<div dir="ltr">getTreeCost() can return INT_MAX, and tryToReduce() adds getReductionCost() to that.<div>Looks like the UB has been there for a while, the new test just exposes it.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Aug 19, 2016 at 9:53 AM, Matthew Simpson via llvm-commits <span dir="ltr"><<a href="mailto:llvm-commits@lists.llvm.org" target="_blank">llvm-commits@lists.llvm.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div class="m_-5089131390155058624WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Sorry about that, I’ll take a look!<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">-- Matt<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Kostya Serebryany [mailto:<a href="mailto:kcc@google.com" target="_blank">kcc@google.com</a>] <br><b>Sent:</b> Friday, August 19, 2016 12:43 PM<br><b>To:</b> Matthew Simpson <<a href="mailto:mssimpso@codeaurora.org" target="_blank">mssimpso@codeaurora.org</a>><br><b>Cc:</b> LLVM Commits <<a href="mailto:llvm-commits@lists.llvm.org" target="_blank">llvm-commits@lists.llvm.org</a>><br><b>Subject:</b> Re: [llvm] r279125 - [SLP] Initialize VectorizedValue when gathering<u></u><u></u></span></p><div><div class="h5"><p class="MsoNormal"><u></u> <u></u></p><div><p class="MsoNormal">I think this is causing the ubsan bot failure. please fix: <u></u><u></u></p><div><pre><span class="m_-5089131390155058624gmail-stdout"><span style="font-size:12.0pt;color:black">lib/Transforms/Vectorize/<wbr>SLPVectorizer.cpp:4177:34: runtime error: signed integer overflow: <a href="tel:2147483647" value="+12147483647" target="_blank">2147483647</a> + 11 cannot be represented in type 'int'</span></span><span class="m_-5089131390155058624gmail-stdout"><span style="font-family:"Arial",sans-serif"> </span></span><u></u><u></u></pre></div><div><p class="MsoNormal"><span class="m_-5089131390155058624gmail-stdout"><a href="http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux-fast/builds/15655/steps/check-llvm%20ubsan/logs/stdio" target="_blank">http://lab.llvm.org:8011/<wbr>builders/sanitizer-x86_64-<wbr>linux-fast/builds/15655/steps/<wbr>check-llvm%20ubsan/logs/stdio</a></span><u></u><u></u></p></div></div><div><p class="MsoNormal"><u></u> <u></u></p><div><p class="MsoNormal">On Thu, Aug 18, 2016 at 12:50 PM, Matthew Simpson via llvm-commits <<a href="mailto:llvm-commits@lists.llvm.org" target="_blank">llvm-commits@lists.llvm.org</a>> wrote:<u></u><u></u></p><blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in"><p class="MsoNormal">Author: mssimpso<br>Date: Thu Aug 18 14:50:32 2016<br>New Revision: 279125<br><br>URL: <a href="http://llvm.org/viewvc/llvm-project?rev=279125&view=rev" target="_blank">http://llvm.org/viewvc/llvm-<wbr>project?rev=279125&view=rev</a><br>Log:<br>[SLP] Initialize VectorizedValue when gathering<br><br>We abort building vectorizable trees in some cases (e.g., if the maximum<br>recursion depth is reached, if the region size is too large, etc.). If this<br>happens for a reduction, we can be left with a root entry that needs to be<br>gathered. For these cases, we need make sure we actually set VectorizedValue to<br>the resulting vector.