<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Issue</th>
<td>
<a href=https://github.com/llvm/llvm-project/issues/57326>57326</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>
AArch64 SelectionDAG crashes when lowering `shufflevector` if Mask is `undef`
</td>
</tr>
<tr>
<th>Labels</th>
<td>
new issue
</td>
</tr>
<tr>
<th>Assignees</th>
<td>
</td>
</tr>
<tr>
<th>Reporter</th>
<td>
DataCorrupted
</td>
</tr>
</table>
<pre>
When `shufflevector`'s mask is undef, AArch64 will have out of bound read on the latest commit `cfd2c5ce`
You can check it out here: https://llvm.godbolt.org/z/9xEPWa76c
On LLVM14, it reports as `Invalid shufflevector operands!` and treated `undef` as a uninitialized vector.
It seems problem starts at [`AArch64ISelLowering.cpp:13391`](https://github.com/llvm/llvm-project/blob/main/llvm/lib/Target/AArch64/AArch64ISelLowering.cpp#L13391) where the Mask(undef) is taken and used without any sanity check.
Below is a sample input and corresponding stack trace.
```
; ModuleID = 'PoC.ll'
source_filename = "M"
define void @f() {
BB:
%A2 = alloca <32 x i16>, align 64
%B = urem <32 x i16> <i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1>, <i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1, i16 -1>
%S = shufflevector <32 x i16> %B, <32 x i16> %B, <32 x i32> undef
store <32 x i16> %S, <32 x i16>* %A2, align 64
ret void
}
```
```
llc: /home/peter/aflplusplus-isel/llvm-project/llvm/include/llvm/ADT/ArrayRef.h:256: const T &llvm::ArrayRef<int>::operator[](size_t) const [T = int]: Assertion `Index < Length && "Invalid index!"' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0. Program arguments: /home/peter/aflplusplus-isel/llvm-project/build-debug/bin/llc -mtriple=aarch64 PoC.ll
1. Running pass 'Function Pass Manager' on module 'PoC.ll'.
2. Running pass 'Interleaved Access Pass' on function '@f'
#0 0x00000000030fa65a llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Support/Unix/Signals.inc:569:11
#1 0x00000000030fa80b PrintStackTraceSignalHandler(void*) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Support/Unix/Signals.inc:636:1
#2 0x00000000030f8e56 llvm::sys::RunSignalHandlers() /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Support/Signals.cpp:103:5
#3 0x00000000030faf35 SignalHandler(int) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Support/Unix/Signals.inc:407:1
#4 0x00007f315691a980 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x12980)
#5 0x00007f315580ae87 raise /build/glibc-uZu3wS/glibc-2.27/signal/../sysdeps/unix/sysv/linux/raise.c:51:0
#6 0x00007f315580c7f1 abort /build/glibc-uZu3wS/glibc-2.27/stdlib/abort.c:81:0
#7 0x00007f31557fc3fa __assert_fail_base /build/glibc-uZu3wS/glibc-2.27/assert/assert.c:89:0
#8 0x00007f31557fc472 (/lib/x86_64-linux-gnu/libc.so.6+0x30472)
#9 0x00000000010f1ef9 llvm::ArrayRef<int>::operator[](unsigned long) const /home/peter/aflplusplus-isel/llvm-project/llvm/include/llvm/ADT/ArrayRef.h:0:7
#10 0x000000000142a4fd llvm::AArch64TargetLowering::lowerInterleavedStore(llvm::StoreInst*, llvm::ShuffleVectorInst*, unsigned int) const /home/peter/aflplusplus-isel/llvm-project/llvm/lib/Target/AArch64/AArch64ISelLowering.cpp:13418:42
#11 0x0000000001d26493 (anonymous namespace)::InterleavedAccess::lowerInterleavedStore(llvm::StoreInst*, llvm::SmallVector<llvm::Instruction*, 32u>&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/CodeGen/InterleavedAccessPass.cpp:511:7
#12 0x0000000001d2580a (anonymous namespace)::InterleavedAccess::runOnFunction(llvm::Function&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/CodeGen/InterleavedAccessPass.cpp:541:18
