<html>
<head>
<base href="https://bugs.llvm.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [X86][AVX] Incorrect decoding of constant vector data from X86ISD::SUBV_BROADCAST_LOAD nodes"
href="https://bugs.llvm.org/show_bug.cgi?id=51281">51281</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[X86][AVX] Incorrect decoding of constant vector data from X86ISD::SUBV_BROADCAST_LOAD nodes
</td>
</tr>
<tr>
<th>Product</th>
<td>libraries
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Windows NT
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>enhancement
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>Backend: X86
</td>
</tr>
<tr>
<th>Assignee</th>
<td>llvm-dev@redking.me.uk
</td>
</tr>
<tr>
<th>Reporter</th>
<td>llvm-dev@redking.me.uk
</td>
</tr>
<tr>
<th>CC</th>
<td>craig.topper@gmail.com, llvm-bugs@lists.llvm.org, llvm-dev@redking.me.uk, pengfei.wang@intel.com, spatel+llvm@rotateright.com
</td>
</tr></table>
<p>
<div>
<pre>Internal fuzz tests have found an issue that appeared after rGc8472db0a88701.
The more aggressive creation of X86ISD::SUBV_BROADCAST_LOAD nodes has exposed
an existing bug with incorrect constant decoding in
getTargetConstantBitsFromNode if its referencing a constant pool entry larger
than the subvector size.
define <16 x float> @shuffc(<8 x float> %a0) {
%shuffle = shufflevector <8 x float> %a0, <8 x float> <float poison, float
0x3FD6BB78C0000000, float poison, float poison, float poison, float poison,
float 0.000000e+00, float poison>, <16 x i32> <i32 7, i32 7, i32 1, i32 1, i32
6, i32 3, i32 6, i32 0, i32 14, i32 0, i32 9, i32 9, i32 7, i32 1, i32 5, i32
9>
ret <16 x float> %shuffle
}
<a href="https://c.godbolt.org/z/b9W3xKe1e">https://c.godbolt.org/z/b9W3xKe1e</a>
codegen (same for trunk and 12.x):
shuffc: # @shuffc
vextractf128 xmm1, ymm0, 1
vperm2f128 ymm3, ymm0, ymm0, 1 # ymm3 = ymm0[2,3,0,1]
vshufps xmm2, xmm0, xmm1, 49 # xmm2 = xmm0[1,0],xmm1[3,0]
vshufps xmm1, xmm2, xmm1, 210 # xmm1 = xmm2[2,0],xmm1[1,3]
vmovsldup xmm2, xmm0 # xmm2 = xmm0[0,0,2,2]
vblendps ymm0, ymm3, ymm0, 66 # ymm0 =
ymm3[0],ymm0[1],ymm3[2,3,4,5],ymm0[6],ymm3[7]
vpermilps ymm0, ymm0, ymmword ptr [rip + .LCPI0_1] # ymm0 =
ymm0[3,3,1,1,6,7,6,4]
vinsertf128 ymm1, ymm2, xmm1, 1
vblendps ymm1, ymm1, ymmword ptr [rip + .LCPI0_0], 141 # ymm1 =
mem[0],ymm1[1],mem[2,3],ymm1[4,5,6],mem[7]
ret
trunk constant table:
.LCPI0_0:
.long 0x00000000 # float 0
.zero 4
.long 0x3eb5dbc6 # float 0.355192363
.long 0x3eb5dbc6 # float 0.355192363
.zero 4
.long 0x3eb5dbc6 # float 0.355192363
.zero 4
.zero 4
12.x constant table:
.LCPI0_0:
.long 0x00000000 # float 0
.zero 4
.long 0x3eb5dbc6 # float 0.355192363
.long 0x3eb5dbc6 # float 0.355192363
.zero 4
.long 0x3eb5dbc6 # float 0.355192363
.long 0x3eb5dbc6 # float 0.355192363
.long 0x3eb5dbc6 # float 0.355192363
I'm currently working on a patch.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>