[PATCH] D37880: Fix an out-of-bounds shufflevector index bug

[George Burgess IV via Phabricator via llvm-commits]

This revision was automatically updated to reflect the committed changes.
Closed by commit rL314380: [DAGCombiner] Fix an off-by-one error in vector logic (authored by gbiv).

Changed prior to commit:
  https://reviews.llvm.org/D37880?vs=116918&id=116925#toc

Repository:
  rL LLVM

https://reviews.llvm.org/D37880

Files:
  llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
  llvm/trunk/test/CodeGen/ARM/crash-on-pow2-shufflevector.ll


Index: llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
===================================================================
--- llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
+++ llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
@@ -14501,8 +14501,8 @@
     }
 
     NearestPow2 = PowerOf2Ceil(MaxIndex);
-    if (InVT.isSimple() && (NearestPow2 > 2) &&
-        ((NumElems * 2) < NearestPow2)) {
+    if (InVT.isSimple() && NearestPow2 > 2 && MaxIndex < NearestPow2 &&
+        NumElems * 2 < NearestPow2) {
       unsigned SplitSize = NearestPow2 / 2;
       EVT SplitVT = EVT::getVectorVT(*DAG.getContext(),
                                      InVT.getVectorElementType(), SplitSize);
Index: llvm/trunk/test/CodeGen/ARM/crash-on-pow2-shufflevector.ll
===================================================================
--- llvm/trunk/test/CodeGen/ARM/crash-on-pow2-shufflevector.ll
+++ llvm/trunk/test/CodeGen/ARM/crash-on-pow2-shufflevector.ll
@@ -0,0 +1,24 @@
+; RUN: llc < %s -mtriple=armv7 | FileCheck %s
+;
+; Ensure that don't crash given a largeish power-of-two shufflevector index.
+
+%struct.desc = type { i32, [7 x i32] }
+
+define i32 @foo(%struct.desc* %descs, i32 %num, i32 %cw) local_unnamed_addr #0 {
+; CHECK-LABEL: foo:
+; CHECK:       @ BB#0: @ %entry
+; CHECK-NEXT:    mov r1, #32
+; CHECK-NEXT:    vld1.32 {d16, d17}, [r0], r1
+; CHECK-NEXT:    vld1.32 {d18, d19}, [r0]
+; CHECK-NEXT:    vtrn.32 q8, q9
+; CHECK-NEXT:    vadd.i32 d16, d16, d16
+; CHECK-NEXT:    vmov.32 r0, d16[1]
+; CHECK-NEXT:    bx lr
+entry:
+  %descs.vec = bitcast %struct.desc* %descs to <16 x i32>*
+  %wide.vec = load <16 x i32>, <16 x i32>* %descs.vec, align 4
+  %strided.vec = shufflevector <16 x i32> %wide.vec, <16 x i32> undef, <2 x i32> <i32 0, i32 8>
+  %bin.rdx20 = add <2 x i32> %strided.vec, %strided.vec
+  %0 = extractelement <2 x i32> %bin.rdx20, i32 1
+  ret i32 %0
+}


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D37880.116925.patch
Type: text/x-patch
Size: 1894 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20170928/8ab83b2a/attachment.bin>