<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/63507>63507</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [X86/DAGCombine] X86 backend crashes/miscompiles when combining mul with -1 vector splat constant
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          Benjins
      </td>
    </tr>
</table>

<pre>
    The following is a reduced repro for the issue:
```llvm
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define <4 x i32> @do_stuff() #0 {
entry:
  %0 = tail call <4 x i32> @llvm.x86.sse2.psll.d(<4 x i32> zeroinitializer, <4 x i32> zeroinitializer)
  %cmp.i = icmp eq <4 x i32> %0, zeroinitializer
  %sext.i = sext <4 x i1> %cmp.i to <4 x i32>
 %shuffle.i101 = shufflevector <4 x i32> %sext.i, <4 x i32> zeroinitializer, <4 x i32> <i32 0, i32 4, i32 1, i32 5>
  %mul.i = mul <4 x i32> %shuffle.i101, %shuffle.i101
  ret <4 x i32> %mul.i
}

; Function Attrs: nocallback nofree nosync nounwind willreturn memory(none)
declare <4 x i32> @llvm.x86.sse2.psll.d(<4 x i32>, <4 x i32>) #1

attributes #0 = { "target-features"="+avx,+avx2,+crc32,+cx8,+fxsr,+mmx,+popcnt,+sse,+sse2,+sse3,+sse4.1,+sse4.2,+ssse3,+x87,+xsave" }
attributes #1 = { nocallback nofree nosync nounwind willreturn memory(none) }
```
[Godbolt link](https://godbolt.org/z/T5h9dxTes)

This will either crash if assertions are enabled, or miscompile the function by returning immediately, instead of returning `<1, 1, 1, 1>` (or multiplying `<-1, -1, -1, -1>` by itself and returning that, which was the behavior in 16.0)

The assertion hit is:
```
/llvm/llvm-project/llvm/lib/Target/X86/X86ISelLowering.cpp:48816: llvm::SDValue combineMul(llvm::SDNode*, llvm::SelectionDAG&, llvm::TargetLowering::DAGCombinerInfo&, const llvm::X86Subtarget&): Assertion `C->getZExtValue() != 0 && C->getZExtValue() != maxUIntN(VT.getScalarSizeInBits()) && "Both cases that could cause potential overflows should have " "already been handled."' failed.
```

A bisect showed that this started happening in b6808ba291fcb5ff2e0d651e9e710f3d75631bc4, which added support for folding vector constants in multiplies

The state of the DAG at the crash:
```
SelectionDAG has 11 nodes:
  t0: ch,glue = EntryToken
 t30: i64 = X86ISD::Wrapper TargetConstantPool:i64<<2 x i64> <i64 4294967295, i64 4294967295>> 0
    t28: v2i64,ch = load<(load (s128) from constant-pool)> t0, t30, undef:i64
  t15: v4i32 = bitcast t28
    t9: v4i32 = mul t15, t15
  t12: ch,glue = CopyToReg t0, Register:v4i32 $xmm0, t9
  t13: ch = X86ISD::RET_GLUE t12, TargetConstant:i32<0>, Register:v4i32 $xmm0, t12:1
```

What appears to be happening is that `getTargetConstantFromNode` via `combineMul` in `X86ISelLowering.cpp` is detecting that the vector is a splat of -1, and tries to switch it to an add/shift. However, with scalars a multiply of -1 would usually have already been dealt with in `visitMul` in `DAGCombiner.cpp`: it seems like `ISD::isConstantSplatVector()` is supposed to catch this case, but it isn't (unsure why). Since the vector is a constant splat of -1, it trips the assertion
https://github.com/llvm/llvm-project/blob/0ddfb802e4cab9782d0b6dda6916e0062493f0cf/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp#L4308

I have confirmed this still repros on latest trunk, 0ddfb802e4cab9782d0b6dda6916e0062493f0cf

