[llvm] r342183 - [DAGCombine] Fix crash when store merging created an extract_subvector with invalid index.

[Reid Kleckner via llvm-commits]

I reverted this in r342265 because it caused assertion failures while
building Chromium. I'm starting a reduction.

On Thu, Sep 13, 2018 at 2:30 PM Amara Emerson via llvm-commits <
llvm-commits at lists.llvm.org> wrote:

> Author: aemerson
> Date: Thu Sep 13 14:28:58 2018
> New Revision: 342183
>
> URL: http://llvm.org/viewvc/llvm-project?rev=342183&view=rev
> Log:
> [DAGCombine] Fix crash when store merging created an extract_subvector
> with invalid index.
>
> Differential Revision: https://reviews.llvm.org/D51831
>
> Added:
>     llvm/trunk/test/CodeGen/X86/merge-vector-stores-scale-idx-crash.ll
> Modified:
>     llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
>
> Modified: llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
> URL:
> http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp?rev=342183&r1=342182&r2=342183&view=diff
>
> ==============================================================================
> --- llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp (original)
> +++ llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp Thu Sep 13
> 14:28:58 2018
> @@ -13843,17 +13843,24 @@ bool DAGCombiner::MergeStoresOfConstants
>               Val.getOpcode() == ISD::EXTRACT_SUBVECTOR)) {
>            SDValue Vec = Val.getOperand(0);
>            EVT MemVTScalarTy = MemVT.getScalarType();
> +          SDValue Idx = Val.getOperand(1);
>            // We may need to add a bitcast here to get types to line up.
>            if (MemVTScalarTy != Vec.getValueType()) {
>              unsigned Elts = Vec.getValueType().getSizeInBits() /
>                              MemVTScalarTy.getSizeInBits();
> +            if (Val.getValueType().isVector()) {
> +              unsigned IdxC = cast<ConstantSDNode>(Idx)->getZExtValue();
> +              unsigned NewIdx =
> +                  ((uint64_t)IdxC * MemVT.getVectorNumElements()) / Elts;
> +              Idx = DAG.getConstant(NewIdx, SDLoc(Val),
> Idx.getValueType());
> +            }
>              EVT NewVecTy =
>                  EVT::getVectorVT(*DAG.getContext(), MemVTScalarTy, Elts);
>              Vec = DAG.getBitcast(NewVecTy, Vec);
>            }
>            auto OpC = (MemVT.isVector()) ? ISD::EXTRACT_SUBVECTOR
>                                          : ISD::EXTRACT_VECTOR_ELT;
> -          Val = DAG.getNode(OpC, SDLoc(Val), MemVT, Vec,
> Val.getOperand(1));
> +          Val = DAG.getNode(OpC, SDLoc(Val), MemVT, Vec, Idx);
>          }
>          Ops.push_back(Val);
>        }
>
> Added: llvm/trunk/test/CodeGen/X86/merge-vector-stores-scale-idx-crash.ll
> URL:
> http://llvm.org/viewvc/llvm-project/llvm/trunk/test/CodeGen/X86/merge-vector-stores-scale-idx-crash.ll?rev=342183&view=auto
>
> ==============================================================================
> --- llvm/trunk/test/CodeGen/X86/merge-vector-stores-scale-idx-crash.ll
> (added)
> +++ llvm/trunk/test/CodeGen/X86/merge-vector-stores-scale-idx-crash.ll Thu
> Sep 13 14:28:58 2018
> @@ -0,0 +1,19 @@
> +; RUN: llc < %s  -mtriple=x86_64-apple-osx10.14 -mattr=+avx2 | FileCheck
> %s
> +
> +; Check that we don't crash due creating invalid extract_subvector
> indices in store merging.
> +; CHECK-LABEL: testfn
> +; CHECK: retq
> +define void @testfn(i32* nocapture %p) {
> +  %v0 = getelementptr i32, i32* %p, i64 12
> +  %1 = bitcast i32* %v0 to <2 x i64>*
> +  %2 = bitcast i32* %v0 to <4 x i32>*
> +  %3 = getelementptr <2 x i64>, <2 x i64>* %1, i64 -3
> +  store <2 x i64> undef, <2 x i64>* %3, align 16
> +  %4 = shufflevector <4 x i64> zeroinitializer, <4 x i64> undef, <2 x
> i32> <i32 0, i32 1>
> +  %5 = getelementptr <2 x i64>, <2 x i64>* %1, i64 -2
> +  store <2 x i64> %4, <2 x i64>* %5, align 16
> +  %6 = shufflevector <8 x i32> zeroinitializer, <8 x i32> undef, <4 x
> i32> <i32 4, i32 5, i32 6, i32 7>
> +  %7 = getelementptr <4 x i32>, <4 x i32>* %2, i64 -1
> +  store <4 x i32> %6, <4 x i32>* %7, align 16
> +  ret void
> +}
>
>
> _______________________________________________
> llvm-commits mailing list
> llvm-commits at lists.llvm.org
> http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-commits
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20180914/b0469420/attachment.html>