<br><br>This patch ensures we properly set VectorizedValue, and it also ensures the<br>insertelement sequence generated for the gathers is inserted at the correct<br>location.<br><br>Reference: <a href="https://llvm.org/bugs/show_bug.cgi?id=28330" target="_blank">https://llvm.org/bugs/show_<wbr>bug.cgi?id=28330</a><br>Differential Revison: <a href="https://reviews.llvm.org/D23410" target="_blank">https://reviews.llvm.org/<wbr>D23410</a><br><br>Added:<br> llvm/trunk/test/Transforms/<wbr>SLPVectorizer/AArch64/gather-<wbr>root.ll<br>Modified:<br> llvm/trunk/lib/Transforms/<wbr>Vectorize/SLPVectorizer.cpp<br><br>Modified: llvm/trunk/lib/Transforms/<wbr>Vectorize/SLPVectorizer.cpp<br>URL: <a href="http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/Transforms/Vectorize/SLPVectorizer.cpp?rev=279125&r1=279124&r2=279125&view=diff" target="_blank">http://llvm.org/viewvc/llvm-<wbr>project/llvm/trunk/lib/<wbr>Transforms/Vectorize/<wbr>SLPVectorizer.cpp?rev=279125&<wbr>r1=279124&r2=279125&view=diff</a><br>==============================<wbr>==============================<wbr>==================<br>--- llvm/trunk/lib/Transforms/<wbr>Vectorize/SLPVectorizer.cpp (original)<br>+++ llvm/trunk/lib/Transforms/<wbr>Vectorize/SLPVectorizer.cpp Thu Aug 18 14:50:32 2016<br>@@ -2153,11 +2153,61 @@ void BoUpSLP::<wbr>reorderInputsAccordingToOp<br> }<br><br> void BoUpSLP::<wbr>setInsertPointAfterBundle(<wbr>ArrayRef<Value *> VL) {<br>- Instruction *VL0 = cast<Instruction>(VL[0]);<br>- BasicBlock::iterator NextInst(VL0);<br>- ++NextInst;<br>- Builder.SetInsertPoint(VL0-><wbr>getParent(), NextInst);<br>- Builder.<wbr>SetCurrentDebugLocation(VL0-><wbr>getDebugLoc());<br>+<br>+ // Get the basic block this bundle is in. All instructions in the bundle<br>+ // should be in this block.<br>+ auto *Front = cast<Instruction>(VL.front());<br>+ auto *BB = Front->getParent();<br>+ assert(all_of(make_range(VL.<wbr>begin(), VL.end()), [&](Value *V) -> bool {<br>+ return cast<Instruction>(V)-><wbr>getParent() == BB;<br>+ }));<br>+<br>+ // The last instruction in the bundle in program order.<br>+ Instruction *LastInst = nullptr;<br>+<br>+ // Find the last instruction. The common case should be that BB has been<br>+ // scheduled, and the last instruction is VL.back(). So we start with<br>+ // VL.back() and iterate over schedule data until we reach the end of the<br>+ // bundle. The end of the bundle is marked by null ScheduleData.<br>+ if (BlocksSchedules.count(BB)) {<br>+ auto *Bundle = BlocksSchedules[BB]-><wbr>getScheduleData(VL.back());<br>+ if (Bundle && Bundle->isPartOfBundle())<br>+ for (; Bundle; Bundle = Bundle->NextInBundle)<br>+ LastInst = Bundle->Inst;<br>+ }<br>+<br>+ // LastInst can still be null at this point if there's either not an entry<br>+ // for BB in BlocksSchedules or there's no ScheduleData available for<br>+ // VL.back(). This can be the case if buildTree_rec aborts for various<br>+ // reasons (e.g., the maximum recursion depth is reached, the maximum region<br>+ // size is reached, etc.). ScheduleData is initialized in the scheduling<br>+ // "dry-run".