For priority/triage purposes: this was not in code I manually wrote, but was found by a fuzzer meant to test SIMD codegen
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJykWNlu6zjSfhrmpmBDomRZvsiFY8fnD9Dd-NFJL5ibBiWVLPahSA1JxfZ5-kGR8pb0NhggUEpSsdavFlk4J_ca8ZEtnthi-yBG3xn7-IT6d6ndQ2Wa0-Nbh9AapcxB6j1IBwIsNmONDVgcrIHWWPAdgnRuRJatWbJlyZoVSfxT6r2Pj7ywe_TQCC-UOJnRA8u2wDjHWc-yNc4GvkxYts54uNBten9LVJGHy0yeibakQykvZ7okojifKfLZa8pLxvmdfm_loPCs-1gWvxX5bNRftTnomZJ6PM72erycitcGW6np0CaHI0iS_wwsTxrzm_Nj2zLSswLGswTY8ikeQu3t6RIRAMYXSdDrhVRQC6U-C6RwzY9lMXcO-XxwSs0bEn7H9w2tkVp6KZT8hpbxDfwNw-rGhrof5jLYIet-APz3Ryv4IiGRH4VcJTg8-kkEkZfz6XQ8avDmXvAkgM53Y9sqnMs0SaOU-OAda2_sZ3Oivn_g5kcGlm1kxiG4Q0R-JtIzsbgaRpr6UU2O9eOn7NwbHrR9eDQJsug_nw2iJ0wtt7fgYtkT7EZde2k0rL23jmVr0IYQUon6K2jTWkTQxp10DdqM-iB1AweplEU_Wg099saeGC-10XhJd4O1EvYPYPtPUPYpmhPA01vThfdWVqNHN2Gfqmr5RJUVy23WovCjRUcFlW3pyp_E-5HxTSR4pGpbZ2fyWEaiPTobqb6fDgxmqLWPtHN4IfiFyi5UPk9v6AvHheVYLifCiXdknMMlL_dupRe3_qecXMVfmuN0u3j6YprKKA9K6q9ssWW87LwfCAeM7xjf7eP7ubF7xnffGN-9LbpVc3yjwK5uM_LWSResAJS-Qwu1Fa4D2YJwDi1hzAGBArWoFDaUZmOhl642_SAVhmbenuFYnSC6E7p_32MjhUd1CvWjnUfRgGlveMirbBOq4_aSPbMiAcZL0jUqLwd1urLPAteHazxSnUB6h6oFoZsbPb4ThAM4dLLu4CBcsLvCTrxLY0FqSIt58ik4eA0DdNKDdJ9H1nTLd2F2xX-zwZrfsfY3T2VFaQgoZ3z3a1nE68srqu_MAa3U-3k9DCxb52UZxhKEo9maZevX7c9CjQi16Sup8ftRMV7evv7BNMj4mly8eYwKQ1626y-MF_cvoyln1fHZdv1lEzXYF92a6UxttPM3J38ti9ex8pMrBQUtW8P6EihWJJsZy5736P_1fPTB8svES6k4KLUF4wX8DV8vjj-9aP8D4-XPb_M9-tdaKGFf5Td80U_Su8geTwSBjPMn4zuohUMXsg61GVUDtRgdwmA8ahoAYN7RtsocHLguMHTiHSGUNedCWRTNCSpEDZ3QjcJmHprRElohw90fgiBc11BJh7UnyQdsohWeCs15YT2SrmHAWCMaqqJMykrwVdrW1aJtOSZNsUhxhcs0abNmuSiytKrzK3xF02ADbhwGY33YqFqjGhI3jcSQMaG9I_lT_Uh0H7HtvPBI9Ui1sF1_gWAnxh7wZ0C_BRV0wkGagjYNupvVxdOOBXXH-GZPsKVcPtN682a-op64fBa4ZJGH96EWthFhv1gKkIWI0c3kzf8bo1i2DqvchmUbTrOGbuLkLnLI-SpfFUu-WoSGc_8keybO5GwjgKcRtoZ3TkL4pu6CHcqIhuTzkijqQS6NoGyt6S-hnQ1kDUH_mdzlm-AP38CoG2wnM8_hSBdBUU4rBOmopK-F88GCqzmreyZaKegkiU4XV1n8c2w3Zji9mR9xP5nyI-6l82hZtp7k8fzY99HM1VVUFkV9iv-Pz2-_ffnup-egjW8-5IGcoxG_Saa5_5fqgr3pX5TLL1QelG9hHW2BFd7Wx1TErEj26O_t2FnTh75XJPAuBfHc9MciIfCzIvmjJksvHTToCcrTeAjQnwoofLi4QQlP5RFnDA0UbyUGI91B-roD6elGaCpJxneuk62fw_-ZA77HBfMgfQcudC0SeZ5lUSocQucZ3SiUOsUOdNd6GhTKRxnRl3fppL_z7qZlT56FovLgEHsHSn5FYrukVrpz-F7JvZ-Dv1MbjVEJfcVR3zJQC_Iy9C7qqORRNXoIk1AzvvRUH6N2o0U4dCfGV3N4lbrGT8E8183HqMr4iRXn8WXYRmR8WGqk78ZqXpv-T2dtpQxN2aRp2qpMOOa1qFbLkjdJVTSNKFZpgUlS8HyVtUndfpzOG9PgF9SM7-4n5-5jkHn2XZ4l5S2KX2L6aqNbafvQ9UPDp9UqfPk6MBqU8Eh1b0f9lbz_x5beaNoZC4OVxkp_YnznrRR7hGG0lLXwLRBU046jjSeY1KZBeIFe6Ai0gzX-kkvia82oG9qdBLTjt29ooUfKlTcQ7H19-X4bpOxRPzSPWbPKVuIBH9OiXC7TZcnzh-5xsVzxsknLYlUusrTIknyRtFWW5k2athmuHuQjT3iWFHyRllnC8_miKupkKZqsaNJFmecsT7AXUs3DB4ex-4fwK8FjkS2S5YMSFSoXfnzgXONh-gmBc7bYPtjHAIVq3Dv6YJHOu6sUL70Kv1rEreuaTbYIfQ9oRUfdxMFHO_LuuuA6OHSop82LegX15VCSs_SM8IjpM8QfRqse_2vsBm9IdfD2PwEAAP__edg__A">