[WIP][SCCP] Don't track specialized functions unless they are recursive.

[labrinea]

Summary

An attempt to fix a crash when compiling MultiSource from the llvm test suite with FuncSpecializationMaxIters > 1

llvm/include/llvm/Analysis/ValueLattice.h:
bool llvm::ValueLatticeElement::markConstant(llvm::Constant*, bool):
Assertion `getConstant() == V && "Marking constant with different value"'

llvm::ValueLatticeElement::markConstant(llvm::Constant*, bool)
llvm::SCCPInstVisitor::markConstant(llvm::Value*, llvm::Constant*)
llvm::SCCPInstVisitor::visitCastInst(llvm::CastInst&)
llvm::SCCPInstVisitor::solve()
llvm::FunctionSpecializer::specialize(llvm::SmallVectorImpl<llvm::Function*>&)

[labrinea]

Side note: I've fixed this in https://reviews.llvm.org/D126456 but there are more instances of the same issue (use after free) arising from marking a newly cloned function executable and then invoking the solver, which is something we only need for specializing recursive functions.

[labrinea]

Abandoning in favor of D126455.

llvm/lib/Transforms/IPO/FunctionSpecialization.cpp

bool FunctionSpecializer::isCandidateFunction(Function *F) {
   if (F->hasFnAttribute(Attribute::AlwaysInline))
     return false;
 
   LLVM_DEBUG(dbgs() << "FnSpecialization: Try function: " << F->getName()
                     << "\n");
   return true;
 }
 
+static bool isRecursive(Function *F) {
+  return any_of(F->users(), [F](User *U) {
+           if (auto *CS = dyn_cast<CallBase>(U))
+             return CS->getFunction() == F;
+           return false;
+         });
+}
+
 void FunctionSpecializer::specializeFunction(Function *F, SpecializationInfo &S,
                                              FuncList &WorkList) {
   ValueToValueMapTy Mappings;
   Function *Clone = cloneCandidateFunction(F, Mappings);
 
   // Rewrite calls to the function so that they call the clone instead.
   rewriteCallSites(Clone, S.Args, Mappings);
 
   // Initialize the lattice state of the arguments of the function clone,
   // marking the argument on which we specialized the function constant
   // with the given value.
   Solver.markArgInFuncSpecialization(Clone, S.Args);
 
+  if (isRecursive(F) && FuncSpecializationMaxIters > 1) {
+    // Initialize the state of the newly created functions, marking them
+    // argument-tracked and executable.
+    if (F->hasExactDefinition() && !F->hasFnAttribute(Attribute::Naked))
+      Solver.addTrackedFunction(Clone);
+    Solver.addArgumentTrackedFunction(Clone);
+    Solver.markBlockExecutable(&Clone->front());
+  }
+
   // Mark all the specialized functions
   WorkList.push_back(Clone);
   NbFunctionsSpecialized++;
 
   // If the function has been completely specialized, the original function
   // is no longer needed. Mark it unreachable.
   if (F->getNumUses() == 0 || all_of(F->users(), [F](User *U) {
         if (auto *CS = dyn_cast<CallBase>(U))
for (auto *CS : CallSitesToRewrite) {
     }
   }
 }
 
 void FunctionSpecializer::updateSpecializedFuncs(FuncList &Candidates,
                                                  FuncList &WorkList) {
   for (auto *F : WorkList) {
     SpecializedFuncs.insert(F);
-
-    // Initialize the state of the newly created functions, marking them
-    // argument-tracked and executable.
-    if (F->hasExactDefinition() && !F->hasFnAttribute(Attribute::Naked))
-      Solver.addTrackedFunction(F);
-
-    Solver.addArgumentTrackedFunction(F);
     Candidates.push_back(F);
-    Solver.markBlockExecutable(&F->front());
 
     // Replace the function arguments for the specialized functions.
     for (Argument &Arg : F->args())
       if (!Arg.use_empty() && tryToReplaceWithConstant(&Arg))
         LLVM_DEBUG(dbgs() << "FnSpecialization: Replaced constant argument: "
                           << Arg.getNameOrAsOperand() << "\n");
   }
 }