SSA CFG: free up insts in unreachable blocks

Author: clonker

libyul/backends/evm/ssa/transform/UnreachableBlockCleaner.cpp

@@ -20,6 +20,9 @@
 
 #include <libyul/backends/evm/ssa/SSACFG.h>
 
+#include <libsolutil/Visitor.h>
+
+#include <cstdint>
 #include <deque>
 #include <vector>
 
@@ -47,12 +50,53 @@ void transform::cleanUnreachableBlocks(SSACFG& _cfg)
 		});
 	}
 
+	auto& store = _cfg.instructionStore();
 	for (SSACFG::BlockId blockId{0}; blockId.value < _cfg.numBlocks(); ++blockId.value)
 	{
 		auto& block = _cfg.block(blockId);
 		if (reachable[blockId.value])
 			std::erase_if(block.entries, [&](auto const& entry) { return !reachable[entry.value]; });
 		else
+		{
+			for (InstId const id: block.instructions)
+				store.tombstone(id);
 			block = {};
+		}
+	}
+
+	// Post-condition: every reference reachable from a live block resolves to a
+	// non-Tombstoned slot. Catches CFG-construction bugs and any future pass that
+	// fails to drop a stale cross-block reference.
+	for (SSACFG::BlockId blockId{0}; blockId.value < _cfg.numBlocks(); ++blockId.value)
+	{
+		if (!reachable[blockId.value])
+			continue;
+		auto const& block = _cfg.block(blockId);
+		auto const checkRef = [&](InstId const _ref) {
+			yulAssert(_ref.hasValue());
+			yulAssert(
+				store.kindOf(_ref) != InstOpcode::Tombstone,
+				"reachable IR references a tombstoned Inst"
+			);
+		};
+		for (InstId const id: block.instructions)
+		{
+			auto const& inst = store.inst(id);
+			yulAssert(inst.opcode != InstOpcode::Tombstone);
+			for (InstId const input: inst.inputs)
+				checkRef(input);
+			if (inst.isUpsilon())
+				checkRef(_cfg.upsilonPhi(id));
+		}
+		std::visit(solidity::util::GenericVisitor{
+			[&](SSACFG::BasicBlock::ConditionalJump const& _c) { checkRef(_c.condition); },
+			[&](SSACFG::BasicBlock::FunctionReturn const& _r) {
+				for (InstId const v: _r.returnValues)
+					checkRef(v);
+			},
+			[](SSACFG::BasicBlock::Jump const&) {},
+			[](SSACFG::BasicBlock::MainExit const&) {},
+			[](SSACFG::BasicBlock::Terminated const&) {}
+		}, block.exit);
 	}
 }

libyul/backends/evm/ssa/transform/UnreachableBlockCleaner.h

@@ -17,7 +17,6 @@
 // SPDX-License-Identifier: GPL-3.0
 /**
  * Removes unreachable blocks from an SSA CFG and cleans up entry lists referencing them.
- * Note that this invalidates ValueIds and InstIds pointing into the (unreachable) blocks.
  */
 #pragma once