RPCS3/llvm-mirror
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm-mirror.git synced 2024-11-23 19:23:23 +01:00
Code Issues Projects Releases Wiki Activity

Fix an issue in the verifier where we could try to read information out of a malformed statepoint intrinsic.

Browse Source 
In this situation we would always have already flagged an error on the statepoint intrinsic,
but then we carry on to parse other, related GC intrinsics, and could end up crashing during that
verification when they try to access data from the malformed statepoint.

llvm-svn: 231759
This commit is contained in:
Owen Anderson 2015-03-10 05:58:21 +00:00
parent c22a907f78
commit b10fb77aca
2 changed files with 25 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
lib/IR/Verifier.cpp
View File

@ -2969,8 +2969,12 @@ void Verifier::visitIntrinsicFunctionCall(Intrinsic::ID ID, CallInst &CI) {
// Check that BaseIndex and DerivedIndex fall within the 'gc parameters'
// section of the statepoint's argument
const int NumCallArgs =
Assert(StatepointCS.arg_size() > 0,
"gc.statepoint: insufficient arguments");
const unsigned NumCallArgs =
cast<ConstantInt>(StatepointCS.getArgument(1))->getZExtValue();
Assert(StatepointCS.arg_size() > NumCallArgs+3,
"gc.statepoint: mismatch in number of call arguments");
const int NumDeoptArgs =
cast<ConstantInt>(StatepointCS.getArgument(NumCallArgs + 3))->getZExtValue();
const int GCParamArgsStart = NumCallArgs + NumDeoptArgs + 4;

20
test/Verifier/invalid-statepoint.ll Normal file
View File

@ -0,0 +1,20 @@
; RUN: not opt -verify 2>&1 < %s | FileCheck %s
; CHECK: gc.statepoint: mismatch in number of call arguments
declare zeroext i1 @return0i1()
; Function Attrs: nounwind
declare i32 @llvm.experimental.gc.statepoint.p0f0i1f(i1 ()*, i32, i32, ...) #0
; Function Attrs: nounwind
declare i32 addrspace(1)* @llvm.experimental.gc.relocate.p1i32(i32, i32, i32) #0
define i32 addrspace(1)* @0(i32 addrspace(1)* %dparam) {
%a00 = load i32, i32 addrspace(1)* %dparam
%to0 = call i32 (i1 ()*, i32, i32, ...)* @llvm.experimental.gc.statepoint.p0f0i1f(i1 ()* @return0i1, i32 9, i32 0, i2 0, i32 addrspace(1)* %dparam)
%relocate = call i32 addrspace(1)* @llvm.experimental.gc.relocate.p1i32(i32 %to0, i32 0, i32 4)
ret i32 addrspace(1)* %relocate
}
attributes #0 = { nounwind }