The rewriter may hold references to instructions that are deleted because they are trivially dead.

Fix by clearing the rewriter cache before deleting the trivially dead
instructions.
Also make InsertedExpressions use an AssertingVH to catch these
bugs easier.

llvm-svn: 72364

4 files changed, 45 insertions, 2 deletions

diff --git a/llvm/include/llvm/Analysis/ScalarEvolutionExpander.h b/llvm/include/llvm/Analysis/ScalarEvolutionExpander.h
index cf2ad10e25a..8194555cdeb 100644
--- a/llvm/include/llvm/Analysis/ScalarEvolutionExpander.h
+++ b/llvm/include/llvm/Analysis/ScalarEvolutionExpander.h
@@ -28,7 +28,7 @@ namespace llvm {
   /// memory.
   struct SCEVExpander : public SCEVVisitor<SCEVExpander, Value*> {
     ScalarEvolution &SE;
-    std::map<SCEVHandle, Value*> InsertedExpressions;
+    std::map<SCEVHandle, AssertingVH<Value> > InsertedExpressions;
     std::set<Value*> InsertedValues;
 
     BasicBlock::iterator InsertPt;
diff --git a/llvm/lib/Analysis/ScalarEvolutionExpander.cpp b/llvm/lib/Analysis/ScalarEvolutionExpander.cpp
index 507ced74fd1..fc66ddb6f48 100644
--- a/llvm/lib/Analysis/ScalarEvolutionExpander.cpp
+++ b/llvm/lib/Analysis/ScalarEvolutionExpander.cpp
@@ -526,7 +526,7 @@ Value *SCEVExpander::expandCodeFor(SCEVHandle SH, const Type *Ty) {
 
 Value *SCEVExpander::expand(const SCEV *S) {
   // Check to see if we already expanded this.
-  std::map<SCEVHandle, Value*>::iterator I = InsertedExpressions.find(S);
+  std::map<SCEVHandle, AssertingVH<Value> >::iterator I = InsertedExpressions.find(S);
   if (I != InsertedExpressions.end())
     return I->second;
   
diff --git a/llvm/lib/Transforms/Scalar/IndVarSimplify.cpp b/llvm/lib/Transforms/Scalar/IndVarSimplify.cpp
index 89742c55d64..670499062ec 100644
--- a/llvm/lib/Transforms/Scalar/IndVarSimplify.cpp
+++ b/llvm/lib/Transforms/Scalar/IndVarSimplify.cpp
@@ -298,6 +298,7 @@ void IndVarSimplify::RewriteLoopExitValues(Loop *L,
         // in the loop, so we don't need an LCSSA phi node anymore.
         if (NumPreds == 1) {
           PN->replaceAllUsesWith(ExitVal);
+          Rewriter.clear();
           RecursivelyDeleteTriviallyDeadInstructions(PN);
           break;
         }
@@ -418,6 +419,7 @@ bool IndVarSimplify::runOnLoop(Loop *L, LPPassManager &LPM) {
   // Reorder instructions to avoid use-before-def conditions.
   FixUsesBeforeDefs(L, Rewriter);
 
+  Rewriter.clear();
   // For completeness, inform IVUsers of the IV use in the newly-created
   // loop exit test instruction.
   if (NewICmp)
diff --git a/llvm/test/Transforms/IndVarSimplify/2009-05-24-useafterfree.ll b/llvm/test/Transforms/IndVarSimplify/2009-05-24-useafterfree.ll
new file mode 100644
index 00000000000..ecbb23192e9
--- /dev/null
+++ b/llvm/test/Transforms/IndVarSimplify/2009-05-24-useafterfree.ll
@@ -0,0 +1,41 @@
+; RUN: llvm-as < %s | opt -indvars
+; PR4258
+target datalayout = "e-p:32:32:32-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-f32:32:32-f64:32:64-v64:64:64-v128:128:128-a0:0:64-f80:32:32"
+target triple = "i386-linux-gnu"
+
+define void @0(i32*, i32*, i32, i32) nounwind {
+	br i1 false, label %bb.nph1.preheader, label %.outer._crit_edge
+
+bb.nph1.preheader:		; preds = %4
+	%smax = select i1 false, i32 -1, i32 0		; <i32> [#uses=1]
+	%tmp12 = sub i32 0, %smax		; <i32> [#uses=1]
+	br label %bb.nph1
+
+bb.nph1:		; preds = %.outer, %bb.nph1.preheader
+	br i1 false, label %bb.nph3.preheader, label %.outer
+
+bb.nph3.preheader:		; preds = %bb.nph1
+	br label %bb.nph3
+
+bb.nph3:		; preds = %bb.nph3, %bb.nph3.preheader
+	%indvar7 = phi i32 [ %indvar.next8, %bb.nph3 ], [ 0, %bb.nph3.preheader ]		; <i32> [#uses=3]
+	%tmp9 = mul i32 %indvar7, -1		; <i32> [#uses=1]
+	%tmp13 = add i32 %tmp9, %tmp12		; <i32> [#uses=1]
+	%tmp14 = add i32 %tmp13, -2		; <i32> [#uses=1]
+	%5 = icmp sgt i32 %tmp14, 0		; <i1> [#uses=1]
+	%indvar.next8 = add i32 %indvar7, 1		; <i32> [#uses=1]
+	br i1 %5, label %bb.nph3, label %.outer.loopexit
+
+.outer.loopexit:		; preds = %bb.nph3
+	%indvar7.lcssa = phi i32 [ %indvar7, %bb.nph3 ]		; <i32> [#uses=0]
+	br label %.outer
+
+.outer:		; preds = %.outer.loopexit, %bb.nph1
+	br i1 false, label %bb.nph1, label %.outer._crit_edge.loopexit
+
+.outer._crit_edge.loopexit:		; preds = %.outer
+	br label %.outer._crit_edge
+
+.outer._crit_edge:		; preds = %.outer._crit_edge.loopexit, %4
+	ret void
+}