[IR] CallBrInst: scan+update arg list when indirect dest list changes

[nickdesaulniers]

Summary

There's an unspoken invariant of callbr that the list of BlockAddress
Constants in the "function args" list match the BasicBlocks in the
"other labels" list. (This invariant is being added to the LangRef in
https://reviews.llvm.org/D67196).

When modifying the any of the indirect destinations of a callbr
instruction (possible jump targets), we need to update the function
arguments if the argument is a BlockAddress whose BasicBlock refers to
the indirect destination BasicBlock being replaced. Otherwise, many
transforms that modify successors will end up violating that invariant.
A recent change to the arm64 Linux kernel exposed this bug, which
prevents the kernel from booting.

I considered maintaining a mapping from indirect destination BasicBlock
to argument operand BlockAddress, but this ends up being a one to
potentially many (though usually one) mapping. Also, the list of
arguments to a function (or more typically inline assembly) ends up
being less than 10. The implementation is significantly simpler to just
rescan the full list of arguments. Because of the one to potentially
many relationship, the full arg list must be scanned (we can't stop at
the first instance).

Thanks to the following folks that reported the issue and helped debug
it:

• Nathan Chancellor
• Will Deacon
• Andrew Murray
• Craig Topper

Link: https://bugs.llvm.org/show_bug.cgi?id=43222
Link: https://github.com/ClangBuiltLinux/linux/issues/649
Link: https://lists.infradead.org/pipermail/linux-arm-kernel/2019-September/678330.html

[craig.topper]

llvm/include/llvm/IR/Instructions.h

4085

Why is this change needed?

llvm/lib/IR/Instructions.cpp

827

When would this fail?

[nickdesaulniers]

llvm/include/llvm/IR/Instructions.h

4085

This change requires careful analysis of CallBrInst::init. CallBrInst::init calls CallBrInst::setIndirectDest while initializing the instruction. Calling CallBrInst::getIndirectDest via CallBrInst::updateArgBlockAddresses via CallBrInst::setIndirectDest leads to a compiler crash (IIUC, it's not safe to pass cast a nullptr). Essentially, it's not safe to getIndirectDest before setIndirectDest without this change.

llvm/lib/IR/Instructions.cpp

827

There's two scenarios that could call CallBrInst::updateArgBlockAddresses via CallBrInst::setIndirectDest.

1. We're initializing the instruction. CallBrInst::init calls CallBrInst::setIndirectDest calls CallBrInst::updateArgBlockAddresses. There is no OldBB, because we're initializing the instruction, so there's nothing to do.
2. We're updating the successor. CallBrInst::setSuccessor now calls CallBrInst::setIndirectDest calls CallBrInst::updateArgBlockAddresses. Now there is an OldBB which implies there should be a BlockAddress Constant argument operand we need to update as well.

[nickdesaulniers]

• rebase, add/clean up the commit message

[nickdesaulniers]

I have verified this allows me to boot:

• arm64 linux-next (this patch fixes this regression, the below I verified are not regressed)
• x86_64 linux-next
• arm linux-next
• arm linux-next + CONFIG_JUMP_LABEL
• arm64 linux
• x86_64 linux
• arm linux
• arm linux + CONFIG_JUMP_LABEL

[nickdesaulniers]

• updated commit message

[craig.topper]

LGTM

[nickdesaulniers]

• git-clang-format HEAD~

llvm/include/llvm/IR/Instructions.h

inline CallBrInst(FunctionType *Ty, Value *Func, BasicBlock *DefaultDest,
                     ArrayRef<Value *> Args,
                     ArrayRef<OperandBundleDef> Bundles, int NumOperands,
                     const Twine &NameStr, BasicBlock *InsertAtEnd);
 
   void init(FunctionType *FTy, Value *Func, BasicBlock *DefaultDest,
             ArrayRef<BasicBlock *> IndirectDests, ArrayRef<Value *> Args,
             ArrayRef<OperandBundleDef> Bundles, const Twine &NameStr);
 
+  /// Should the Indirect Destinations change, scan + update the Arg list.
+  void updateArgBlockAddresses(unsigned i, BasicBlock *B);
+
   /// Compute the number of operands to allocate.
   static int ComputeNumOperands(int NumArgs, int NumIndirectDests,
                                 int NumBundleInputs = 0) {
     // We need one operand for the called function, plus our extra operands and
     // the input operand counts provided.
     return 2 + NumIndirectDests + NumArgs + NumBundleInputs;
   }
 
return getOperandUse(i + getNumArgOperands() + getNumTotalBundleOperands() +
                          1);
   }
 
   // Return the destination basic blocks...
   BasicBlock *getDefaultDest() const {
     return cast<BasicBlock>(*(&Op<-1>() - getNumIndirectDests() - 1));
   }
   BasicBlock *getIndirectDest(unsigned i) const {
-    return cast<BasicBlock>(*(&Op<-1>() - getNumIndirectDests() + i));
+    return cast_or_null<BasicBlock>(*(&Op<-1>() - getNumIndirectDests() + i));
   }
   SmallVector<BasicBlock *, 16> getIndirectDests() const {
     SmallVector<BasicBlock *, 16> IndirectDests;
     for (unsigned i = 0, e = getNumIndirectDests(); i < e; ++i)
       IndirectDests.push_back(getIndirectDest(i));
     return IndirectDests;
   }
   void setDefaultDest(BasicBlock *B) {
     *(&Op<-1>() - getNumIndirectDests() - 1) = reinterpret_cast<Value *>(B);
   }
   void setIndirectDest(unsigned i, BasicBlock *B) {
+    updateArgBlockAddresses(i, B);
     *(&Op<-1>() - getNumIndirectDests() + i) = reinterpret_cast<Value *>(B);
   }
 
