AutoUpgrade: Fix crash when tbaa has an empty argument

[dexonsmith]

Should the verifier fail on this? If so, might be nice to make that happen before dropping it; if not, LGTM.

[arsenm]

Add verifier error

[dexonsmith]

LGTM, thanks!

[arsenm]

d065b1d65b11db9ecd92db5606327ee3bb3b9992

llvm/lib/IR/AutoUpgrade.cpp

for (User *U : make_early_inc_range(F->users()))
         UpgradeIntrinsicCall(CB, NewFn);
 
     // Remove old function, no longer used, from the module.
     F->eraseFromParent();
   }
 }
 
 MDNode *llvm::UpgradeTBAANode(MDNode &MD) {
+  const unsigned NumOperands = MD.getNumOperands();
+  if (NumOperands == 0)
+    return &MD; // Invalid, punt to a verifier error.
+
   // Check if the tag uses struct-path aware TBAA format.
-  if (isa<MDNode>(MD.getOperand(0)) && MD.getNumOperands() >= 3)
+  if (isa<MDNode>(MD.getOperand(0)) && NumOperands >= 3)
     return &MD;
 
   auto &Context = MD.getContext();
-  if (MD.getNumOperands() == 3) {
+  if (NumOperands == 3) {
     Metadata *Elts[] = {MD.getOperand(0), MD.getOperand(1)};
     MDNode *ScalarType = MDNode::get(Context, Elts);
     // Create a MDNode <ScalarType, ScalarType, offset 0, const>
     Metadata *Elts2[] = {ScalarType, ScalarType,
                          ConstantAsMetadata::get(
                              Constant::getNullValue(Type::getInt64Ty(Context))),
                          MD.getOperand(2)};
     return MDNode::get(Context, Elts2);

llvm/lib/IR/Verifier.cpp

if (!Type || Type->getNumOperands() < 3)
     return false;
 
   // In the new format type nodes shall have a reference to the parent type as
   // its first operand.
   return isa_and_nonnull<MDNode>(Type->getOperand(0));
 }
 
 bool TBAAVerifier::visitTBAAMetadata(Instruction &I, const MDNode *MD) {
+  CheckTBAA(MD->getNumOperands() > 0, "TBAA metadata cannot have 0 operands",
+            &I, MD);
+
   CheckTBAA(isa<LoadInst>(I) || isa<StoreInst>(I) || isa<CallInst>(I) ||
                 isa<VAArgInst>(I) || isa<AtomicRMWInst>(I) ||
                 isa<AtomicCmpXchgInst>(I),
             "This instruction shall not have a TBAA access tag!", &I);
 
   bool IsStructPathTBAA =
       isa<MDNode>(MD->getOperand(0)) && MD->getNumOperands() >= 3;
 

llvm/test/Verifier/tbaa.ll

 ; CHECK-NEXT:  store i32 7, ptr %ptr, align 4, !tbaa !{{[0-9]+}}
 
 ; CHECK: Struct tag nodes have a string as their first operand
 ; CHECK-NEXT:  !{{[0-9]+}} = !{!{{[0-9]+}}, !{{[0-9]+}}, i64 0}
 
 ; CHECK: Access type node must be a valid scalar type
 ; CHECK-NEXT:  store i32 9, ptr %ptr, align 4, !tbaa !{{[0-9]+}}
 
+; CHECK: TBAA metadata cannot have 0 operands
+; CHECK-NEXT:  store i32 10, ptr %ptr, align 4, !tbaa !{{[0-9]+}}
+
   store i32 0, ptr %ptr, !tbaa !{!3, !2, i64 40, i64 0, i64 1, i64 2}
   store i32 1, ptr %ptr, !tbaa !{!3, !2, i64 40, !"immutable"}
   store i32 2, ptr %ptr, !tbaa !{!3, !2, i64 40, i64 4}
   store i32 3, ptr %ptr, !tbaa !{!3, !2, !"40", i64 0}
   store i32 4, ptr %ptr, !tbaa !{!3, null, !"40", i64 0}
   store i32 5, ptr %ptr, !tbaa !{!3, !3, !"40", i64 0}
   store i32 6, ptr %ptr, !tbaa !{!3, !2, i32 40, i64 0}
   store i32 7, ptr %ptr, !tbaa !{!3, !12, i32 40, i64 0}, !metadata !42
   store i32 8, ptr %ptr, !tbaa !{!13, !1, i64 0}
   store i32 9, ptr %ptr, !tbaa !{!14, !14, i64 0}
+  store i32 10, ptr %ptr, !tbaa !15
   ret void
 }
 !42 = !{!"Do no strip this!"}
 
 define void @f_1(ptr %ptr) {
 ; This part checks for more semantic verifier rules.
 
 ; CHECK: Cycle detected in struct path

 !7 = !{!"bad-scalar-1", null}
 !8 = !{!"bad-struct-type-0", !1, i64 40, !1}
 !9 = !{!"bad-struct-type-1", !1, i64 40, i64 56, !1}
 !10 = !{!"bad-struct-type-2", !1, i64 40, !1, i32 56}
 !11 = !{!"bad-struct-type-2", !1, i64 80, !1, i64 56}
 !12 = !{!"bad-scalar-2", !3, i64 0}
 !13 = !{!1, !1, i64 0}
 !14 = !{!"bad-scalar-2", !13}
+!15 = !{}