EA: disable finalizer inlining for allocations that are edges of `Phi…

…Node`s

The current EA-based finalizer inlining implementation can create
invalid IR when the target object is later aliased as a `PhiNode`,
which was causing #56422.
In such cases, finalizer inlining for the allocations that are edges of
each `PhiNode` should be avoided, and instead, finalizer inlining should
ideally be applied to the `PhiNode` itself, but implementing that is
somewhat complex. As a temporary fix, this commit disables inlining in
those cases.

- fixes #56422

base/compiler/ssair/passes.jl

@@ -1731,8 +1731,11 @@ function sroa_mutables!(ir::IRCode, defuses::IdDict{Int,Tuple{SPCSet,SSADefUse}}
             if finalizer_useidx isa Int
                 nargs = length(ir.argtypes) # COMBAK this might need to be `Int(opt.src.nargs)`
                 estate = EscapeAnalysis.analyze_escapes(ir, nargs, 𝕃ₒ, get_escape_cache(inlining.interp))
+                # disable finalizer inlining when this allocation is aliased to somewhere,
+                # mostly likely to edges of `PhiNode`
+                hasaliases = EscapeAnalysis.getaliases(SSAValue(defidx), estate) !== nothing
                 einfo = estate[SSAValue(defidx)]
-                if EscapeAnalysis.has_no_escape(einfo)
+                if !hasaliases && EscapeAnalysis.has_no_escape(einfo)
                     already = BitSet(use.idx for use in defuse.uses)
                     for idx = einfo.Liveness
                         if idx ∉ already

test/compiler/inline.jl

@@ -2286,6 +2286,23 @@ let;Base.Experimental.@force_compile
     @test foreign_buffer_checker.finalized
 end
 
+# JuliaLang/julia#56422:
+# EA-based finalizer inlining should not result in an invalid IR in the existence of `PhiNode`s
+function issue56422(cnd::Bool, N::Int)
+    if cnd
+        workspace = foreign_alloc(Float64, N)
+    else
+        workspace = foreign_alloc(Float64, N+1)
+    end
+    GC.@preserve workspace begin
+        (;ptr) = workspace
+        Base.@assume_effects :nothrow @noinline println(devnull, "ptr = ", ptr)
+    end
+end
+let src = code_typed1(issue56422, (Bool,Int,))
+    @test_broken count(iscall((src, Core.finalizer)), src.code) == 0
+end
+
 # Test that inlining doesn't unnecessarily move things to statement position
 @noinline f_noinline_invoke(x::Union{Symbol,Nothing}=nothing) = Core.donotdelete(x)
 g_noinline_invoke(x) = f_noinline_invoke(x)