Fix a crash caused by dereference of MBB.end(). rdar://8110842

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@106399 91177308-0d34-0410-b5e6-96231b3b80d8

2 files changed, 43 insertions, 6 deletions

diff --git a/lib/Target/ARM/Thumb2ITBlockPass.cpp b/lib/Target/ARM/Thumb2ITBlockPass.cpp
index d72bb5d731..52ab71a71f 100644
--- a/lib/Target/ARM/Thumb2ITBlockPass.cpp
+++ b/lib/Target/ARM/Thumb2ITBlockPass.cpp
@@ -317,12 +317,14 @@ Thumb2ITBlockPass::MoveCopyOutOfITBlock(MachineInstr *MI,
     // If not, then there is nothing to be gained by moving the copy.
     MachineBasicBlock::iterator I = MI; ++I;
     MachineBasicBlock::iterator E = MI->getParent()->end();
-    while (I != E && I->isDebugValue())
-      ++I;
-    unsigned NPredReg = 0;
-    ARMCC::CondCodes NCC = getPredicate(I, NPredReg);
-    if (NCC == CC || NCC == OCC)
-      return true;
+    if (I != E) {
+      while (I != E && I->isDebugValue())
+        ++I;
+      unsigned NPredReg = 0;
+      ARMCC::CondCodes NCC = getPredicate(I, NPredReg);
+      if (NCC == CC || NCC == OCC)
+        return true;
+    }
   }
   return false;
 }
diff --git a/test/CodeGen/Thumb2/2010-06-19-ITBlockCrash.ll b/test/CodeGen/Thumb2/2010-06-19-ITBlockCrash.ll
new file mode 100644
index 0000000000..501f763bda
--- /dev/null
+++ b/test/CodeGen/Thumb2/2010-06-19-ITBlockCrash.ll
@@ -0,0 +1,35 @@
+; RUN: llc < %s -mtriple=thumbv7-apple-darwin -O3 -relocation-model=pic -disable-fp-elim -mcpu=cortex-a8
+; rdar://8110842
+
+declare arm_apcscc i32 @__maskrune(i32, i32)
+
+define arm_apcscc i32 @strncmpic(i8* nocapture %s1, i8* nocapture %s2, i32 %n) nounwind {
+entry:
+  br i1 undef, label %bb11, label %bb19
+
+bb11:                                             ; preds = %entry
+  %0 = sext i8 0 to i32                           ; <i32> [#uses=1]
+  br i1 undef, label %bb.i.i10, label %bb1.i.i11
+
+bb.i.i10:                                         ; preds = %bb11
+  br label %isupper144.exit12
+
+bb1.i.i11:                                        ; preds = %bb11
+  %1 = tail call arm_apcscc  i32 @__maskrune(i32 %0, i32 32768) nounwind ; <i32> [#uses=1]
+  %2 = icmp ne i32 %1, 0                          ; <i1> [#uses=1]
+  %3 = zext i1 %2 to i32                          ; <i32> [#uses=1]
+  %.pre = load i8* undef, align 1                 ; <i8> [#uses=1]
+  br label %isupper144.exit12
+
+isupper144.exit12:                                ; preds = %bb1.i.i11, %bb.i.i10
+  %4 = phi i8 [ %.pre, %bb1.i.i11 ], [ 0, %bb.i.i10 ] ; <i8> [#uses=1]
+  %5 = phi i32 [ %3, %bb1.i.i11 ], [ undef, %bb.i.i10 ] ; <i32> [#uses=1]
+  %6 = icmp eq i32 %5, 0                          ; <i1> [#uses=1]
+  %7 = sext i8 %4 to i32                          ; <i32> [#uses=1]
+  %storemerge1 = select i1 %6, i32 %7, i32 undef  ; <i32> [#uses=1]
+  %8 = sub nsw i32 %storemerge1, 0                ; <i32> [#uses=1]
+  ret i32 %8
+
+bb19:                                             ; preds = %entry
+  ret i32 0
+}