<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/59074>59074</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [PowerPC] Backend crash due to index out of bound when `lshr` / `shl` i128 vector after `sub`
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          HazyFish
      </td>
    </tr>
</table>

<pre>
    ## Description

When targeting `ppc64`, `ppc32`, or `ppc32le`, the following code containing i128 vector shift crashes due to index being out of bound during `PowerPC DAG->DAG Pattern Instruction Selection`.

The problem occurs for `lshr` and `shl` but not for `ashr`.
The problem occurs for `sub` but not for `add` and the result of `sub` must be used as the shift amount operand.
The problem doesn't occur for i64 vectors.
The problem doesn't occur when targeting `ppc64le`, `aarch64`, `x86_64`, or `riscv64`.

## Minimal Reproduction

https://godbolt.org/z/vW4YT3Ga7

### Code

```ll
define void @f(ptr %0) {
BB:
  %V1 = load <2 x i128>, <2 x i128>* %0
  %V2 = insertelement <2 x i128> %V1, i128 12, i32 0
  %V3 = sub <2 x i128> %V1, %V2
  %V4 = lshr <2 x i128> %V2, %V3
  store <2 x i128> %V4, <2 x i128>* %0
  ret void
}
```

### Stack Trace

```console
llc: /home/henry/aflplusplus-isel/llvm-project/llvm/include/llvm/ADT/SmallVector.h:298: llvm::SmallVectorTemplateCommon::const_reference llvm::SmallVectorTemplateCommon<(anonymous namespace)::BitPermutationSelector::ValueBit>::operator[](llvm::SmallVectorTemplateCommon::size_type) const [T = (anonymous namespace)::BitPermutationSelector::ValueBit]: Assertion `idx < size()' failed.
PLEASE submit a bug report to https://github.com/llvm/llvm-project/issues/ and include the crash backtrace.
Stack dump:
0.      Program arguments: ./llvm-project/build-debug/bin/llc -mtriple=ppc64 ./crash-reports/dagisel-ppc64/1.ll
1.      Running pass 'Function Pass Manager' on module './crash-reports/dagisel-ppc64/1.ll'.
2.      Running pass 'PowerPC DAG->DAG Pattern Instruction Selection' on function '@f'
 #0 0x00000000047db7da llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Support/Unix/Signals.inc:569:11
 #1 0x00000000047db98b PrintStackTraceSignalHandler(void*) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Support/Unix/Signals.inc:636:1
 #2 0x00000000047d9fc6 llvm::sys::RunSignalHandlers() /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Support/Signals.cpp:104:5
 #3 0x00000000047dc0b5 SignalHandler(int) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Support/Unix/Signals.inc:407:1
 #4 0x00007f3802601980 __restore_rt (/lib/x86_64-linux-gnu/libpthread.so.0+0x12980)
 #5 0x00007f38014f1e87 raise /build/glibc-CVJwZb/glibc-2.27/signal/../sysdeps/unix/sysv/linux/raise.c:51:0
 #6 0x00007f38014f37f1 abort /build/glibc-CVJwZb/glibc-2.27/stdlib/abort.c:81:0
 #7 0x00007f38014e33fa __assert_fail_base /build/glibc-CVJwZb/glibc-2.27/assert/assert.c:89:0
 #8 0x00007f38014e3472 (/lib/x86_64-linux-gnu/libc.so.6+0x30472)
 #9 0x000000000217ced9 llvm::SmallVectorTemplateCommon<(anonymous namespace)::BitPermutationSelector::ValueBit, void>::operator[](unsigned long) const /home/henry/aflplusplus-isel/llvm-project/llvm/include/llvm/ADT/SmallVector.h:0:5
#10 0x000000000217b0ba (anonymous namespace)::BitPermutationSelector::getValueBits(llvm::SDValue, unsigned int) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Target/PowerPC/PPCISelDAGToDAG.cpp:1507:21
#11 0x000000000217b469 (anonymous namespace)::BitPermutationSelector::getValueBits(llvm::SDValue, unsigned int) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Target/PowerPC/PPCISelDAGToDAG.cpp:1543:30
#12 0x0000000002179acc (anonymous namespace)::BitPermutationSelector::Select(llvm::SDNode*) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Target/PowerPC/PPCISelDAGToDAG.cpp:2674:9
#13 0x0000000002170d66 (anonymous namespace)::PPCDAGToDAGISel::tryBitPermutation(llvm::SDNode*) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Target/PowerPC/PPCISelDAGToDAG.cpp:3938:17
#14 0x000000000215b184 (anonymous namespace)::PPCDAGToDAGISel::Select(llvm::SDNode*) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Target/PowerPC/PPCISelDAGToDAG.cpp:5037:7
#15 0x000000000453dac9 llvm::SelectionDAGISel::DoInstructionSelection() /home/henry/aflplusplus-isel/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:1165:5
#16 0x000000000453cb1a llvm::SelectionDAGISel::CodeGenAndEmitDAG() /home/henry/aflplusplus-isel/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:936:3
#17 0x000000000453b4ed llvm::SelectionDAGISel::SelectBasicBlock(llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void>, false, true>, llvm::ilist_iterator<llvm::ilist_detail::node_options<llvm::Instruction, true, false, void>, false, true>, bool&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:688:1
#18 0x000000000453af8b llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:1603:11
#19 0x0000000004538536 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/CodeGen/SelectionDAG/SelectionDAGISel.cpp:467:3
#20 0x000000000215ad79 (anonymous namespace)::PPCDAGToDAGISel::runOnMachineFunction(llvm::MachineFunction&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/Target/PowerPC/PPCISelDAGToDAG.cpp:167:7
#21 0x0000000003597c35 llvm::MachineFunctionPass::runOnFunction(llvm::Function&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/CodeGen/MachineFunctionPass.cpp:91:8
#22 0x0000000003c7f5e6 llvm::FPPassManager::runOnFunction(llvm::Function&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1430:23
#23 0x0000000003c84412 llvm::FPPassManager::runOnModule(llvm::Module&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1476:16
#24 0x0000000003c7feb9 (anonymous namespace)::MPPassManager::runOnModule(llvm::Module&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1545:23
#25 0x0000000003c7fa2d llvm::legacy::PassManagerImpl::run(llvm::Module&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:535:16
#26 0x0000000003c846f1 llvm::legacy::PassManager::run(llvm::Module&) /home/henry/aflplusplus-isel/llvm-project/llvm/lib/IR/LegacyPassManager.cpp:1672:3
#27 0x0000000000d2566c compileModule(char**, llvm::LLVMContext&) /home/henry/aflplusplus-isel/llvm-project/llvm/tools/llc/llc.cpp:737:41
#28 0x0000000000d23a12 main /home/henry/aflplusplus-isel/llvm-project/llvm/tools/llc/llc.cpp:418:13
#29 0x00007f38014d4c87 __libc_start_main /build/glibc-CVJwZb/glibc-2.27/csu/../csu/libc-start.c:344:0
#30 0x0000000000d2321a _start (./llvm-project/build-debug/bin/llc+0xd2321a)
```

