Indvars: Don't recursively delete instruction during BB iteration.
This can invalidate the iterators leading to use after frees and crashes.
Fixes PR12536.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@166291 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/lib/Transforms/Scalar/IndVarSimplify.cpp b/lib/Transforms/Scalar/IndVarSimplify.cpp
index 78630b2..82eb746 100644
--- a/lib/Transforms/Scalar/IndVarSimplify.cpp
+++ b/lib/Transforms/Scalar/IndVarSimplify.cpp
@@ -551,15 +551,17 @@
PN->setIncomingValue(i, ExitVal);
- // If this instruction is dead now, delete it.
- RecursivelyDeleteTriviallyDeadInstructions(Inst, TLI);
+ // If this instruction is dead now, delete it. Don't do it now to avoid
+ // invalidating iterators.
+ if (isInstructionTriviallyDead(Inst, TLI))
+ DeadInsts.push_back(Inst);
if (NumPreds == 1) {
// Completely replace a single-pred PHI. This is safe, because the
// NewVal won't be variant in the loop, so we don't need an LCSSA phi
// node anymore.
PN->replaceAllUsesWith(ExitVal);
- RecursivelyDeleteTriviallyDeadInstructions(PN, TLI);
+ PN->eraseFromParent();
}
}
if (NumPreds != 1) {
diff --git a/test/Transforms/IndVarSimplify/crash.ll b/test/Transforms/IndVarSimplify/crash.ll
index 62af42b..1b702a3 100644
--- a/test/Transforms/IndVarSimplify/crash.ll
+++ b/test/Transforms/IndVarSimplify/crash.ll
@@ -113,3 +113,21 @@
ret void
}
+; PR12536
+define void @fn1() noreturn nounwind {
+entry:
+ br label %for.cond
+
+for.cond: ; preds = %for.end, %entry
+ %b.0 = phi i32 [ undef, %entry ], [ %conv, %for.end ]
+ br label %for.cond1
+
+for.cond1: ; preds = %for.cond1, %for.cond
+ %c.0 = phi i32 [ %b.0, %for.cond1 ], [ 0, %for.cond ]
+ br i1 undef, label %for.cond1, label %for.end
+
+for.end: ; preds = %for.cond1
+ %cmp2 = icmp slt i32 %c.0, 1
+ %conv = zext i1 %cmp2 to i32
+ br label %for.cond
+}