The rewriter may hold references to instructions that are deleted because they are trivially dead.

Fix by clearing the rewriter cache before deleting the trivially dead
instructions.
Also make InsertedExpressions use an AssertingVH to catch these
bugs easier.


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@72364 91177308-0d34-0410-b5e6-96231b3b80d8

4 files changed, 45 insertions, 2 deletions

diff --git a/include/llvm/Analysis/ScalarEvolutionExpander.h b/include/llvm/Analysis/ScalarEvolutionExpander.h
index cf2ad10e25..8194555cde 100644
--- a/include/llvm/Analysis/ScalarEvolutionExpander.h
+++ b/include/llvm/Analysis/ScalarEvolutionExpander.h
@@ -28,7 +28,7 @@ namespace llvm {
   /// memory.
   struct SCEVExpander : public SCEVVisitor<SCEVExpander, Value*> {
     ScalarEvolution &SE;
-    std::map<SCEVHandle, Value*> InsertedExpressions;
+    std::map<SCEVHandle, AssertingVH<Value> > InsertedExpressions;
     std::set<Value*> InsertedValues;
 
     BasicBlock::iterator InsertPt;
diff --git a/lib/Analysis/ScalarEvolutionExpander.cpp b/lib/Analysis/ScalarEvolutionExpander.cpp
index 507ced74fd..fc66ddb6f4 100644
--- a/lib/Analysis/ScalarEvolutionExpander.cpp
+++ b/lib/Analysis/ScalarEvolutionExpander.cpp
@@ -526,7 +526,7 @@ Value *SCEVExpander::expandCodeFor(SCEVHandle SH, const Type *Ty) {
 
 Value *SCEVExpander::expand(const SCEV *S) {
   // Check to see if we already expanded this.
-  std::map<SCEVHandle, Value*>::iterator I = InsertedExpressions.find(S);
+  std::map<SCEVHandle, AssertingVH<Value> >::iterator I = InsertedExpressions.find(S);
   if (I != InsertedExpressions.end())
     return I->second;
   
diff --git a/lib/Transforms/Scalar/IndVarSimplify.cpp b/lib/Transforms/Scalar/IndVarSimplify.cpp
index 89742c55d6..670499062e 100644
--- a/lib/Transforms/Scalar/IndVarSimplify.cpp
+++ b/lib/Transforms/Scalar/IndVarSimplify.cpp
@@ -298,6 +298,7 @@ void IndVarSimplify::RewriteLoopExitValues(Loop *L,
         // in the loop, so we don't need an LCSSA phi node anymore.
         if (NumPreds == 1) {
           PN->replaceAllUsesWith(ExitVal);
+          Rewriter.clear();
           RecursivelyDeleteTriviallyDeadInstructions(PN);
           break;
         }
@@ -418,6 +419,7 @@ bool IndVarSimplify::runOnLoop(Loop *L, LPPassManager &LPM) {
   // Reorder instructions to avoid use-before-def conditions.
   FixUsesBeforeDefs(L, Rewriter);
 
+  Rewriter.clear();
   // For completeness, inform IVUsers of the IV use in the newly-created
   // loop exit test instruction.
   if (NewICmp)
diff --git a/test/Transforms/IndVarSimplify/2009-05-24-useafterfree.ll b/test/Transforms/IndVarSimplify/2009-05-24-useafterfree.ll
new file mode 100644
index 0000000000..ecbb23192e
--- /dev/null
+++ b/test/Transforms/IndVarSimplify/2009-05-24-useafterfree.ll
@@ -0,0 +1,41 @@
+; RUN: llvm-as < %s | opt -indvars
+; PR4258
+target datalayout = "e-p:32:32:32-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:32:64-f32:32:32-f64:32:64-v64:64:64-v128:128:128-a0:0:64-f80:32:32"
+target triple = "i386-linux-gnu"
+
+define void @0(i32*, i32*, i32, i32) nounwind {
+	br i1 false, label %bb.nph1.preheader, label %.outer._crit_edge
+
+bb.nph1.preheader:		; preds = %4
+	%smax = select i1 false, i32 -1, i32 0		; <i32> [#uses=1]
+	%tmp12 = sub i32 0, %smax		; <i32> [#uses=1]
+	br label %bb.nph1
+
+bb.nph1:		; preds = %.outer, %bb.nph1.preheader
+	br i1 false, label %bb.nph3.preheader, label %.outer
+
+bb.nph3.preheader:		; preds = %bb.nph1
+	br label %bb.nph3
+
+bb.nph3:		; preds = %bb.nph3, %bb.nph3.preheader
+	%indvar7 = phi i32 [ %indvar.next8, %bb.nph3 ], [ 0, %bb.nph3.preheader ]		; <i32> [#uses=3]
+	%tmp9 = mul i32 %indvar7, -1		; <i32> [#uses=1]
+	%tmp13 = add i32 %tmp9, %tmp12		; <i32> [#uses=1]
+	%tmp14 = add i32 %tmp13, -2		; <i32> [#uses=1]
+	%5 = icmp sgt i32 %tmp14, 0		; <i1> [#uses=1]
+	%indvar.next8 = add i32 %indvar7, 1		; <i32> [#uses=1]
+	br i1 %5, label %bb.nph3, label %.outer.loopexit
+
+.outer.loopexit:		; preds = %bb.nph3
+	%indvar7.lcssa = phi i32 [ %indvar7, %bb.nph3 ]		; <i32> [#uses=0]
+	br label %.outer
+
+.outer:		; preds = %.outer.loopexit, %bb.nph1
+	br i1 false, label %bb.nph1, label %.outer._crit_edge.loopexit
+
+.outer._crit_edge.loopexit:		; preds = %.outer
+	br label %.outer._crit_edge
+
+.outer._crit_edge:		; preds = %.outer._crit_edge.loopexit, %4
+	ret void
+}