<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/217964>217964</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            [SDAG] Divide-by-zero crash in visitSUBSAT when usubsat is given known zero value
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            confirmed,
            crash-on-valid,
            llvm:SelectionDAG,
            generated by fuzzer
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          Benjins
      </td>
    </tr>
</table>

<pre>
    Running `llc` on the following IR:
```llvm
target datalayout = "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128"
target triple = "x86_64-unknown-linux-gnu"

define <4 x i32> @do_stuff(<4 x i32> %v3) {
bb0:
  %v5 = xor <4 x i32> %v3, %v3
  %v7 = call <4 x i32> @llvm.usub.sat.v4i32(<4 x i32> %v5, <4 x i32> %v3)
  ret <4 x i32> %v7
}

; Function Attrs: nocallback nocreateundeforpoison nofree nosync nounwind speculatable willreturn memory(none)
declare <4 x i32> @llvm.usub.sat.v4i32(<4 x i32>, <4 x i32>) #0

attributes #0 = { nocallback nocreateundeforpoison nofree nosync nounwind speculatable willreturn memory(none) }
```
Godbolt link: https://godbolt.org/z/TovMnh5zT

will crash in `DAGCombiner::visitSUBSAT`:
```
0.      Program arguments: /opt/compiler-explorer/clang-trunk/bin/llc -o /app/output.s -x86-asm-syntax=intel <source>
1.      Running pass 'Function Pass Manager' on module '<source>'.
2.      Running pass 'X86 DAG->DAG Instruction Selection' on function '@do_stuff'
 #0 0x0000000003c44798 llvm::sys::PrintStackTrace(llvm::raw_ostream&, int) (/opt/compiler-explorer/clang-trunk/bin/llc+0x3c44798)
 #1 0x0000000003c4183d SignalHandler(int, siginfo_t*, void*) Signals.cpp:0:0
 #2 0x00007c58da245330 (/lib/x86_64-linux-gnu/libc.so.6+0x45330)
 #3 0x00000000037f1603 (anonymous namespace)::DAGCombiner::visitSUBSAT(llvm::SDNode*) DAGCombiner.cpp:0:0
 #4 0x000000000389c088 (anonymous namespace)::DAGCombiner::visit(llvm::SDNode*) DAGCombiner.cpp:0:0
 #5 0x000000000389eaa3 (anonymous namespace)::DAGCombiner::combine(llvm::SDNode*) DAGCombiner.cpp:0:0
 #6 0x00000000038a0365 llvm::SelectionDAG::Combine(llvm::CombineLevel, llvm::BatchAAResults*, llvm::CodeGenOptLevel) (/opt/compiler-explorer/clang-trunk/bin/llc+0x38a0365)
 #7 0x00000000039e0192 llvm::SelectionDAGISel::CodeGenAndEmitDAG() (/opt/compiler-explorer/clang-trunk/bin/llc+0x39e0192)
 #8 0x00000000039e260f llvm::SelectionDAGISel::SelectAllBasicBlocks(llvm::Function const&) (/opt/compiler-explorer/clang-trunk/bin/llc+0x39e260f)
 #9 0x00000000039e4035 llvm::SelectionDAGISel::runOnMachineFunction(llvm::MachineFunction&) (/opt/compiler-explorer/clang-trunk/bin/llc+0x39e4035)
...
Program terminated with signal: SIGFPE
```

Looking at the code, it seems like a known-zero value will have `ActiveBits` be zero, and `NarrowBits` will also end up as zero, which leads to a divide-by-zero crash.

https://github.com/llvm/llvm-project/blob/4ccc07bc4d106cbc800be1fa2bb9b0dd456369b5/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp#L4726-L4730

A bisect confirmed this started happening with 9584b932c86d8c234856c13a185bc02d8afeb317 (PR: https://github.com/llvm/llvm-project/pull/206592 )

I confirmed this still happens on latest trunk (0c8f1121a2bb2095227dab641e66e5ea4c238e87)

Not sure what the code should do in the case of a known zero: I'd assume just skip it and let other passes take care of it?

For disclosure: this code was found by a fuzzer that was built partly using LLM generative tooling, but this issue and its analysis are done by myself and I manually reproduced the bug to verify its occurrence

