[DAG] Avoid using deleted node in rebuildSetCC

[niravd]

Summary

The combine in rebuildSetCC may be combined to another
node leaving our references stale. Keep a handle on
it to avoid stale references.

Fixes PR36602.

[uabelho]

This patch at least solves the problem with r325892 that I reported here:
https://bugs.llvm.org/show_bug.cgi?id=36602#c2

Thanks!

[JesperAntonsson]

This works for me too and looks good (but again, I don't know the framework very well). Thanks!

[efriedma]

llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp

11523

This needs a much better comment explaining what we're doing, and why; normally the DAGCombine visitors are not supposed to call each other (because it causes weird issues like this).

---

And actually, I'm not sure why we're calling visitXOR here in the first place; if we're missing some important optimization on xors, we should probably fix the setcc optimizations to do the same thing rather than try to delay the xor->setcc transform. But I won't ask you to change that here; I don't want to delay the bugfix.

[niravd]

Add some explanatory text. Minor cleanup reducing number of handle construction/destructions.

[efriedma]

LGTM

llvm/test/CodeGen/X86/pr36602.ll

21

This testcase seems fragile, but I guess it's hard to come up with anything better for DAGCombine.

llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp

if (Op0.getOpcode() == ISD::AND && Op1.getOpcode() == ISD::Constant) {
         }
       }
     }
   }
 
   // Transform br(xor(x, y)) -> br(x != y)
   // Transform br(xor(xor(x,y), 1)) -> br (x == y)
   if (N.getOpcode() == ISD::XOR) {
-    SDNode *TheXor = N.getNode();
+    // Because we may call this on a speculatively constructed
+    // SimplifiedSetCC Node, we need to simplify this node first.
+    // Ideally this should be folded into SimplifySetCC and not
+    // here. For now, grab a handle to N so we don't lose it from
+    // replacements interal to the visit.
+    HandleSDNode XORHandle(N);
+    while (N.getOpcode() == ISD::XOR) {
+      SDValue Tmp = visitXOR(N.getNode());
+      // No simplification done.
+      if (!Tmp.getNode())
+        break;
+      // Returning N is form in-visit replacement that may invalidated
+      // N. Grab value from Handle.
+      if (Tmp.getNode() == N.getNode())
+        N = XORHandle.getValue();
+      else // Node simplified. Try simplifying again.
+        N = Tmp;
+    }
 
-    // Avoid missing important xor optimizations.
-    while (SDValue Tmp = visitXOR(TheXor)) {
-      // We don't have a XOR anymore, bail.
-      if (Tmp.getOpcode() != ISD::XOR)
-        return Tmp;
+    if (N.getOpcode() != ISD::XOR)
+      return N;
 
-      TheXor = Tmp.getNode();
-    }
+    SDNode *TheXor = N.getNode();
 
     SDValue Op0 = TheXor->getOperand(0);
     SDValue Op1 = TheXor->getOperand(1);
 
     if (Op0.getOpcode() != ISD::SETCC && Op1.getOpcode() != ISD::SETCC) {
       bool Equal = false;
       if (isOneConstant(Op0) && Op0.hasOneUse() &&
           Op0.getOpcode() == ISD::XOR) {

llvm/test/CodeGen/X86/pr36602.ll

+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
+; RUN: llc < %s -mtriple=x86_64-unknown-linux-gnu | FileCheck %s
+
+
+define i32 @fn2() {
+; CHECK-LABEL: fn2:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    xorl %eax, %eax
+; CHECK-NEXT:    testb %al, %al
+; CHECK-NEXT:    jne .LBB0_2
+; CHECK-NEXT:  # %bb.1: # %bb1
+; CHECK-NEXT:    xorl %eax, %eax
+; CHECK-NEXT:    retq
+; CHECK-NEXT:  .LBB0_2: # %bb2
+; CHECK-NEXT:    movl $1, %eax
+; CHECK-NEXT:    retq
+  %_tmp10 = icmp eq i8 0, 0
+  %_tmp13 = icmp slt i8 undef, 1
+  %_tmp151 = or i1 %_tmp10, %_tmp13
+  %_tmp15 = zext i1 %_tmp151 to i8
+  br i1 %_tmp151, label %bb1, label %bb2
+
+bb1:                                              ; preds = %0, %0
+  ret i32 0
+
+bb2:                                              ; preds = %0, %0
+  ret i32 1
+
+
+}