On Monday 01 March 2010 20:32:07 Dan Gohman wrote:> > No, what I mean is the thing under UI at the point of call to > > AddModifiedNodeToCSEMaps gets deleted. So UI is invalid and when > > we loop back around and check it against UE we blow up with a > > singular iterator error. > > UI is incremented before AddModifiedNodeToCSEMaps is called, so > I'm still not seeing what you're describing here.It's not the increment that trips, it's the loop top compare to UE. It doesn't matter where UI points at the call to AddModifiedNodeToCSEMaps. The fact that AddModifiedNodeToCSEMaps can recursively call ReplaceAllUsesOf means that we can potentially delete the node out from under UI. -Dave
On Mar 2, 2010, at 8:57 AM, David Greene wrote:> On Monday 01 March 2010 20:32:07 Dan Gohman wrote: > >>> No, what I mean is the thing under UI at the point of call to >>> AddModifiedNodeToCSEMaps gets deleted. So UI is invalid and when >>> we loop back around and check it against UE we blow up with a >>> singular iterator error. >> >> UI is incremented before AddModifiedNodeToCSEMaps is called, so >> I'm still not seeing what you're describing here. > > It's not the increment that trips, it's the loop top compare to UE. It > doesn't matter where UI points at the call to AddModifiedNodeToCSEMaps. > The fact that AddModifiedNodeToCSEMaps can recursively call > ReplaceAllUsesOf means that we can potentially delete the node > out from under UI.Ok, I think I've finally managed to draw on my whiteboard a theoretical situation which could have a problem like this. The attached patch should theoretically fix this bug, though I have no way to confirm this right now. Does it fix the bug you're seeing? Dan -------------- next part -------------- A non-text attachment was scrubbed... Name: rauw.patch Type: application/octet-stream Size: 3853 bytes Desc: not available URL: <http://lists.llvm.org/pipermail/llvm-dev/attachments/20100302/a5fcb6be/attachment.obj> -------------- next part --------------
On Tuesday 02 March 2010 16:13:50 Dan Gohman wrote:> Ok, I think I've finally managed to draw on my whiteboard a theoretical > situation which could have a problem like this.Do you have a way to express it over the list? I'd like to learn a little more about SelectionDAG and how this could happen.> The attached patch should theoretically fix this bug, though I have no > way to confirm this right now. Does it fix the bug you're seeing?Can you send it again? I get a zero-length file. Same with the attached .txt file. -Dave
On Tuesday 02 March 2010 16:13:50 Dan Gohman wrote:> The attached patch should theoretically fix this bug, though I have noClever. :)> way to confirm this right now. Does it fix the bug you're seeing?Yep, it fixed it. Now we should get a testcase for this. Can you describe the (not so :) ) theoretical way this could be triggered? Then we can synthesize a testcase. -Dave