cc @sipher-01 
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJy0WN1uGzsOfhrlhrCh0fxf5GIS19kAaU_RdIG9KzQa2lajkQb6ceI-_UIaO4nTnD172t2iTTWiRH6kPlJUuHNyqxEvSXlFytUFD35n7OUV6u9Su4veDIfLL0FrqbdAKqqUIBUFo8HvEDZGKfMYRbdfSN4R2pGKzn-V2o-Edp7bLXoYuOeKH0zwQPIVEMZwMZK8w8XEakryLmfpR_zMzj_jqCrSj4V8HmSsIXmXsWaxaehxpNNUddpeFYv7uIyxFxzeyknhCcNTU32rikXQD9o86oWSOjwttjrMWwjtBtxIHZdfF_AEMqr9AKSgg_nmfNhsSERxJmPlPiesBVJfEdr1PZ3DAklSJsNPxr7VOO-6Pg5Oy-u0XHClfkYQw7sMLvRLx_1yX0TJe2DKpPZdjMmORf-OuI7u16s5CCS_gnXQwkujofPeOpJ3oE0E1nPxEIcWucegB9wYOxnpjAZtNhYRtHEHLUCboB-lHsBNKILinvcK4VEqZdEHq2HE0dgDYY02Gmd0AwrF7Tvh_y-c_8ntdCgsp7NP3Hsr--DRpcmZEPXV_90rOEb1lCWEdjdm6I3yoKR-iIHdeT_FCBO2Jmy9naVLY7eErX8Qtv5q9h_1rvzxdfYkGgNhuduB1DFDV93NtRl7qdFGLXm3l076-39e3Xdfo8XzNCW0o0tC28_WbC0fgdttGFH7dMaErc3kCVsLM05SoV3g06SMRRvnFNfbhbdBPxC27qUmbK2UgIWJ-_g0xd3BT8EvHSyemmrB3bhwB-35E8lXUntMvHYmWIHxhGiXRSinajNxF0-nfube5zjxkWu-jQDqWIRGM4SYz6w-08TqJaEde0_bv5oKVt3NguQfVt0N3GrnbZj136PCNDoq35wMR_Wvkz6mx8wb-kRPf3JRFHXbQCp8KfDu4ObBZyu1v_dcPHy1XCBhzcsiyx-_Gect8pGwKtJWaj-TtfmV-BN2RZ-OWI5JTlievUGaNfkA93KrufoH14OKGptk-Bqc3Eq9Md88YV383hs5pGF73OGWYppI3tH0bzbAjgZqUTYDZ0WZx6xKLijZE7Y-1tpXNTYKxNKZZZUwpy0viPMzxPUmq2geFXJt9GE0wYHmI7opxbOdY_kfqf866PerT2bAo1Ovdr3jWHGGo2kFbZpfw_GrCMo3CJDzvx8JMX_9KobqHAOneVW-Yvpz5qy6m3nm-h17x7k73KOKxHqRXHEvdl33BV1Q3h1593rjgDeo_5j8ce9vZseM_4Vr9Zl3LdKsZX_i3e09qjNQnR4-jNJHxyOk30Q2235B1rxBxiq6-Utk82yn1BV3UlwpIx7c2UE8V1RhtPOp7Pw27ojsBXf7BndB8z_jywtuG_Qf-iMXO6nxBPEM90-y_wXwCG0GvlzGW-N0E3q0o9Tc4wCP0u9iWdQ8IoX725v15w9vblFCuztjHuJVw31qjkVKrmuQHhzi6EDJBwQOc7P5A62BPVdh7hdgx_cYr-9OeLnHK-ld7LN7hLgwquF6iPJP3FrzeJKnrVw5A6gHCBNw97zhcSfFDhTywYE3wGGQezngoj_MxlPTsJyhv2k6pN-FfinMmEK1P_23mKz5jiIGulcmVvVCCEHrXhRDRivRi4bSHrMNZ33f9nQYirLKq7YvX-lJt8ExeQhbn5UOtn5bhlh-V9SsWtwV9al366CXDoWP7N1IO-IAficdOM9tPK0dnyZMd346t7Zsir7NmWiqoREsL5qyElnOs6bsBWVDwzfY51kdefT5yzsd2F8HYwpKEbZmtCpbBjOZCO1uf0Y4n3TE52KHobhHF18lQT9E-1Q0myxjWYwfo23JWD3wvioyrCoskReC5Q029bOJT8aDCxbhcfeKdeB2JqgBBhN7wjTLHYLZnNg3cyTv4JawegDuXBgRvgfnwT3IKVI20k2hB-N3aFP3hA48f4i6bNIlPcnXM4y1sTBIJ5SJYKLi5G_C8sgdbEzQA_QH4LAJP36gBR_xRlEfpPIwcevVAYKLx3Z39xG2qNHymArgjVFSbyOl--BnzdK5gAmj9A645urgpIOIbDAao6nx4FBt0ppbGLkOXKkDWJysGYJIR4LQh23MjT1auTkkXUaIYC1qgbNrQsQXh5PTDu2CZnAxXOZDm7f8Ai-zuqnzvMzq_GJ3KbBvOGNM5BxzvinyPK_FQGtW0owhthfyklFW0YZlWV22eb4c2qLhyPtqyMpatLHHxJFLtUzvG2O3F8nNS5bVbVVcKN6jcumdztgzs-JblV3HmZjOC6MXe67ky_Sxep6n2VF2DDKmo5kPJsrK1YW9TBTvw9bF95Z03r2g8tKr9PuC-6isXMHqncISmfeq_YLHHWqIbzbHPUgHW7lH_YqNcy28CFZd_u38S2FyMQPnSO0v2b8DAAD__4QEKzc">