Skip to content

Commit

Permalink
[FlattenCFG] Fix the miscompilation where phi nodes exist in the merg…
Browse files Browse the repository at this point in the history
…e point (#81987)

When there are phi nodes in the merge point of the if-region, we cannot
do the merge.
Alive2: https://alive2.llvm.org/ce/z/DbgEan
Fixes #70900.

(cherry picked from commit f920b74)
  • Loading branch information
dtcxzyw authored and tstellar committed Feb 26, 2024
1 parent 3aea3d2 commit a5b2e43
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 16 deletions.
14 changes: 4 additions & 10 deletions llvm/lib/Transforms/Utils/FlattenCFG.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -407,6 +407,10 @@ bool FlattenCFGOpt::CompareIfRegionBlock(BasicBlock *Block1, BasicBlock *Block2,
/// form, by inverting the condition and the branch successors. The same
/// approach goes for the opposite case.
bool FlattenCFGOpt::MergeIfRegion(BasicBlock *BB, IRBuilder<> &Builder) {
// We cannot merge the if-region if the merge point has phi nodes.
if (isa<PHINode>(BB->front()))
return false;

BasicBlock *IfTrue2, *IfFalse2;
BranchInst *DomBI2 = GetIfCondition(BB, IfTrue2, IfFalse2);
if (!DomBI2)
Expand Down Expand Up @@ -493,16 +497,6 @@ bool FlattenCFGOpt::MergeIfRegion(BasicBlock *BB, IRBuilder<> &Builder) {
PBI->replaceUsesOfWith(PBI->getCondition(), NC);
Builder.SetInsertPoint(SaveInsertBB, SaveInsertPt);

// Handle PHI node to replace its predecessors to FirstEntryBlock.
for (BasicBlock *Succ : successors(PBI)) {
for (PHINode &Phi : Succ->phis()) {
for (unsigned i = 0, e = Phi.getNumIncomingValues(); i != e; ++i) {
if (Phi.getIncomingBlock(i) == SecondEntryBlock)
Phi.setIncomingBlock(i, FirstEntryBlock);
}
}
}

// Remove IfTrue1
if (IfTrue1 != FirstEntryBlock) {
IfTrue1->dropAllReferences();
Expand Down
15 changes: 9 additions & 6 deletions llvm/test/Transforms/Util/flattencfg.ll
Original file line number Diff line number Diff line change
Expand Up @@ -77,13 +77,16 @@ define void @test_not_crash3(i32 %a) #0 {
; CHECK-SAME: (i32 [[A:%.*]]) {
; CHECK-NEXT: entry:
; CHECK-NEXT: [[A_EQ_0:%.*]] = icmp eq i32 [[A]], 0
; CHECK-NEXT: br i1 [[A_EQ_0]], label [[BB0:%.*]], label [[BB1:%.*]]
; CHECK: bb0:
; CHECK-NEXT: br label [[BB1]]
; CHECK: bb1:
; CHECK-NEXT: [[A_EQ_1:%.*]] = icmp eq i32 [[A]], 1
; CHECK-NEXT: [[TMP0:%.*]] = or i1 [[A_EQ_0]], [[A_EQ_1]]
; CHECK-NEXT: br i1 [[TMP0]], label [[BB2:%.*]], label [[BB3:%.*]]
; CHECK-NEXT: br i1 [[A_EQ_1]], label [[BB2:%.*]], label [[BB3:%.*]]
; CHECK: bb2:
; CHECK-NEXT: br label [[BB3]]
; CHECK: bb3:
; CHECK-NEXT: [[CHECK_BADREF:%.*]] = phi i32 [ 17, [[ENTRY:%.*]] ], [ 11, [[BB2]] ]
; CHECK-NEXT: [[CHECK_BADREF:%.*]] = phi i32 [ 17, [[BB1]] ], [ 11, [[BB2]] ]
; CHECK-NEXT: ret void
;
entry:
Expand Down Expand Up @@ -278,9 +281,9 @@ define i1 @test_cond_multi_use(i32 %x, i32 %y, i32 %z) {
; CHECK-NEXT: entry.x:
; CHECK-NEXT: [[CMP_X:%.*]] = icmp ne i32 [[X]], 0
; CHECK-NEXT: [[CMP_Y:%.*]] = icmp eq i32 [[Y]], 0
; CHECK-NEXT: [[TMP0:%.*]] = xor i1 [[CMP_Y]], true
; CHECK-NEXT: [[TMP1:%.*]] = or i1 [[CMP_X]], [[TMP0]]
; CHECK-NEXT: br i1 [[TMP1]], label [[IF_THEN_Y:%.*]], label [[EXIT:%.*]]
; CHECK-NEXT: [[CMP_Y_NOT:%.*]] = xor i1 [[CMP_Y]], true
; CHECK-NEXT: [[TMP0:%.*]] = or i1 [[CMP_X]], [[CMP_Y_NOT]]
; CHECK-NEXT: br i1 [[TMP0]], label [[IF_THEN_Y:%.*]], label [[EXIT:%.*]]
; CHECK: if.then.y:
; CHECK-NEXT: store i32 [[Z]], ptr @g, align 4
; CHECK-NEXT: br label [[EXIT]]
Expand Down

0 comments on commit a5b2e43

Please sign in to comment.