[PATCH] D86428: [X86] Remove extra getOperand(0) call from recently introduced store(extract_element(vtrunc)) to truncated store combine.

[Craig Topper via Phabricator via llvm-commits]

craig.topper created this revision.
craig.topper added reviewers: RKSimon, spatel.
Herald added a subscriber: hiraditya.
Herald added a project: LLVM.
craig.topper requested review of this revision.

The IsExtractedElement already called getOperand(0) so Extract
here is the source vector. We shouldn't call getOperand(0). This
worked for the original test cases because the result was a
bitcast so the getOperand(0) accidently peeked through the bitcast
which is what we wanted.

In the failing case here, the operand turns out to be undef so
the getOperand(0) asserts because undef has no operands.

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25184


Repository:
  rG LLVM Github Monorepo

https://reviews.llvm.org/D86428

Files:
  llvm/lib/Target/X86/X86ISelLowering.cpp
  llvm/test/CodeGen/X86/oss-fuzz-25184.ll


Index: llvm/test/CodeGen/X86/oss-fuzz-25184.ll
===================================================================
--- /dev/null
+++ llvm/test/CodeGen/X86/oss-fuzz-25184.ll
@@ -0,0 +1,18 @@
+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
+; RUN: llc < %s -mtriple=x86_64-apple-darwin19.5.0 | FileCheck %s
+
+; OSS fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25184
+
+define <2 x double> @test_fpext() {
+; CHECK-LABEL: test_fpext:
+; CHECK:       ## %bb.0:
+; CHECK-NEXT:    movsd {{.*#+}} xmm0 = mem[0],zero
+; CHECK-NEXT:    retq
+  %tmp12 = insertelement <4 x float> undef, float 0.000000e+00, i32 3
+  %tmp5 = fpext <4 x float> %tmp12 to <4 x double>
+  %ret = shufflevector <4 x double> %tmp5, <4 x double> undef, <2 x i32> <i32 0, i32 1>
+  %E1 = extractelement <4 x double> %tmp5, i16 undef
+  %I2 = insertelement <2 x double> %ret, double 4.940660e-324, i16 undef
+  store double %E1, double* undef, align 8
+  ret <2 x double> %I2
+}
Index: llvm/lib/Target/X86/X86ISelLowering.cpp
===================================================================
--- llvm/lib/Target/X86/X86ISelLowering.cpp
+++ llvm/lib/Target/X86/X86ISelLowering.cpp
@@ -44622,7 +44622,7 @@
       return SDValue();
     };
     if (SDValue Extract = IsExtractedElement(StoredVal)) {
-      SDValue Trunc = peekThroughOneUseBitcasts(Extract.getOperand(0));
+      SDValue Trunc = peekThroughOneUseBitcasts(Extract);
       if (Trunc.getOpcode() == X86ISD::VTRUNC) {
         SDValue Src = Trunc.getOperand(0);
         MVT DstVT = Trunc.getSimpleValueType();


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D86428.287298.patch
Type: text/x-patch
Size: 1585 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20200824/f7a9b915/attachment.bin>