From 7e2fa3142aca46d9435a5804932ef76123c0cf71 Mon Sep 17 00:00:00 2001 From: Aaron Ballman Date: Thu, 15 Mar 2012 00:05:31 +0000 Subject: [PATCH] Fixed a transform crash when setting a negative size value for memset. Fixes PR12202. git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@152756 91177308-0d34-0410-b5e6-96231b3b80d8 --- .../Scalar/ScalarReplAggregates.cpp | 8 ++++++-- test/Transforms/ScalarRepl/negative-memset.ll | 20 +++++++++++++++++++ 2 files changed, 26 insertions(+), 2 deletions(-) create mode 100644 test/Transforms/ScalarRepl/negative-memset.ll diff --git a/lib/Transforms/Scalar/ScalarReplAggregates.cpp b/lib/Transforms/Scalar/ScalarReplAggregates.cpp index d23263fa5cb..d36a18f21c6 100644 --- a/lib/Transforms/Scalar/ScalarReplAggregates.cpp +++ b/lib/Transforms/Scalar/ScalarReplAggregates.cpp @@ -574,8 +574,9 @@ void ConvertToScalarInfo::ConvertUsesToScalar(Value *Ptr, AllocaInst *NewAI, // transform it into a store of the expanded constant value. if (MemSetInst *MSI = dyn_cast(User)) { assert(MSI->getRawDest() == Ptr && "Consistency error!"); - unsigned NumBytes = cast(MSI->getLength())->getZExtValue(); - if (NumBytes != 0) { + signed SNumBytes = cast(MSI->getLength())->getSExtValue(); + if (SNumBytes > 0) { + unsigned NumBytes = static_cast(SNumBytes); unsigned Val = cast(MSI->getValue())->getZExtValue(); // Compute the value replicated the right number of times. @@ -1517,6 +1518,9 @@ void SROA::isSafeForScalarRepl(Instruction *I, uint64_t Offset, ConstantInt *Length = dyn_cast(MI->getLength()); if (Length == 0) return MarkUnsafe(Info, User); + if (Length->isNegative()) + return MarkUnsafe(Info, User); + isSafeMemAccess(Offset, Length->getZExtValue(), 0, UI.getOperandNo() == 0, Info, MI, true /*AllowWholeAccess*/); diff --git a/test/Transforms/ScalarRepl/negative-memset.ll b/test/Transforms/ScalarRepl/negative-memset.ll new file mode 100644 index 00000000000..5c7f307b7af --- /dev/null +++ b/test/Transforms/ScalarRepl/negative-memset.ll @@ -0,0 +1,20 @@ +; PR12202 +; RUN: opt < %s -scalarrepl -S +; Ensure that we do not hang or crash when feeding a negative value to memset + +target datalayout = "e-p:32:32:32-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-f80:128:128-v64:64:64-v128:128:128-a0:0:64-f80:32:32-n8:16:32-S32" +target triple = "i686-pc-win32" + +define i32 @test() nounwind { +entry: + %retval = alloca i32, align 4 + %buff = alloca [1 x i8], align 1 + store i32 0, i32* %retval + %0 = bitcast [1 x i8]* %buff to i8* + call void @llvm.memset.p0i8.i32(i8* %0, i8 0, i32 1, i32 1, i1 false) + %arraydecay = getelementptr inbounds [1 x i8]* %buff, i32 0, i32 0 + call void @llvm.memset.p0i8.i32(i8* %arraydecay, i8 -1, i32 -8, i32 1, i1 false) ; Negative 8! + ret i32 0 +} + +declare void @llvm.memset.p0i8.i32(i8* nocapture, i8, i32, i32, i1) nounwind