<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/81136>81136</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [X86] X86FixupVectorConstants - rebuildZeroUpperCst / rebuildExtCst - incorrect handling of load vs constant pool entry width
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            backend:X86,
            miscompilation
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
            RKSimon
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          RKSimon
      </td>
    </tr>
</table>

<pre>
    Fuzz testing has found a case where if a vector load is loading from a constant pool wider than the destination register width then the bitwidth is incorrectly calculated. For rebuildZeroUpperCst this shouldn't have any effect (other than possibly preventing folding), but it will cause rebuildExtCst to use the incorrect extension scale.

I have a fix and will commit shortly.

Reduced test case:
```ll
define i64 @negmsk(i32 %a0, i32 %a1, ptr %a2) {
  %v0 = bitcast i32 %a0 to <2 x i16>
  %v1 = bitcast i32 %a1 to <2 x i16>
  %cmp15 = icmp sle <2 x i16> %v1, %v0
  %conv16 = sext <2 x i1> %cmp15 to <2 x i64>
  %shuffle29 = shufflevector <2 x i64> %conv16, <2 x i64> <i64 128, i64 1>, <4 x i32> <i32 2, i32 3, i32 3, i32 0>
  %data = load volatile <4 x i64>, ptr %a2, align 32
  %cmp65 = icmp ne <4 x i64> %data, <i64 -2071602529, i64 -1537047284, i64 717942021, i64 597457239>
  %cmp67 = icmp ne <4 x i64> %shuffle29, zeroinitializer
  %and = and <4 x i1> %cmp65, %cmp67
  %mask = bitcast <4 x i1> %and to i4
  %cnt = tail call i4 @llvm.ctpop.i4(i4 %mask)
 %cntz = zext i4 %cnt to i64
  %res = sub nsw i64 0, %cntz
  ret i64 %res
}
declare i4 @llvm.ctpop.i4(i4)
```

17.0.1 (note that we're loading a 128-bit vector from a 256-bit constant pool entry):
```asm
.LCPI0_0:
        .quad   128 # 0x80
        .quad   1                               # 0x1
 .zero   8
        .zero   8
...          
        vmovdqa .LCPI0_0(%rip), %xmm4           # xmm4 = <128,1,u,u>
```

trunk (note that we're now extending from 8 -> 32-bits instead of 8 -> 64-bits):
```asm
.LCPI0_3:
        .byte   128 # 0x80
        .byte   1                               # 0x1
 .byte   0                               # 0x0
        .byte   0 # 0x0
...
        vpmovzxbd .LCPI0_3(%rip), %xmm4 # xmm4 = [128,1,0,0]
```

https://simd.godbolt.org/z/aq7rK8cEv
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJyUVkuP4ygQ_jXkUoqF8TOHHGbSE2k0e1jNalejvaywwTHbGDyA00l-_Qpsp-1-aTbqtOOivnrwUUVRa8VJcb5H2WdEyPdvf4hOK0QIyh42dHCtNvtJuKk0u-6Pw-0Gjlsn1AlaaqHRg2JAoaaWw1PLDQfRAIUzr502IDVlIGx4ekhjdOe1tbKOKge91hKeBOMGXEsVuJYDC-apE1qB4SdhHTdex7V-edSphBslwoJQtTaG105eoaayHiR1nEVw1AYMrwYh2d_c6D_7npuDdeBaYcG2epBMIVI4aOmZA1VX4E3DaweIlNq1c0i9tlZU8gq94WeuQuaNlj4dRHaIHKAaHAgHT0JKqOlg-ez2y8UFhxq80Md9jxX4xXFlfY62ppJHCD8g_Gn8_3UKCRpxAarYZFp3nXA-cuPkdQX4ztlQcxaYCVSgZFpBOR7_pBwFjDdCcRB5CijFip86-4hIKRICiGQU-4Tml9i_9M6EF4LIDlDxeTQDXnbGgJIHT0ZNrbvDsM8YJQcCFxBxjpIvS0z8Jib-CFN3fZwFmKi7Hqzka9XRrg82BLVEanWO8wC1_OKeYRNqtLxwnadr17YdmkZyn7q3Mb5Nh3uFefYW4lgvJQe_3zEpw-76n97LqJd6vYTMegkBMnOQvPqB19Ex6mgILNTZWUvqxLg56XMyaw4PQKU4KUjIeoPzxQarFyZmV1PEPoEtwUWcY5KNJRBEcZYUOC1Imc6iIi52KcEkngXZrkizgiS7VwTnxcf-70R4UzdutFDCCSrFjZuFJV8t3s74HG0syM6z6ZQEjwtcR-3j6mC-BHuDToNIl2ErFzCOCl_5UoIIVSXluYtq1-s-EqkvrnR24TvGiB_ht4C_-aM5KnmT3k2-9GO4HY_fUIGyT2En8ZyIcrdZ1XA3FnaATA2geJgLv5bUt-d3QryHdm8Zyw4TFxGOYt8alXa-l1EHTxyRwvB7c6f-hG8r4ebuP3V7kuVBuu76XDlz9U5ftSpqu1ES_Xb4_Sv-B99VYPpEPwfKALw_QCQBfCnxOxrw8WdExxM48gcLAMoXxtbiKIoWBlaa506f2U8K98h9yWdG9NNVgUh26br0RQBB5AlGyWFsEr5ghvCd6-RNVpwZ1OPbpCj9NN4xz_duCVt_mBPi2fD3pnWcMtDNvJKnYeWXSElek1JdHf-YlFnj_5EyofAvod5xidfLURS9IK7v9Pl2qRjc83uHujVh2ednwnD4Zg8fENY611u_c-SIyNGKjkUnzSotXaTNCZHjDZEj_VmYb2X95bxh-4Ttkh3d8H1c4CLFmKTppt2nWdnweEd3Mc7KhMVVGu9wVue7jFR5RthG7AkmKSa4jJMMp2mUcIZrRjLGsoQ0dIdSzDsqZBQagTanjbB24PsyjpN8I2nFpZ2mworWj1wxlHz6UeZ-NiQHREgnbK27XsgwqE0jo9l7c9tqOFnfY4R19tmBE06GSdObyR7gR5kfxWXo_wrN4jA1BwvbN6c2RI4vxqrtYppqqWLSH3TdTHehfavdjGPkZjByv2biJFw7VFGtO0SOPuLpse2N_pfXDpFj2B-LyDFs0X8BAAD__9BDIEk">