From 923c216da572e93dc732478a2cad59929ec7c544 Mon Sep 17 00:00:00 2001
From: Taewook Oh <twoh@fb.com>
Date: Wed, 25 Apr 2018 17:19:21 +0000
Subject: [PATCH] [ICP] Do not attempt type matching for variable length
 arguments.

Summary:
When performing indirect call promotion, current implementation inspects "all" parameters of the callsite and attemps to match with the formal argument type of the callee function. However, it is not possible to find the type for variable length arguments, and the compiler crashes when it attemps to match the type for variable lenght argument.

It seems that the bug is introduced with D40658. Prior to that, the type matching is performed only for the parameters whose ID is less than callee->getFunctionNumParams(). The attached test case will crash without the patch.

Reviewers: mssimpso, davidxl, davide

Reviewed By: mssimpso

Subscribers: llvm-commits

Differential Revision: https://reviews.llvm.org/D46026

llvm-svn: 330844
---
 llvm/lib/Transforms/Utils/CallPromotionUtils.cpp   | 12 ++++++----
 .../PGOProfile/indirect_call_promotion_vla.ll      | 28 ++++++++++++++++++++++
 2 files changed, 35 insertions(+), 5 deletions(-)
 create mode 100644 llvm/test/Transforms/PGOProfile/indirect_call_promotion_vla.ll

diff --git a/llvm/lib/Transforms/Utils/CallPromotionUtils.cpp b/llvm/lib/Transforms/Utils/CallPromotionUtils.cpp
index 5dc6068..4d9c22e 100644
--- a/llvm/lib/Transforms/Utils/CallPromotionUtils.cpp
+++ b/llvm/lib/Transforms/Utils/CallPromotionUtils.cpp
@@ -389,12 +389,14 @@ Instruction *llvm::promoteCall(CallSite CS, Function *Callee,
   // Inspect the arguments of the call site. If an argument's type doesn't
   // match the corresponding formal argument's type in the callee, bitcast it
   // to the correct type.
-  for (Use &U : CS.args()) {
-    unsigned ArgNo = CS.getArgumentNo(&U);
-    Type *FormalTy = Callee->getFunctionType()->getParamType(ArgNo);
-    Type *ActualTy = U.get()->getType();
+  auto CalleeType = Callee->getFunctionType();
+  auto CalleeParamNum = CalleeType->getNumParams();
+  for (unsigned ArgNo = 0; ArgNo < CalleeParamNum; ++ArgNo) {
+    auto *Arg = CS.getArgument(ArgNo); 
+    Type *FormalTy = CalleeType->getParamType(ArgNo);
+    Type *ActualTy = Arg->getType();
     if (FormalTy != ActualTy) {
-      auto *Cast = CastInst::Create(Instruction::BitCast, U.get(), FormalTy, "",
+      auto *Cast = CastInst::Create(Instruction::BitCast, Arg, FormalTy, "",
                                     CS.getInstruction());
       CS.setArgument(ArgNo, Cast);
     }
diff --git a/llvm/test/Transforms/PGOProfile/indirect_call_promotion_vla.ll b/llvm/test/Transforms/PGOProfile/indirect_call_promotion_vla.ll
new file mode 100644
index 0000000..0065031
--- /dev/null
+++ b/llvm/test/Transforms/PGOProfile/indirect_call_promotion_vla.ll
@@ -0,0 +1,28 @@
+; RUN: opt < %s -pgo-icall-prom -S | FileCheck %s
+
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-unknown-linux-gnu"
+
+%struct.A = type { i8 }
+%struct.B = type { i8 }
+@foo = common global i32 (%struct.A*, ...)* null, align 8
+
+define i32 @func1(%struct.B* %x, ...) {
+entry:
+  ret i32 0
+}
+
+define i32 @bar(%struct.A* %x) {
+entry:
+  %tmp = load i32 (%struct.A*, ...)*, i32 (%struct.A*, ...)** @foo, align 8
+; CHECK:   [[CMP:%[0-9]+]] = icmp eq i32 (%struct.A*, ...)* %tmp, bitcast (i32 (%struct.B*, ...)* @func1 to i32 (%struct.A*, ...)*)
+; CHECK:   br i1 [[CMP]], label %if.true.direct_targ, label %if.false.orig_indirect, !prof [[BRANCH_WEIGHT:![0-9]+]]
+; CHECK: if.true.direct_targ:
+; CHECK:   [[DIRCALL_RET:%[0-9]+]] = call i32 (%struct.B*, ...) @func1
+; CHECK:   br label %if.end.icp
+  %call = call i32 (%struct.A*, ...) %tmp(%struct.A* %x, i32 0), !prof !1
+  ret i32 %call
+}
+
+; CHECK: [[BRANCH_WEIGHT]] = !{!"branch_weights", i32 1500, i32 100}
+!1 = !{!"VP", i32 0, i64 1600, i64 -2545542355363006406, i64 1500}
-- 
2.7.4