#13 0x00000000025a2256 llvm::FPPassManager::runOnFunction(llvm::Function&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1430:23
#14 0x00000000025a7082 llvm::FPPassManager::runOnModule(llvm::Module&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1476:16
#15 0x00000000025a2b29 (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1545:23
#16 0x00000000025a269d llvm::legacy::PassManagerImpl::run(llvm::Module&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:535:16
#17 0x00000000025a7361 llvm::legacy::PassManager::run(llvm::Module&) /home/peter/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1672:3
#18 0x0000000000c744b0 compileModule(char**, llvm::LLVMContext&) /home/peter/aflplusplus-isel/llvm-project/llvm/tools/llc/llc.cpp:737:41
#19 0x0000000000c72832 main /home/peter/aflplusplus-isel/llvm-project/llvm/tools/llc/llc.cpp:418:13
#20 0x00007f31557edc87 __libc_start_main /build/glibc-uZu3wS/glibc-2.27/csu/../csu/libc-start.c:344:0
#21 0x0000000000c7203a _start (/home/peter/aflplusplus-isel/llvm-project/build-debug/bin/llc+0xc7203a)
Aborted
```
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJztWVtv47YS_jX2CxFDInWxH_zgJJueAAkabNIt2heDlihbpxQpiFTi9Nd3hpSjy6Y92UvT81DDsiiKHM58HM43pHc6f17_fBCKzJLAHNqikOJRZFY38DyjqSEVN7-R0pBW5aKY0Quy2TTZIYnIUyklOfBHQXRriS7ITkMb0gieE62IPQgiuRXGkkxXVWlxhKzIaRZnAoUHl7Ng84tuScYVyQ4ig2Gsk3UQjZixDTlYWxsozOgVfKV8rBZ7ne-0tAvd7KHqd7hWxw93P_M0ybxA__ujIjc3n27DCBUGqY2odWMN4Qa1uFaPXJY5GdlLdC0arnIzoyG0IVAkFoyxIsc-3nysBykARqlKW4KU3-G1F7AYKnBtiRGiMqRu9E6KihjLnQIAQ3wOcjoUr--FvNFPoinVfpHVNVgbMrZCDWbx5YwuxxjsS3todwsAtAOku53BMP8FLeBxJ_UObhUv1aBNiXUPvNkLbNMN3pc-U4OyG68HXZEnnA83n7fgC6BT5wordAvLfwPnQbBaA1A8gYI4hVw9E8MBo2c_tSNwzoXUT9iZQ5uqloKUqnadcvCVphGm1ioHVRA1cAvb8EyMJCA8_usf2Tm51XkrxfUlmTG4aHqnLxZSQsE3MbptMrEtSikUr0TXit7CNRQMhpVKkEcN7jGLArByiYbO0vNO9XOcC1ck0D_eUCeJS6kzDsULRsmRlGEyYx_Q98BD9ooA1H2Xc9ejbcApxu3xEUrkLHRe-2_pS0se8n9R_GYUe2e9d846DpRTrwWX7nD_y2pGsdrHjm4AA-LEKx3vP5c3oxu_3l5bVY2wbsl2Kzm9fD1KvFYpZYZUA6HwoCsBt1pY0cCdF7KWrcHrrDRCfh5pu9haqky2uegrNpcP-Ns0_PmjKBYHkE_jBEfJtAI6fIDREtcWQgnbnBqi3yqLprpqR0fIwwCjYwIDXLO1GI28GHjx4GYHe0ELkL8xRjS21MqzXC6OiCK5EWpvDzgqfDHqnQiwxCbIdxAEaUoKDtEx7wLt3c2Hzf0HYtodcjcnu3bf0SixmnwxLZXGtAK49cpF-Q4zRypZw82B7CDQD-P8vYv8eVvVLwE3WBD3uWv0vuEVATZrK6Gs-doJ3LWlzM9yAabhU0eYGTmrbFMCLQG4nPtkp2MTp0fY6fGxVQpJqubGIONctSpz4N9hxS1XfI-KpJgNVY6dRrzUGUr_RNq1AjOkgPwqJ5ssE1CLcjt5xWksJDjHUx3PQQULSHAMTh8WFDyJOekdzjwbX7gDurcO6AdEHnysb9Twp602mABVzm8unJshFX79SvFZyH1boxdB6SdVHrECFjOXZgFOAQPHyQqToLA3J5yaswx2ZKK7l_Ef8C2JOi1dNKCb91A4Ybi2B_rSib5LESevwQ8zPlLbnJKN76fwSdMuswwYAtxryqbIFiwmUyjfad6jIB3DGHXKpQULwSlCvloGZLuF7BBZYwtxyOHVST8uk20SnclStcezvWr9i9oecD-yMHoBu5nz4BhSkALm9MPEw2HiZcDFMiUNB4PIKURghANh2Vn7a8ue7l8e6QJWHb0yzg4oLBb49GxyUWOka72ZUPHotAHN4O5EL5ynA9dugl6TZKJJlhYh4TvtLH2bJjb3aLhebpDlZJB0NEhaZKzggCp3zLFFBtju-Ntt9_1eCn7I1XjI5XTIKKVvmLsMZy1xs8YC6DKatdXQc8OgCEWxIl_Oqa3CyYMIK7XaD6j1780GAri6cI3hbRSuw4jyqMiHtvgtmt-8nTZp_pXEpwFR3OPKGIVxV3MNNrlgeDEQe-9zuk8upxu0eIGkW_ffjMgX7z1xCxyFS4wJtEdpxAJhTpNoxdCLuNLqudKtIbivM7UjspW3cQCNp9DvAFsFez0PGjhXX4-Nm9ZxcteH0dblrcl3iZ4XOhc_CMxQPjMK04IOuDgMx75FJ6hhgPtK1JpW_ahOOc4Irb7yXW2N0FbwkxdjR3RGY07piHiv7rD3KS97Z5uuP8LPjdjz7HmgxcnfI4YxgbLelmhiSxos6Rts8acgI0tOVe9iR-pyoaS3I57Oyc5p8ZcOePv_aVwcxZNJSqbGJath5JZOUpdr9_Kuq1q-WPVPWROzeDJT6dTjWBL-b2P-cUPCBFIDthnMynJoCGRRUbQL8Ay6ht3tiwtlB964QD2J73hsfKEh7Bztt6tvtZbGPWb-t9M5ZZjrRmGv82qiM13CNgLPcP-O4T25hj1kNBinaCLPIAnebjEL27qT6-1Jl7ckhZlpT9mwL7qXTo5LEFkU9RkiDh9OrQ8YJKWuQ5cofq-9vUsn_QAv-eQGk2WRT46H5mIdJknIAraK4nm-ZvmKrfjcllaK9ek_EEhdhKOJy80P_iBDGDwvV0R2Gc1r_6uQsnBH6XgEPvhrYd42cv31BytxymgyP6xZkguaiSzIspBHcb7MRJLHKQ_DMBIsKuaS74Q0a0yCKVUCT-JBBJ4BxZfzck0DSoFsoiAMV0G0WLLVEvYIIs3zOMc0PAoEOINcuP9jdLOfN2unEiBt4KUsjTX9S1ivmE6Ktc-557y1B92sL7nlF7pp2hqQnzsF1s6APwCRkeW5">