<br>+ //<br>+ // If this happens, we can still find the last instruction by brute force. We<br>+ // iterate forwards from Front (inclusive) until we either see all<br>+ // instructions in the bundle or reach the end of the block. If Front is the<br>+ // last instruction in program order, LastInst will be set to Front, and we<br>+ // will visit all the remaining instructions in the block.<br>+ //<br>+ // One of the reasons we exit early from buildTree_rec is to place an upper<br>+ // bound on compile-time. Thus, taking an additional compile-time hit here is<br>+ // not ideal. However, this should be exceedingly rare since it requires that<br>+ // we both exit early from buildTree_rec and that the bundle be out-of-order<br>+ // (causing us to iterate all the way to the end of the block).<br>+ if (!LastInst) {<br>+ SmallPtrSet<Value *, 16> Bundle(VL.begin(), VL.end());<br>+ for (auto &I : make_range(BasicBlock::<wbr>iterator(Front), BB->end())) {<br>+ if (Bundle.erase(&I))<br>+ LastInst = &I;<br>+ if (Bundle.empty())<br>+ break;<br>+ }<br>+ }<br>+<br>+ // Set the insertion point after the last instruction in the bundle. Set the<br>+ // debug location to Front.<br>+ Builder.SetInsertPoint(BB, next(BasicBlock::iterator(<wbr>LastInst)));<br>+ Builder.<wbr>SetCurrentDebugLocation(Front-<wbr>>getDebugLoc());<br> }<br><br> Value *BoUpSLP::Gather(ArrayRef<<wbr>Value *> VL, VectorType *Ty) {<br>@@ -2235,7 +2285,9 @@ Value *BoUpSLP::vectorizeTree(<wbr>TreeEntry<br><br> if (E->NeedToGather) {<br> setInsertPointAfterBundle(E-><wbr>Scalars);<br>- return Gather(E->Scalars, VecTy);<br>+ auto *V = Gather(E->Scalars, VecTy);<br>+ E->VectorizedValue = V;<br>+ return V;<br> }<br><br> unsigned Opcode = getSameOpcode(E->Scalars);<br>@@ -2282,7 +2334,10 @@ Value *BoUpSLP::vectorizeTree(<wbr>TreeEntry<br> E->VectorizedValue = V;<br> return V;<br> }<br>- return Gather(E->Scalars, VecTy);<br>+ setInsertPointAfterBundle(E-><wbr>Scalars);<br>+ auto *V = Gather(E->Scalars, VecTy);<br>+ E->VectorizedValue = V;<br>+ return V;<br> }<br> case Instruction::ExtractValue: {<br> if (canReuseExtract(E->Scalars, Instruction::ExtractValue)) {<br>@@ -2294,7 +2349,10 @@ Value *BoUpSLP::vectorizeTree(<wbr>TreeEntry<br> E->VectorizedValue = V;<br> return propagateMetadata(V, E->Scalars);<br> }<br>- return Gather(E->Scalars, VecTy);<br>+ setInsertPointAfterBundle(E-><wbr>Scalars);<br>+ auto *V = Gather(E->Scalars, VecTy);<br>+ E->VectorizedValue = V;<br>+ return V;<br> }<br> case Instruction::ZExt:<br> case Instruction::SExt:<br><br>Added: llvm/trunk/test/Transforms/<wbr>SLPVectorizer/AArch64/gather-<wbr>root.ll<br>URL: <a href="http://llvm.org/viewvc/llvm-project/llvm/trunk/test/Transforms/SLPVectorizer/AArch64/gather-root.ll?rev=279125&view=auto" target="_blank">http://llvm.org/viewvc/llvm-<wbr>project/llvm/trunk/test/<wbr>Transforms/SLPVectorizer/<wbr>AArch64/gather-root.ll?rev=<wbr>279125&view=auto</a><br>==============================<wbr>==============================<wbr>==================<br>--- llvm/trunk/test/Transforms/<wbr>SLPVectorizer/AArch64/gather-<wbr>root.ll (added)<br>+++ llvm/trunk/test/Transforms/<wbr>SLPVectorizer/AArch64/gather-<wbr>root.ll Thu Aug 18 14:50:32 2016<br>@@ -0,0 +1,95 @@<br>+; RUN: opt < %s -slp-vectorizer -S | FileCheck %s --check-prefix=DEFAULT<br>+; RUN: opt < %s -slp-recursion-max-depth=0 -slp-vectorizer -S | FileCheck %s --check-prefix=GATHER<br>+<br>+target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:<wbr>64-i128:128-n32:64-S128"<br>+target triple = "aarch64--linux-gnu"<br>+<br>+@a = common global [80 x i8] zeroinitializer, align 16<br>+<br>+; DEFAULT-LABEL: @PR28330(<br>+; DEFAULT: %tmp17 = phi i32 [ %tmp34, %for.body ], [ 0, %entry ]<br>+; DEFAULT: %tmp18 = phi i32 [ %tmp35, %for.body ], [ %n, %entry ]<br>+; DEFAULT: %[[S0:.