diff options
| author | Richard Sandiford <richard.sandiford@arm.com> | 2019-10-22 08:43:01 +0000 |
|---|---|---|
| committer | Richard Sandiford <rsandifo@gcc.gnu.org> | 2019-10-22 08:43:01 +0000 |
| commit | 87121696fb2ddbec5f33daa359234850f7fd306d (patch) | |
| tree | cc0355da7614212e8c7c186339e97cd127f5ba87 /gcc | |
| parent | 10bce48f104de56503b17954ed79f019df3252e3 (diff) | |
| download | gcc-87121696fb2ddbec5f33daa359234850f7fd306d.zip gcc-87121696fb2ddbec5f33daa359234850f7fd306d.tar.gz gcc-87121696fb2ddbec5f33daa359234850f7fd306d.tar.bz2 | |
Fix use after free in vector_size change
r277235 was a bit too mechanical and ended up introducing use
after free bugs in both loop and SLP vectorisation.
2019-10-22 Richard Sandiford <richard.sandiford@arm.com>
gcc/
* tree-vect-slp.c (vect_slp_bb_region): Check whether
autodetected_vector_size rather than vector_size is zero.
* tree-vect-loop.c (vect_analyze_loop): Likewise.
Set autodetected_vector_size immediately after calling
vect_analyze_loop_2. Check for a fatal error before advancing
next_size.
From-SVN: r277282
Diffstat (limited to 'gcc')
| -rw-r--r-- | gcc/ChangeLog | 9 | ||||
| -rw-r--r-- | gcc/tree-vect-loop.c | 16 | ||||
| -rw-r--r-- | gcc/tree-vect-slp.c | 2 |
3 files changed, 18 insertions, 9 deletions
diff --git a/gcc/ChangeLog b/gcc/ChangeLog index 5e6c662..65baf0c 100644 --- a/gcc/ChangeLog +++ b/gcc/ChangeLog @@ -1,3 +1,12 @@ +2019-10-22 Richard Sandiford <richard.sandiford@arm.com> + + * tree-vect-slp.c (vect_slp_bb_region): Check whether + autodetected_vector_size rather than vector_size is zero. + * tree-vect-loop.c (vect_analyze_loop): Likewise. + Set autodetected_vector_size immediately after calling + vect_analyze_loop_2. Check for a fatal error before advancing + next_size. + 2019-10-21 Jason Merrill <jason@redhat.com> * lock-and-run.sh: Check for process existence rather than timeout. diff --git a/gcc/tree-vect-loop.c b/gcc/tree-vect-loop.c index a4c9f2f..07ddc2e 100644 --- a/gcc/tree-vect-loop.c +++ b/gcc/tree-vect-loop.c @@ -2365,6 +2365,9 @@ vect_analyze_loop (class loop *loop, loop_vec_info orig_loop_vinfo, LOOP_VINFO_ORIG_LOOP_INFO (loop_vinfo) = orig_loop_vinfo; opt_result res = vect_analyze_loop_2 (loop_vinfo, fatal, &n_stmts); + if (next_size == 0) + autodetected_vector_size = loop_vinfo->vector_size; + if (res) { LOOP_VINFO_VECTORIZABLE_P (loop_vinfo) = 1; @@ -2390,21 +2393,18 @@ vect_analyze_loop (class loop *loop, loop_vec_info orig_loop_vinfo, else delete loop_vinfo; - if (next_size == 0) - autodetected_vector_size = loop_vinfo->vector_size; - - if (next_size < vector_sizes.length () - && known_eq (vector_sizes[next_size], autodetected_vector_size)) - next_size += 1; - if (fatal) { gcc_checking_assert (first_loop_vinfo == NULL); return opt_loop_vec_info::propagate_failure (res); } + if (next_size < vector_sizes.length () + && known_eq (vector_sizes[next_size], autodetected_vector_size)) + next_size += 1; + if (next_size == vector_sizes.length () - || known_eq (loop_vinfo->vector_size, 0U)) + || known_eq (autodetected_vector_size, 0U)) { if (first_loop_vinfo) { diff --git a/gcc/tree-vect-slp.c b/gcc/tree-vect-slp.c index d482aa1..20ea105 100644 --- a/gcc/tree-vect-slp.c +++ b/gcc/tree-vect-slp.c @@ -3102,7 +3102,7 @@ vect_slp_bb_region (gimple_stmt_iterator region_begin, if (vectorized || next_size == vector_sizes.length () - || known_eq (bb_vinfo->vector_size, 0U) + || known_eq (autodetected_vector_size, 0U) /* If vect_slp_analyze_bb_1 signaled that analysis for all vector sizes will fail do not bother iterating. */ || fatal) |