LICM's AliasSetTracker is holding deleted values

[llvmbot]

Bugzilla Link	3787
Resolution	FIXED
Resolved on	Mar 25, 2009 18:58
Version	trunk
OS	Linux
Attachments	preproccesed file that crash llvm
Reporter	LLVM Bugzilla Contributor

Extended Description

Hi,

with llvm-gcc from svn, I got on x86

llvm-gcc -std=c99 -fomit-frame-pointer -g -Wdeclaration-after-statement -Wall -Wno-switch -Wdisabled-optimization -Wpointer-arith -Wredundant-decls -Wno-pointer-sign -Wcast-qual -Wwrite-strings -Wundef -O3 -fno-math-errno -c -o utils.o utils.c
/data/build/userspace/ffmpeg/libavformat/utils.c: In function 'parse_date':
/data/build/userspace/ffmpeg/libavformat/utils.c:3015: warning: cast discards qualifiers from pointer target type
/data/build/userspace/ffmpeg/libavformat/utils.c: At top level:
/data/build/userspace/ffmpeg/libavformat/utils.c:3311: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See URL:http://developer.apple.com/bugreporter for instructions.

[llvmbot]

reduced test case

[llvmbot]

Attached reduced test case.

LICM keeps track of alias info from nested loops. There is a comment in the code that says,

255
256 // What if InnerLoop was modified by other passes ?
257 CurAST->add(*InnerAST);
258 }

Well, in this example the modified inner loop caused InnerAST to hold alias info for deleted values. Which is not a good idea.

[llvmbot]

valgrind shows a use of freed memory:

Invalid read of size 2
at 0x6E34AC: llvm::Value::getValueID() const (Value.h:217)
by 0x6E3501: bool llvm::isa_impl<llvm::Instruction, llvm::Value>(llvm::Value const&) (Value.h:288)
by 0x6E3A7E: llvm::isa_impl_wrap<llvm::Instruction, llvm::Value const, llvm::Value const>::doit(llvm::Value const&) (Casting.h:71)
by 0x6E3A95: bool llvm::isa_impl_clllvm::Value::isallvm::Instruction(llvm::Value const&) (Casting.h:83)
by 0x700C0E: bool llvm::isa_impl_cl<llvm::Value const>::isallvm::Instruction(llvm::Value const&) (Casting.h:92)
by 0x700C25: bool llvm::isa_impl_cl<llvm::Value const*>::isallvm::Instruction(llvm::Value const*) (Casting.h:101)
by 0x700C3F: bool llvm::isa<llvm::Instruction, llvm::Value const*>(llvm::Value const* const&) (Casting.h:116)
by 0x71570D: llvm::CallInst::classof(llvm::Value const*) (Instructions.h:1174)
by 0x715751: bool llvm::isa_impl<llvm::CallInst, llvm::Value>(llvm::Value const&) (Casting.h:54)
by 0x715768: llvm::isa_impl_wrap<llvm::CallInst, llvm::Value const, llvm::Value const>::doit(llvm::Value const&) (Casting.h:71)
by 0x71577F: bool llvm::isa_impl_clllvm::Value::isallvm::CallInst(llvm::Value const&) (Casting.h:83)
by 0x715796: bool llvm::isa_impl_cl<llvm::Value const>::isallvm::CallInst(llvm::Value const&) (Casting.h:92)
Address 0x5d94250 is 128 bytes inside a block of size 208 free'd
at 0x4C2614D: operator delete(void*) (vg_replace_malloc.c:312)
by 0x9FED7F: llvm::User::operator delete(void*) (Value.cpp:425)
by 0x9BEF1D: llvm::CallInst::~CallInst() (Instructions.cpp:277)
by 0x7139D9: llvm::ilist_node_traitsllvm::Instruction::deleteNode(llvm::Instruction*) (ilist.h:110)
by 0x716A84: llvm::iplist<llvm::Instruction, llvm::ilist_traitsllvm::Instruction >::erase(llvm::ilist_iteratorllvm::Instruction) (ilist.h:463)
by 0x9BE39F: llvm::Instruction::eraseFromParent() (Instruction.cpp:68)
by 0x7FCCEF: (anonymous namespace)::LoopIndexSplit::removeBlocks(llvm::BasicBlock*, llvm::LoopBasellvm::BasicBlock, llvm::BasicBlock) (LoopIndexSplit.cpp:681)
by 0x7FED77: (anonymous namespace)::LoopIndexSplit::splitLoop() (LoopIndexSplit.cpp:1075)
by 0x8000FD: (anonymous namespace)::LoopIndexSplit::runOnLoop(llvm::LoopBasellvm::BasicBlock*, llvm::LPPassManager&) (LoopIndexSplit.cpp:264)
by 0x8FDAE4: llvm::LPPassManager::runOnFunction(llvm::Function&) (LoopPass.cpp:224)
by 0x9DF00B: llvm::FPPassManager::runOnFunction(llvm::Function&) (PassManager.cpp:1324)
by 0x9DF177: llvm::FPPassManager::runOnModule(llvm::Module&) (PassManager.cpp:1347)

[llvmbot]

Fixed. Rev. 67719.