+]] = select <8 x i1> %1, <8 x i32> <i32 -720, i32 -720, i32 -720, i32 -720, i32 -720, i32 -720, i32 -720, i32 -720>, <8 x i32> <i32 -80, i32 -80, i32 -80, i32 -80, i32 -80, i32 -80, i32 -80, i32 -80><br>+; DEFAULT: %[[R0:.+]] = shufflevector <8 x i32> %[[S0]], <8 x i32> undef, <8 x i32> <i32 4, i32 5, i32 6, i32 7, i32 undef, i32 undef, i32 undef, i32 undef><br>+; DEFAULT: %[[R1:.+]] = add <8 x i32> %[[S0]], %[[R0]]<br>+; DEFAULT: %[[R2:.+]] = shufflevector <8 x i32> %[[R1]], <8 x i32> undef, <8 x i32> <i32 2, i32 3, i32 undef, i32 undef, i32 undef, i32 undef, i32 undef, i32 undef><br>+; DEFAULT: %[[R3:.+]] = add <8 x i32> %[[R1]], %[[R2]]<br>+; DEFAULT: %[[R4:.+]] = shufflevector <8 x i32> %[[R3]], <8 x i32> undef, <8 x i32> <i32 1, i32 undef, i32 undef, i32 undef, i32 undef, i32 undef, i32 undef, i32 undef><br>+; DEFAULT: %[[R5:.+]] = add <8 x i32> %[[R3]], %[[R4]]<br>+; DEFAULT: %[[R6:.+]] = extractelement <8 x i32> %[[R5]], i32 0<br>+; DEFAULT: %tmp34 = add i32 %[[R6]], %tmp17<br>+;<br>+; GATHER-LABEL: @PR28330(<br>+; GATHER: %tmp17 = phi i32 [ %tmp34, %for.body ], [ 0, %entry ]<br>+; GATHER: %tmp18 = phi i32 [ %tmp35, %for.body ], [ %n, %entry ]<br>+; GATHER: %tmp19 = select i1 %tmp1, i32 -720, i32 -80<br>+; GATHER: %tmp21 = select i1 %tmp3, i32 -720, i32 -80<br>+; GATHER: %tmp23 = select i1 %tmp5, i32 -720, i32 -80<br>+; GATHER: %tmp25 = select i1 %tmp7, i32 -720, i32 -80<br>+; GATHER: %tmp27 = select i1 %tmp9, i32 -720, i32 -80<br>+; GATHER: %tmp29 = select i1 %tmp11, i32 -720, i32 -80<br>+; GATHER: %tmp31 = select i1 %tmp13, i32 -720, i32 -80<br>+; GATHER: %tmp33 = select i1 %tmp15, i32 -720, i32 -80<br>+; GATHER: %[[I0:.+]] = insertelement <8 x i32> undef, i32 %tmp19, i32 0<br>+; GATHER: %[[I1:.+]] = insertelement <8 x i32> %[[I0]], i32 %tmp21, i32 1<br>+; GATHER: %[[I2:.+]] = insertelement <8 x i32> %[[I1]], i32 %tmp23, i32 2<br>+; GATHER: %[[I3:.+]] = insertelement <8 x i32> %[[I2]], i32 %tmp25, i32 3<br>+; GATHER: %[[I4:.+]] = insertelement <8 x i32> %[[I3]], i32 %tmp27, i32 4<br>+; GATHER: %[[I5:.+]] = insertelement <8 x i32> %[[I4]], i32 %tmp29, i32 5<br>+; GATHER: %[[I6:.+]] = insertelement <8 x i32> %[[I5]], i32 %tmp31, i32 6<br>+; GATHER: %[[I7:.+]] = insertelement <8 x i32> %[[I6]], i32 %tmp33, i32 7<br>+; GATHER: %[[R0:.+]] = shufflevector <8 x i32> %[[I7]], <8 x i32> undef, <8 x i32> <i32 4, i32 5, i32 6, i32 7, i32 undef, i32 undef, i32 undef, i32 undef><br>+; GATHER: %[[R1:.+]] = add <8 x i32> %[[I7]], %[[R0]]<br>+; GATHER: %[[R2:.+]] = shufflevector <8 x i32> %[[R1]], <8 x i32> undef, <8 x i32> <i32 2, i32 3, i32 undef, i32 undef, i32 undef, i32 undef, i32 undef, i32 undef><br>+; GATHER: %[[R3:.+]] = add <8 x i32> %[[R1]], %[[R2]]<br>+; GATHER: %[[R4:.