## Cause

Not sure about the root cause, but the fact the following line returns the shift amount `4294967232` (`-64` represented in `unsigned`) is wrong and caused out-of-bound access to vector in the following code. 

https://github.com/llvm/llvm-project/blob/af029d383a24ee454e1124f64f3427d5b79e5f7e/llvm/lib/Target/PowerPC/PPCISelDAGToDAG.cpp#L1502
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzdWtty2zgS_Rr5BSUVCfD64AdZSjLZimddiddTuy8qEAQlbiBCRYC-5Ou3G5TES5SxJuPEqU05IgkC6HO6G40GwEznT5cTyuCPLKURdbmzpa4m3nLizdvfPzayIpbXa2nLak0mkbfbiSiA64Qu9o-M7h91fSxRcl9mN5IUWin9gO2FziX8VJaXFT6XPk3IvRQWmppNWVgiam420pC8kcRqUla5fCSZxMq6sUQXJNNNlcP7eg_oRj_I-mZBlvN30wl7Axdyw62VdUXeV8bWjUBS5JNU0t1Bk1mf4i0g3NU6U3JLtBBNbQCwY6LMpoYL4SAPrmaj8CkDGJW2h0q8rTR7rjPTZKda5_lBAmqqlqZRjmXXYtsYCxogjZE54cbVa3XFt6AKqL2TNXRwAkGupakmNLYtFie0jIK9xs0ZLR5O2_9oXqTAa7Hpu8RjEq2Ozy3NujTi3pUNVL_3vWtwhi1X5KMEGHlrr361jbU7M2FQ_S38rXWeaWVnul7D0xf4f_9H8O9b9o7HX_eN3S_A6QZvAJn7U6otyGVRVpLc6xLsHHjFhCY7C7hpCBRSMomv2npXVwjC3RJ8e-eTCVsSpTm0YwtKHp1DgxM6TYxK5m2HvebUNS8rI2sL3rmVYMxhq1YK9uZGik_dLaNk0A9z_YC7fLO1k9ZvErTIwXdPtaGHNuzQxoC_yFNVg-ep1tI63e61Hy9HZjhttU-Wi8_ktubitPEgihit9u-UEmAakPp2o7cSL7Kqn-DKC7VTjcH_09JIBUVK3W-n4Gj_hUGwf4RLWQnV5LIrmC9v4fcT-KW6c8NltgERNE1QkKsDvsDmvQq3crtT3MqF3m7Bgd1rRGlXtSxkLSshz2u4AAfkla6eYHwbUvGtNDtUA03bplelvZH1trEcR0ob2HTdvrvjqpFQAe3gClx0wNfh1SRcQs9nYzflF7myTzsUTBwRAp3cOs95CYSABlQ5N-j-GKHBqGX-iM5EUDSIwP5oTApeKnmIbzcf3sw_vUFv35YQAiGgrsHDdrq2OF-MQkVpN002E3rb2XVk_tKYRhq4cTF47wUuxrqZiGTghRadcC--dcu82e6OsQBjWnpT63XNtwRCZYMDGUGQ2dfysqZU-TSXABufyspVEWS6tTD9gj-zpYuwrq2DMG3ZIcacr9GJp-0cTN_6s0MI8xHDx6Zys-qOGwMWit82VTv33WDBNa_4WtaoUCjaQqBVEmudLQirOmH0lLC_PA23OIoDRnhuY-8-ikMB84j36B3-BXGexTnvDSHzZNqbG8gFrLNMGy_6Tl7zh5UG-ZKD9SMXPyvrwvr3BwtVZhgbmh3qC-7-VZWPWFCuK67MDLwIBIcRDgbf7-j4YzppkpER9raP