From 8d0099bdab5523ede53b7df7040891640b55d63a Mon Sep 17 00:00:00 2001
From: Karthik Bhat <kv.bhat@samsung.com>
Date: Tue, 10 Mar 2015 13:31:03 +0000
Subject: [PATCH] Fix a crash in Dependency Analysis. This crash in Dependency
 analysis is because we assume here that in case of UsefulGEP both source and
 destination have the same number of operands which may not be true. This
 incorrect assumption results in crash while populating Pairs. Fix the same.

This crash was observed during lnt regression for code such as-
  struct s{
    int A[10][10];
    int C[10][10][10];
  } S;
  void dep_constraint_crash_test(int k,int N)  {
     for( int i=0;i<N;i++)
       for( int j=0;j<N;j++)
         S.A[0][0] = S.C[0][0][k];
  }
Review: http://reviews.llvm.org/D8162

llvm-svn: 231784
---
 llvm/lib/Analysis/DependenceAnalysis.cpp           | 12 ++---
 llvm/test/Analysis/DependenceAnalysis/UsefulGEP.ll | 51 ++++++++++++++++++++++
 2 files changed, 57 insertions(+), 6 deletions(-)
 create mode 100644 llvm/test/Analysis/DependenceAnalysis/UsefulGEP.ll

diff --git a/llvm/lib/Analysis/DependenceAnalysis.cpp b/llvm/lib/Analysis/DependenceAnalysis.cpp
index b3a6f6f..3dcfcb8 100644
--- a/llvm/lib/Analysis/DependenceAnalysis.cpp
+++ b/llvm/lib/Analysis/DependenceAnalysis.cpp
@@ -3346,9 +3346,9 @@ DependenceAnalysis::depends(Instruction *Src, Instruction *Dst,
     DEBUG(dbgs() << "    SrcPtrSCEV = " << *SrcPtrSCEV << "\n");
     DEBUG(dbgs() << "    DstPtrSCEV = " << *DstPtrSCEV << "\n");
 
-    UsefulGEP =
-      isLoopInvariant(SrcPtrSCEV, LI->getLoopFor(Src->getParent())) &&
-      isLoopInvariant(DstPtrSCEV, LI->getLoopFor(Dst->getParent()));
+    UsefulGEP = isLoopInvariant(SrcPtrSCEV, LI->getLoopFor(Src->getParent())) &&
+                isLoopInvariant(DstPtrSCEV, LI->getLoopFor(Dst->getParent())) &&
+                (SrcGEP->getNumOperands() == DstGEP->getNumOperands());
   }
   unsigned Pairs = UsefulGEP ? SrcGEP->idx_end() - SrcGEP->idx_begin() : 1;
   SmallVector<Subscript, 4> Pair(Pairs);
@@ -3773,9 +3773,9 @@ const  SCEV *DependenceAnalysis::getSplitIteration(const Dependence &Dep,
       SrcGEP->getPointerOperandType() == DstGEP->getPointerOperandType()) {
     const SCEV *SrcPtrSCEV = SE->getSCEV(SrcGEP->getPointerOperand());
     const SCEV *DstPtrSCEV = SE->getSCEV(DstGEP->getPointerOperand());
-    UsefulGEP =
-      isLoopInvariant(SrcPtrSCEV, LI->getLoopFor(Src->getParent())) &&
-      isLoopInvariant(DstPtrSCEV, LI->getLoopFor(Dst->getParent()));
+    UsefulGEP = isLoopInvariant(SrcPtrSCEV, LI->getLoopFor(Src->getParent())) &&
+                isLoopInvariant(DstPtrSCEV, LI->getLoopFor(Dst->getParent())) &&
+                (SrcGEP->getNumOperands() == DstGEP->getNumOperands());
   }
   unsigned Pairs = UsefulGEP ? SrcGEP->idx_end() - SrcGEP->idx_begin() : 1;
   SmallVector<Subscript, 4> Pair(Pairs);
diff --git a/llvm/test/Analysis/DependenceAnalysis/UsefulGEP.ll b/llvm/test/Analysis/DependenceAnalysis/UsefulGEP.ll
new file mode 100644
index 0000000..83c43cf
--- /dev/null
+++ b/llvm/test/Analysis/DependenceAnalysis/UsefulGEP.ll
@@ -0,0 +1,51 @@
+; RUN: opt < %s -analyze -basicaa -da
+;; Check this doesn't crash.
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+;; struct s {
+;;   int A[10][10];
+;;   int C[10][10][10]; 
+;; } S;
+
+;; void dep_constraint_crash_test(int k,int N) {
+;;   for( int i=0;i<N;i++)
+;;     for( int j=0;j<N;j++)
+;;       S.A[0][0] = S.C[0][0][k];
+;; }
+
+
+%struct.s = type { [10 x [10 x i32]], [10 x [10 x [10 x i32]]] }
+
+@S = common global %struct.s zeroinitializer
+
+define void @dep_constraint_crash_test(i32 %k, i32 %N) {
+entry:
+  %cmp12 = icmp sgt i32 %N, 0
+  br i1 %cmp12, label %for.cond1.preheader.lr.ph, label %for.end6
+
+for.cond1.preheader.lr.ph:                        
+  %idxprom = sext i32 %k to i64
+  %arrayidx = getelementptr inbounds %struct.s, %struct.s* @S, i64 0, i32 1, i64 0, i64 0, i64 %idxprom
+  br label %for.body3.preheader
+
+for.body3.preheader:                              
+  %i.013 = phi i32 [ 0, %for.cond1.preheader.lr.ph ], [ %inc5, %for.inc4 ]
+  br label %for.body3
+
+for.body3:                                        
+  %j.011 = phi i32 [ %inc, %for.body3 ], [ 0, %for.body3.preheader ]
+  %0 = load i32, i32* %arrayidx
+  store i32 %0, i32* getelementptr inbounds (%struct.s* @S, i64 0, i32 0, i64 0, i64 0)
+  %inc = add nuw nsw i32 %j.011, 1
+  %exitcond = icmp eq i32 %inc, %N
+  br i1 %exitcond, label %for.inc4, label %for.body3
+
+for.inc4:                                         
+  %inc5 = add nuw nsw i32 %i.013, 1
+  %exitcond14 = icmp eq i32 %inc5, %N
+  br i1 %exitcond14, label %for.end6, label %for.body3.preheader
+
+for.end6:                                         
+  ret void
+}
-- 
2.7.4