[AbstractCallSite] Check that callback callee index is within call arguments

[sdmitriev]

Summary

AbstractCallSite::getCallbackUses() does not check that callback callee index from
the callback metadata does not exceed the total number of call arguments. This patch
add such validation check.

[jdoerfert]

It's unclear in how much trouble we are if the callback metadata is not matching the semantics but this seems reasonable. LGTM.

llvm/lib/IR/AbstractCallSite.cpp

void AbstractCallSite::getCallbackUses(ImmutableCallSite ICS,
   if (!CallbackMD)
     return;
 
   for (const MDOperand &Op : CallbackMD->operands()) {
     MDNode *OpMD = cast<MDNode>(Op.get());
     auto *CBCalleeIdxAsCM = cast<ConstantAsMetadata>(OpMD->getOperand(0));
     uint64_t CBCalleeIdx =
         cast<ConstantInt>(CBCalleeIdxAsCM->getValue())->getZExtValue();
+    if (CBCalleeIdx < ICS.arg_size())
       CBUses.push_back(ICS.arg_begin() + CBCalleeIdx);
   }
 }
 
 /// Create an abstract call site from a use.
 AbstractCallSite::AbstractCallSite(const Use *U) : CS(U->getUser()) {
 
   // First handle unknown users.
   if (!CS) {

llvm/test/Transforms/OpenMP/rtf_type_checking.ll

 ; RUN: opt -S -openmpopt -stats < %s 2>&1 | FileCheck %s
+; RUN: opt -S -attributor -attributor-disable=false -openmpopt -stats < %s 2>&1 | FileCheck %s
 ; REQUIRES: asserts
 
 target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
 
 %struct.ident_t = type { i32, i32, i32, i32, i8* }
 
 @.str = private unnamed_addr constant [23 x i8] c";unknown;unknown;0;0;;\00", align 1
 @0 = private unnamed_addr global %struct.ident_t { i32 0, i32 2, i32 0, i32 0, i8* getelementptr inbounds ([23 x i8], [23 x i8]* @.str, i32 0, i32 0) }, align 8

 ; ===-------------------------------------------------------------------------===
 ;                         ... Statistics Collected ...
 ; ===-------------------------------------------------------------------------===
 ;
 ; CHECK: 1 cgscc-passmgr - Maximum CGSCCPassMgr iterations on one SCC
 ; CHECK: 2 openmp-opt{{.*}}Number of OpenMP runtime functions identified
 ;
 ; There are two matches since the pass is run once per function.
 No newline at end of file