From d1f5b8553b2091ba0e992b0ff080c286b60b2f4c Mon Sep 17 00:00:00 2001
From: Sanjoy Das <sanjoy@playingwithpointers.com>
Date: Tue, 2 Feb 2016 02:32:43 +0000
Subject: [PATCH] [X86] Fix a bug in getMemOpBaseRegImmOfs

Fix a crash in `getMemOpBaseRegImmOfs` that happens if the base of
`MemOp` is a frame index memory operand.  The fix is to have
`getMemOpBaseRegImmOfs` bail out in such cases.  We can possibly be more
clever here, if needed.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@259456 91177308-0d34-0410-b5e6-96231b3b80d8
---
 lib/Target/X86/X86InstrInfo.cpp                    |  6 +++-
 .../X86/machine-sink-and-implicit-null-checks.ll   | 36 +++++++++++++++++++++-
 2 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/lib/Target/X86/X86InstrInfo.cpp b/lib/Target/X86/X86InstrInfo.cpp
index 0c7ce7c2490..092e443d7d6 100644
--- a/lib/Target/X86/X86InstrInfo.cpp
+++ b/lib/Target/X86/X86InstrInfo.cpp
@@ -4604,7 +4604,11 @@ bool X86InstrInfo::getMemOpBaseRegImmOfs(MachineInstr *MemOp, unsigned &BaseReg,
 
   MemRefBegin += X86II::getOperandBias(Desc);
 
-  BaseReg = MemOp->getOperand(MemRefBegin + X86::AddrBaseReg).getReg();
+  MachineOperand &BaseMO = MemOp->getOperand(MemRefBegin + X86::AddrBaseReg);
+  if (!BaseMO.isReg()) // Can be an MO_FrameIndex
+    return false;
+
+  BaseReg = BaseMO.getReg();
   if (MemOp->getOperand(MemRefBegin + X86::AddrScaleAmt).getImm() != 1)
     return false;
 
diff --git a/test/CodeGen/X86/machine-sink-and-implicit-null-checks.ll b/test/CodeGen/X86/machine-sink-and-implicit-null-checks.ll
index 0d3bd06d095..d8fda86739c 100644
--- a/test/CodeGen/X86/machine-sink-and-implicit-null-checks.ll
+++ b/test/CodeGen/X86/machine-sink-and-implicit-null-checks.ll
@@ -27,13 +27,47 @@ define i1 @f(i8* %p0, i8* %p1) {
   unreachable
 }
 
+declare void @foo()
+
+declare token @llvm.experimental.gc.statepoint.p0f_isVoidf(i64, i32, void ()*, i32, i32, ...)
+declare i8 addrspace(1)* @llvm.experimental.gc.relocate.p1i8(token, i32, i32) nounwind readonly
+
+; Check for a crash.  The crash is not specific to statepoints, but
+; gc.statpeoint is an easy way to generate a fill instruction in
+; %continue0 (which causes the llc crash).
+define i1 @g(i8 addrspace(1)* %p0, i8* %p1) gc "statepoint-example" {
+ entry:
+  %c0 = icmp eq i8 addrspace(1)* %p0, null
+  %tok = call token (i64, i32, void ()*, i32, i32, ...) @llvm.experimental.gc.statepoint.p0f_isVoidf(i64 0, i32 0, void ()* @foo, i32 0, i32 0, i32 0, i32 0, i8 addrspace(1)* %p0)
+  %p0.relocated = call coldcc i8 addrspace(1)* @llvm.experimental.gc.relocate.p1i8(token %tok, i32 7, i32 7) ; (%p0, %p0)
+  br i1 %c0, label %throw0, label %continue0, !make.implicit !0
+
+ continue0:
+  %c1 = icmp eq i8* %p1, null
+  br i1 %c1, label %throw1, label %continue1, !make.implicit !0
+
+ continue1:
+  %v0 = load i8, i8 addrspace(1)* %p0.relocated
+  %v1 = load i8, i8* %p1
+  %v = icmp eq i8 %v0, %v1
+  ret i1 %v
+
+ throw0:
+  call void @throw0()
+  unreachable
+
+ throw1:
+  call void @throw1()
+  unreachable
+}
+
 ; Check that we have two implicit null checks in @f
 
 ; CHECK: __LLVM_FaultMaps:
 ; CHECK-NEXT:        .byte   1
 ; CHECK-NEXT:        .byte   0
 ; CHECK-NEXT:        .short  0
-; CHECK-NEXT:        .long   1
+; CHECK-NEXT:        .long   2
 
 ; FunctionInfo[0] =
 
-- 
2.11.0