<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [X86][AVX] Attempt to share broadcasts of different widths (D57663) - node/value mismatch"
href="https://bugs.llvm.org/show_bug.cgi?id=48215">48215</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[X86][AVX] Attempt to share broadcasts of different widths (D57663) - node/value mismatch
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Windows NT
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Backend: X86
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>llvm-dev@redking.me.uk
</td>
</tr>
<tr>
<th>CC</th>
<td>craig.topper@gmail.com, llvm-bugs@lists.llvm.org, llvm-dev@redking.me.uk, pengfei.wang@intel.com, spatel+llvm@rotateright.com
</td>
</tr></table>
<p>
<div>
<pre>We've discovered a problem with an old patch D57663:
// Share broadcast with the longest vector and extract low subvector
(free).
for (SDNode *User : Src->uses())
if (User != N.getNode() && User->getOpcode() == X86ISD::VBROADCAST &&
User->getValueSizeInBits(0) > VT.getSizeInBits()) {
return extractSubVector(SDValue(User, 0), 0, DAG, DL,
VT.getSizeInBits());
}
We're only ensuring the source is from the same SDNode, but not checking its
from the same SDValue. So if we're broadcasting from different values from the
same node (e.g. a ISD::SDIVREM node) then we could match with the wrong
broadcast.
This manually created test case shows the problem:
define i32 @broadcast_sdiv_srem(i32 %a0, i32 %a1) {
%d = sdiv i32 %a0, %a1
%r = srem i32 %a0, %a1
%dv0 = insertelement <8 x i32> undef, i32 %d, i32 0
%rv0 = insertelement <4 x i32> undef, i32 %r, i32 0
%dv1 = shufflevector <8 x i32> %dv0, <8 x i32> undef, <8 x i32>
zeroinitializer
%rv1 = shufflevector <4 x i32> %rv0, <4 x i32> undef, <4 x i32>
zeroinitializer
%dc0 = icmp slt <8 x i32> %dv1, <i32 0, i32 1, i32 2, i32 3, i32 4, i32 5,
i32 6, i32 7>
%rc0 = icmp slt <4 x i32> %rv1, <i32 4, i32 5, i32 6, i32 7>
%db0 = bitcast <8 x i1> %dc0 to i8
%rb0 = bitcast <4 x i1> %rc0 to i4
%db1 = zext i8 %db0 to i32
%rb1 = zext i4 %rb0 to i32
%res = add i32 %db1, %rb1
ret i32 %res
}
We can see the issue here, on a AVX1 target we broadcast (via PSHUFD) both
values:
idivl %esi
vmovd %edx, %xmm0
vpshufd $0, %xmm0, %xmm0 # xmm0 = xmm0[0,0,0,0]
vpcmpgtd %xmm0, %xmm1, %xmm0
vmovd %eax, %xmm2
vmovmskps %xmm0, %eax
vpshufd $0, %xmm2, %xmm2 # xmm2 = xmm2[0,0,0,0]
vpcmpgtd %xmm2, %xmm1, %xmm3
vpcmpgtd %xmm2, %xmm4, %xmm2
vinsertf128 $1, %xmm3, %ymm2, %ymm2
vmovmskps %ymm2, %ecx
addl %ecx, %eax
retq
But on a AVX2 target which performs the fold we end up with a single broadcast:
idivl %esi
vmovd %eax, %xmm0 # WHERE DID THE %edx BROADCAST GO?
vpbroadcastd %xmm0, %ymm0
vpcmpgtd %ymm0, %ymm1, %ymm1
vpcmpgtd %xmm0, %xmm2, %xmm0
vmovmskps %ymm1, %ecx
vmovmskps %xmm0, %eax
addl %ecx, %eax
vzeroupper
retq
<a href="https://gcc.godbolt.org/z/fWf4Es">https://gcc.godbolt.org/z/fWf4Es</a></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>