1 files changed, 50 insertions, 1 deletions

diff --git a/lib/VMCore/Verifier.cpp b/lib/VMCore/Verifier.cpp
index 5af66df7c9..df9aceec02 100644
--- a/lib/VMCore/Verifier.cpp
+++ b/lib/VMCore/Verifier.cpp
@@ -338,6 +338,36 @@ static RegisterPass<Verifier> X("verify", "Module Verifier");
 #define Assert4(C, M, V1, V2, V3, V4) \
   do { if (!(C)) { CheckFailed(M, V1, V2, V3, V4); return; } } while (0)
 
+/// Check whether or not a Value is metadata or made up of a constant
+/// expression involving metadata.
+static bool isMetadata(Value *X) {
+  SmallPtrSet<Value *, 8> Visited;
+  SmallVector<Value *, 8> Queue;
+  Queue.push_back(X);
+
+  while (!Queue.empty()) {
+    Value *V = Queue.back();
+    Queue.pop_back();
+    if (!Visited.insert(V))
+      continue;
+
+    if (isa<MDString>(V) || isa<MDNode>(V))
+      return true;
+    if (!isa<ConstantExpr>(V))
+      continue;
+    ConstantExpr *CE = cast<ConstantExpr>(V);
+
+    if (CE->getType() != Type::EmptyStructTy)
+      continue;
+
+    // The only constant expression that works on metadata type is select.
+    if (CE->getOpcode() != Instruction::Select) return false;
+
+    Queue.push_back(CE->getOperand(1));
+    Queue.push_back(CE->getOperand(2));
+  }
+  return false;
+}
 
 void Verifier::visit(Instruction &I) {
   for (unsigned i = 0, e = I.getNumOperands(); i != e; ++i)
@@ -649,6 +679,7 @@ void Verifier::visitReturnInst(ReturnInst &RI) {
             "Found return instr that returns non-void in Function of void "
             "return type!", &RI, F->getReturnType());
   else if (N == 1 && F->getReturnType() == RI.getOperand(0)->getType()) {
+    Assert1(!isMetadata(RI.getOperand(0)), "Invalid use of metadata!", &RI);
     // Exactly one return value and it matches the return type. Good.
   } else if (const StructType *STy = dyn_cast<StructType>(F->getReturnType())) {
     // The return type is a struct; check for multiple return values.
@@ -696,6 +727,8 @@ void Verifier::visitSelectInst(SelectInst &SI) {
 
   Assert1(SI.getTrueValue()->getType() == SI.getType(),
           "Select values must have same type as select instruction!", &SI);
+  Assert1(!isMetadata(SI.getOperand(1)) && !isMetadata(SI.getOperand(2)),
+          "Invalid use of metadata!", &SI);
   visitInstruction(SI);
 }
 
@@ -951,6 +984,13 @@ void Verifier::visitPHINode(PHINode &PN) {
     Assert1(PN.getType() == PN.getIncomingValue(i)->getType(),
             "PHI node operands are not the same type as the result!", &PN);
 
+  // Check that it's not a PHI of metadata.
+  if (PN.getType() == Type::EmptyStructTy) {
+    for (unsigned i = 0, e = PN.getNumIncomingValues(); i != e; ++i)
+      Assert1(!isMetadata(PN.getIncomingValue(i)),
+              "Invalid use of metadata!", &PN);
+  }
+
   // All other PHI node constraints are checked in the visitBasicBlock method.
 
   visitInstruction(PN);
@@ -981,6 +1021,14 @@ void Verifier::VerifyCallSite(CallSite CS) {
             "Call parameter type does not match function signature!",
             CS.getArgument(i), FTy->getParamType(i), I);
 
+  if (CS.getCalledValue()->getNameLen() < 5 ||
+      strncmp(CS.getCalledValue()->getNameStart(), "llvm.", 5) != 0) {
+    // Verify that none of the arguments are metadata...
+    for (unsigned i = 0, e = FTy->getNumParams(); i != e; ++i)
+      Assert2(!isMetadata(CS.getArgument(i)), "Invalid use of metadata!",
+              CS.getArgument(i), I);
+  }
+
   const AttrListPtr &Attrs = CS.getAttributes();
 
   Assert1(VerifyAttributeCount(Attrs, CS.arg_size()),
@@ -1152,6 +1200,7 @@ void Verifier::visitStoreInst(StoreInst &SI) {
     cast<PointerType>(SI.getOperand(1)->getType())->getElementType();
   Assert2(ElTy == SI.getOperand(0)->getType(),
           "Stored value type does not match pointer operand type!", &SI, ElTy);
+  Assert1(!isMetadata(SI.getOperand(0)), "Invalid use of metadata!", &SI);
   visitInstruction(SI);
 }
 
@@ -1481,7 +1530,7 @@ bool Verifier::PerformTypeCheck(Intrinsic::ID ID, Function *F, const Type *Ty,
     if (EltTy != Ty)
       Suffix += "v" + utostr(NumElts);
 
-    Suffix += "i" + utostr(GotBits);;
+    Suffix += "i" + utostr(GotBits);
 
     // Check some constraints on various intrinsics.
     switch (ID) {