38AZFdoqcYGTzn8G4IhFCLjDS0d400JEp9QPrjCAbdqh-5KAD0jFDsed7wWo4A4pGyEVXhaSsSp_kt0DLx6qMdiDiwuWeDTy_DTxyAomBTepriBwOX3te2-zp6kqq-Zxuq6a9sXObsCD85nRM8hJrrxHH2YizE46MWFfjB8UvkxiUnMgRA5xB0MidCami7t_PPwnOz7SGYw6-tY4HnAzw5gA5s3lDqNB09KEgnuHBpDB1XU9c57uw4_XIYlGSFhc-IRn2jE9D4nNW224Vk5IMhISD4VIxgoOWuVuOlnhlLHK-Pnc23bHm1ZkOhSZjEUGMT3DdgKtFjmrMXBOOrBa2vdc6sdC5ulPzBIgHLoI881soanQK2DloXS17iUCPzzT8roRjqHTG-kp8zL-d7IQWNAclGCGSdHSlaNmjtxfKnLcuoUU3OwnS7y7WbwHZDBd3mr4OQS40AUR6ncK8McKCKL0_1kBAYML8zoF0JECUi7E31FA-zSi_juuFV9ouj2bLI1inM_SjisbcfXyKHqOK_R96BdltIW2fhrq4Ffgy1KGqyg_7ggHQ8Jh5ifBdxH-dawaegzHcI9kOMhSQpZzMYj1h9R4QGipe-lzL3t-mQwL90beSVyE9KWPHhHMYVz6UTgMzNGIlMh8_iypvdh5lb-BVZyT-Dp8Upfzso5OPKKTBTj3PUOnLb3iphRXSovPA_crVWnsqrT7iZUtxq9yaSFbaUsqwL_SbhvWDKr2nMBtq9ZthC4g75T9Wbxf5iq1Zb8YnExr5VZjr2DyKEm6_BxNnoxMzgtYlp1n8rlSndWH0-hx8e0Sptci60ce661CkW46opuELHqWbt1U_6yuudiUlTwwG9D96t3r8A2ieDCe6ShvDHkeP5s2nZxYXksD56dM0XC6oYOMkYVpLGCN-E28uEfUY3qS4o-z7gkwhwiN676kYzVIA5mIi1D23ReUA20Pe10_mc_7j_DzQa65eOqhONgnYLimoT3nZEMuSRBAlvs8l2u3dzd0vn3RT-ERu32iqOMRjG0is2cH2fWvSS4MwpGRwjE5TvsZgXI97QNH1997WKwfWb0Wm5CFI0tFY4-LCv95Mq9OBGIbHcb1QZ7m5TSMIgFT7XZXKnl0IbHhtcv758Mc6MOHu-uFrqx8fIGJ2UIuY9yjaH_3mGOX_gfdzEuTEWbGYbhveVn9CPGB79KcnsrS4fZVHogkJqsV7lCtjOW1XR2wnLNhJgxub7mdwvbWvXT9uM0zFuCatlu_DzfzkT2FhUIrGGPF-WclbietbX_cSvuTw0Sy4I0ZnCH-ri0xTS1xT7Kx7cG7hjLhKmJ6ui8tuLCjLxgUnhTX0jZ1deIoHgAENA1ScFf3VYTbHYy8qTv6xmOqWhoJfoc7Klj5sMHiDstTUhryUGuQgmdRDk2OXz1MdTFtv3rgQkhj8KBr_9EEdPP1FxYz8ien588fiWVKu63XwqNpzhLGaSBlEAbS92lQREHBAhrnYRanMizi3kbeX0pYKPvghx69kJd-BCk5dJ14F_kly1OW8gtbWiUvJ-HVoZNwSa64-CxRMe5gbvCByODTEPfNQu_zDQDQ-3yj_8kJL2AZ1H1qcdHU6vL7TxDD1IuDi80l57QQCUtZnBWJLyRPizCO8FwiSjIWZReKZ1IZZDehtJIPxHUB98DyorykHqW-7yeUeT71ZjLLCyZSGECSRV6RTgJPwkBVM8SBX0Fc1JcOEgwTAy9xEWe6lxBL0cWcMrF_3tiNri9_41-eAPrmwsm-dNj_B05mGvM">