   BasicBlock *getSuccessor(unsigned i) const {
     assert(i < getNumSuccessors() + 1 &&
            "Successor # out of range for callbr!");
     return i == 0 ? getDefaultDest() : getIndirectDest(i - 1);
   }
 
-  void setSuccessor(unsigned idx, BasicBlock *NewSucc) {
-    assert(idx < getNumIndirectDests() + 1 &&
+  void setSuccessor(unsigned i, BasicBlock *NewSucc) {
+    assert(i < getNumIndirectDests() + 1 &&
            "Successor # out of range for callbr!");
-    *(&Op<-1>() - getNumIndirectDests() -1 + idx) =
-        reinterpret_cast<Value *>(NewSucc);
+    return i == 0 ? setDefaultDest(NewSucc) : setIndirectDest(i - 1, NewSucc);
   }
 
   unsigned getNumSuccessors() const { return getNumIndirectDests() + 1; }
 
   // Methods for support type inquiry through isa, cast, and dyn_cast:
   static bool classof(const Instruction *I) {
     return (I->getOpcode() == Instruction::CallBr);
   }

llvm/lib/IR/Instructions.cpp

#endif
 
   auto It = populateBundleOperandInfos(Bundles, Args.size());
   (void)It;
   assert(It + 2 + IndirectDests.size() == op_end() && "Should add up!");
 
   setName(NameStr);
 }
 
+void CallBrInst::updateArgBlockAddresses(unsigned i, BasicBlock *B) {
+  assert(getNumIndirectDests() > i && "IndirectDest # out of range for callbr");
+  if (BasicBlock *OldBB = getIndirectDest(i)) {
+    BlockAddress *Old = BlockAddress::get(OldBB);
+    BlockAddress *New = BlockAddress::get(B);
+    for (unsigned ArgNo = 0, e = getNumArgOperands(); ArgNo != e; ++ArgNo)
+      if (dyn_cast<BlockAddress>(getArgOperand(ArgNo)) == Old)
+        setArgOperand(ArgNo, New);
+  }
+}
+
 CallBrInst::CallBrInst(const CallBrInst &CBI)
     : CallBase(CBI.Attrs, CBI.FTy, CBI.getType(), Instruction::CallBr,
                OperandTraits<CallBase>::op_end(this) - CBI.getNumOperands(),
                CBI.getNumOperands()) {
   setCallingConv(CBI.getCallingConv());
   std::copy(CBI.op_begin(), CBI.op_end(), op_begin());
   std::copy(CBI.bundle_op_info_begin(), CBI.bundle_op_info_end(),
             bundle_op_info_begin());

llvm/unittests/IR/InstructionsTest.cpp

TEST(InstructionsTest, FNegInstruction) {
   EXPECT_FALSE(FNeg->hasAllowReciprocal());
   EXPECT_FALSE(FNeg->hasAllowContract());
   EXPECT_FALSE(FNeg->hasAllowReassoc());
   EXPECT_FALSE(FNeg->hasApproxFunc());
   FAdd->deleteValue();
   FNeg->deleteValue();
 }
 
+TEST(InstructionsTest, CallBrInstruction) {
+  LLVMContext Context;
+  std::unique_ptr<Module> M = parseIR(Context, R"(
+define void @foo() {
+entry:
+  callbr void asm sideeffect "// XXX: ${0:l}", "X"(i8* blockaddress(@foo, %branch_test.exit))
+          to label %land.rhs.i [label %branch_test.exit]
+
+land.rhs.i:
+  br label %branch_test.exit
+
+branch_test.exit:
+  %0 = phi i1 [ true, %entry ], [ false, %land.rhs.i ]
+  br i1 %0, label %if.end, label %if.then
+
+if.then:
+  ret void
+
+if.end:
+  ret void
+}
+)");
+  Function *Foo = M->getFunction("foo");
+  auto BBs = Foo->getBasicBlockList().begin();
+  CallBrInst &CBI = cast<CallBrInst>(BBs->front());
+  ++BBs;
+  ++BBs;
+  BasicBlock &BranchTestExit = *BBs;
+  ++BBs;
+  BasicBlock &IfThen = *BBs;
+
+  // Test that setting the first indirect destination of callbr updates the dest
+  EXPECT_EQ(&BranchTestExit, CBI.getIndirectDest(0));
+  CBI.setIndirectDest(0, &IfThen);
+  EXPECT_EQ(&IfThen, CBI.getIndirectDest(0));
+
+  // Further, test that changing the indirect destination updates the arg
+  // operand to use the block address of the new indirect destination basic
+  // block. This is a critical invariant of CallBrInst.
+  BlockAddress *IndirectBA = BlockAddress::get(CBI.getIndirectDest(0));
+  BlockAddress *ArgBA = cast<BlockAddress>(CBI.getArgOperand(0));
+  EXPECT_EQ(IndirectBA, ArgBA) << "After setting the indirect destination, "
+    "callbr had an indirect destination of '" <<
+    CBI.getIndirectDest(0)->getName() << "', but a argument of '" <<
+    ArgBA->getBasicBlock()->getName() << "'. These should always match:\n" <<
+    CBI;
+  EXPECT_EQ(IndirectBA->getBasicBlock(), &IfThen);
+  EXPECT_EQ(ArgBA->getBasicBlock(), &IfThen);
+}
+
 } // end anonymous namespace
 } // end namespace llvm