Commit 87121696 by Richard Sandiford Committed by Richard Sandiford

Fix use after free in vector_size change

r277235 was a bit too mechanical and ended up introducing use
after free bugs in both loop and SLP vectorisation.

2019-10-22  Richard Sandiford  <richard.sandiford@arm.com>

gcc/
	* tree-vect-slp.c (vect_slp_bb_region): Check whether
	autodetected_vector_size rather than vector_size is zero.
	* tree-vect-loop.c (vect_analyze_loop): Likewise.
	Set autodetected_vector_size immediately after calling
	vect_analyze_loop_2.  Check for a fatal error before advancing
	next_size.

From-SVN: r277282
parent 10bce48f
2019-10-22 Richard Sandiford <richard.sandiford@arm.com>
* tree-vect-slp.c (vect_slp_bb_region): Check whether
autodetected_vector_size rather than vector_size is zero.
* tree-vect-loop.c (vect_analyze_loop): Likewise.
Set autodetected_vector_size immediately after calling
vect_analyze_loop_2. Check for a fatal error before advancing
next_size.
2019-10-21 Jason Merrill <jason@redhat.com> 2019-10-21 Jason Merrill <jason@redhat.com>
* lock-and-run.sh: Check for process existence rather than timeout. * lock-and-run.sh: Check for process existence rather than timeout.
...@@ -2365,6 +2365,9 @@ vect_analyze_loop (class loop *loop, loop_vec_info orig_loop_vinfo, ...@@ -2365,6 +2365,9 @@ vect_analyze_loop (class loop *loop, loop_vec_info orig_loop_vinfo,
LOOP_VINFO_ORIG_LOOP_INFO (loop_vinfo) = orig_loop_vinfo; LOOP_VINFO_ORIG_LOOP_INFO (loop_vinfo) = orig_loop_vinfo;
opt_result res = vect_analyze_loop_2 (loop_vinfo, fatal, &n_stmts); opt_result res = vect_analyze_loop_2 (loop_vinfo, fatal, &n_stmts);
if (next_size == 0)
autodetected_vector_size = loop_vinfo->vector_size;
if (res) if (res)
{ {
LOOP_VINFO_VECTORIZABLE_P (loop_vinfo) = 1; LOOP_VINFO_VECTORIZABLE_P (loop_vinfo) = 1;
...@@ -2390,21 +2393,18 @@ vect_analyze_loop (class loop *loop, loop_vec_info orig_loop_vinfo, ...@@ -2390,21 +2393,18 @@ vect_analyze_loop (class loop *loop, loop_vec_info orig_loop_vinfo,
else else
delete loop_vinfo; delete loop_vinfo;
if (next_size == 0)
autodetected_vector_size = loop_vinfo->vector_size;
if (next_size < vector_sizes.length ()
&& known_eq (vector_sizes[next_size], autodetected_vector_size))
next_size += 1;
if (fatal) if (fatal)
{ {
gcc_checking_assert (first_loop_vinfo == NULL); gcc_checking_assert (first_loop_vinfo == NULL);
return opt_loop_vec_info::propagate_failure (res); return opt_loop_vec_info::propagate_failure (res);
} }
if (next_size < vector_sizes.length ()
&& known_eq (vector_sizes[next_size], autodetected_vector_size))
next_size += 1;
if (next_size == vector_sizes.length () if (next_size == vector_sizes.length ()
|| known_eq (loop_vinfo->vector_size, 0U)) || known_eq (autodetected_vector_size, 0U))
{ {
if (first_loop_vinfo) if (first_loop_vinfo)
{ {
......
...@@ -3102,7 +3102,7 @@ vect_slp_bb_region (gimple_stmt_iterator region_begin, ...@@ -3102,7 +3102,7 @@ vect_slp_bb_region (gimple_stmt_iterator region_begin,
if (vectorized if (vectorized
|| next_size == vector_sizes.length () || next_size == vector_sizes.length ()
|| known_eq (bb_vinfo->vector_size, 0U) || known_eq (autodetected_vector_size, 0U)
/* If vect_slp_analyze_bb_1 signaled that analysis for all /* If vect_slp_analyze_bb_1 signaled that analysis for all
vector sizes will fail do not bother iterating. */ vector sizes will fail do not bother iterating. */
|| fatal) || fatal)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment