFromMaps(MI);
}
};

MachineBasicBlock *MachineBasicBlock::SplitCriticalEdge(
MachineBasicBlock *Succ, Pass &P,
std::vector<SparseBitVector<>> *LiveInSets) {
Expand Down Expand Up @@ -1170,51 +1194,23 @@ MachineBasicBlock *MachineBasicBlock::SplitCriticalEdge(

ReplaceUsesOfBlockWith(Succ, NMBB);

// If updateTerminator() removes instructions, we need to remove them from
// SlotIndexes.
SmallVector<MachineInstr*, 4> Terminators;
if (Indexes) {
for (MachineInstr &MI :
llvm::make_range(getFirstInstrTerminator(), instr_end()))
Terminators.push_back(&MI);
}

// Since we replaced all uses of Succ with NMBB, that should also be treated
// as the fallthrough successor
if (Succ == PrevFallthrough)
PrevFallthrough = NMBB;

if (!ChangedIndirectJump)
if (!ChangedIndirectJump) {
SlotIndexUpdateDelegate SlotUpdater(*MF, Indexes);
updateTerminator(PrevFallthrough);

if (Indexes) {
SmallVector<MachineInstr*, 4> NewTerminators;
for (MachineInstr &MI :
llvm::make_range(getFirstInstrTerminator(), instr_end()))
NewTerminators.push_back(&MI);

for (MachineInstr *Terminator : Terminators) {
if (!is_contained(NewTerminators, Terminator))
Indexes->removeMachineInstrFromMaps(*Terminator);
}
}

// Insert unconditional "jump Succ" instruction in NMBB if necessary.
NMBB->addSuccessor(Succ);
if (!NMBB->isLayoutSuccessor(Succ)) {
SlotIndexUpdateDelegate SlotUpdater(*MF, Indexes);
SmallVector<MachineOperand, 4> Cond;
const TargetInstrInfo *TII = getParent()->getSubtarget().getInstrInfo();
TII->insertBranch(*NMBB, Succ, nullptr, Cond, DL);

if (Indexes) {
for (MachineInstr &MI : NMBB->instrs()) {
// Some instructions may have been moved to NMBB by updateTerminator(),
// so we first remove any instruction that already has an index.
if (Indexes->hasIndex(MI))
Indexes->removeMachineInstrFromMaps(MI);
Indexes->insertMachineInstrInMaps(MI);
}
}
}

// Fix PHI nodes in Succ so they refer to NMBB instead of this.
Expand Down