RPCS3/llvm-mirror
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm-mirror.git synced 2024-11-22 18:54:02 +01:00
Code Issues Projects Releases Wiki Activity

Fix MSan false positive due to select folding.

Browse Source 
Summary:
Select folding in JumpThreading can create a conditional branch on a
code patch that did not have one in the original program. This is not a
valid transformation in sanitize_memory functions.

Note that JumpThreading does select folding in 3 different places. Two
of them seem safe - they apply to a select instruction in a BB that ends
with an unconditional branch to another BB, which (in turn) ends with a
conditional branch or a switch with the same condition.

Fixes PR45220.

Reviewers: glider, dvyukov, efriedma

Subscribers: hiraditya, llvm-commits

Tags: #llvm

Differential Revision: https://reviews.llvm.org/D76332
This commit is contained in:
Evgenii Stepanov 2020-03-17 15:33:26 -07:00
parent 1f417e7ba5
commit c82de1aba3
2 changed files with 38 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
lib/Transforms/Scalar/JumpThreading.cpp
View File

@ -2833,6 +2833,16 @@ bool JumpThreadingPass::TryToUnfoldSelect(CmpInst *CondCmp, BasicBlock *BB) {
/// select is not jump-threaded, it will be folded again in the later
/// optimizations.
bool JumpThreadingPass::TryToUnfoldSelectInCurrBB(BasicBlock *BB) {
// This transform can introduce a UB (a conditional branch that depends on a
// poison value) that was not present in the original program. See
// @TryToUnfoldSelectInCurrBB test in test/Transforms/JumpThreading/select.ll.
// Disable this transform under MemorySanitizer.
// FIXME: either delete it or replace with a valid transform. This issue is
// not limited to MemorySanitizer (but has only been observed as an MSan false
// positive in practice so far).
if (BB->getParent()->hasFnAttribute(Attribute::SanitizeMemory))
return false;
// If threading this would thread across a loop header, don't thread the edge.
// See the comments above FindLoopHeaders for justifications and caveats.
if (LoopHeaders.count(BB))

28
test/Transforms/JumpThreading/select-unfold-msan.ll Normal file
View File

@ -0,0 +1,28 @@
; PR45220
; RUN: opt -S -jump-threading < %s | FileCheck %s
declare i1 @NOP()
define dso_local i32 @f(i1 %b, i1 %u) sanitize_memory {
entry:
br i1 %b, label %if.end, label %if.else
if.else:
%call = call i1 @NOP()
br label %if.end
if.end:
; Check that both selects in this BB are still in place,
; and were not replaced with a conditional branch.
; CHECK: phi
; CHECK-NEXT: phi
; CHECK-NEXT: select
; CHECK-NEXT: select
; CHECK-NEXT: ret
%u1 = phi i1 [ true, %if.else ], [ %u, %entry ]
%v = phi i1 [ %call, %if.else ], [ false, %entry ]
%s = select i1 %u1, i32 22, i32 0
%v1 = select i1 %v, i32 %s, i32 42
ret i32 %v1
}