+]] = shufflevector <8 x i32> %[[R3]], <8 x i32> undef, <8 x i32> <i32 1, i32 undef, i32 undef, i32 undef, i32 undef, i32 undef, i32 undef, i32 undef><br>+; GATHER: %[[R5:.+]] = add <8 x i32> %[[R3]], %[[R4]]<br>+; GATHER: %[[R6:.+]] = extractelement <8 x i32> %[[R5]], i32 0<br>+; GATHER: %tmp34 = add i32 %[[R6]], %tmp17<br>+<br>+define void @PR28330(i32 %n) {<br>+entry:<br>+ %tmp0 = load i8, i8* getelementptr inbounds ([80 x i8], [80 x i8]* @a, i64 0, i64 1), align 1<br>+ %tmp1 = icmp eq i8 %tmp0, 0<br>+ %tmp2 = load i8, i8* getelementptr inbounds ([80 x i8], [80 x i8]* @a, i64 0, i64 2), align 2<br>+ %tmp3 = icmp eq i8 %tmp2, 0<br>+ %tmp4 = load i8, i8* getelementptr inbounds ([80 x i8], [80 x i8]* @a, i64 0, i64 3), align 1<br>+ %tmp5 = icmp eq i8 %tmp4, 0<br>+ %tmp6 = load i8, i8* getelementptr inbounds ([80 x i8], [80 x i8]* @a, i64 0, i64 4), align 4<br>+ %tmp7 = icmp eq i8 %tmp6, 0<br>+ %tmp8 = load i8, i8* getelementptr inbounds ([80 x i8], [80 x i8]* @a, i64 0, i64 5), align 1<br>+ %tmp9 = icmp eq i8 %tmp8, 0<br>+ %tmp10 = load i8, i8* getelementptr inbounds ([80 x i8], [80 x i8]* @a, i64 0, i64 6), align 2<br>+ %tmp11 = icmp eq i8 %tmp10, 0<br>+ %tmp12 = load i8, i8* getelementptr inbounds ([80 x i8], [80 x i8]* @a, i64 0, i64 7), align 1<br>+ %tmp13 = icmp eq i8 %tmp12, 0<br>+ %tmp14 = load i8, i8* getelementptr inbounds ([80 x i8], [80 x i8]* @a, i64 0, i64 8), align 8<br>+ %tmp15 = icmp eq i8 %tmp14, 0<br>+ br label %for.body<br>+<br>+for.body:<br>+ %tmp17 = phi i32 [ %tmp34, %for.body ], [ 0, %entry ]<br>+ %tmp18 = phi i32 [ %tmp35, %for.body ], [ %n, %entry ]<br>+ %tmp19 = select i1 %tmp1, i32 -720, i32 -80<br>+ %tmp20 = add i32 %tmp17, %tmp19<br>+ %tmp21 = select i1 %tmp3, i32 -720, i32 -80<br>+ %tmp22 = add i32 %tmp20, %tmp21<br>+ %tmp23 = select i1 %tmp5, i32 -720, i32 -80<br>+ %tmp24 = add i32 %tmp22, %tmp23<br>+ %tmp25 = select i1 %tmp7, i32 -720, i32 -80<br>+ %tmp26 = add i32 %tmp24, %tmp25<br>+ %tmp27 = select i1 %tmp9, i32 -720, i32 -80<br>+ %tmp28 = add i32 %tmp26, %tmp27<br>+ %tmp29 = select i1 %tmp11, i32 -720, i32 -80<br>+ %tmp30 = add i32 %tmp28, %tmp29<br>+ %tmp31 = select i1 %tmp13, i32 -720, i32 -80<br>+ %tmp32 = add i32 %tmp30, %tmp31<br>+ %tmp33 = select i1 %tmp15, i32 -720, i32 -80<br>+ %tmp34 = add i32 %tmp32, %tmp33<br>+ %tmp35 = add nsw i32 %tmp18, -1<br>+ %tmp36 = icmp eq i32 %tmp35, 0<br>+ br i1 %tmp36, label %for.end, label %for.body<br>+<br>+for.end:<br>+ ret void<br>+}<br><br><br>______________________________<wbr>_________________<br>llvm-commits mailing list<br><a href="mailto:llvm-commits@lists.llvm.org" target="_blank">llvm-commits@lists.llvm.org</a><br><a href="http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-commits" target="_blank">http://lists.llvm.org/cgi-bin/<wbr>mailman/listinfo/llvm-commits</a><u></u><u></u></p></blockquote></div><p class="MsoNormal"><u></u> <u></u></p></div></div></div></div></div><br>______________________________<wbr>_________________<br>
llvm-commits mailing list<br>
<a href="mailto:llvm-commits@lists.llvm.org">llvm-commits@lists.llvm.org</a><br>
<a href="http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-commits" rel="noreferrer" target="_blank">http://lists.llvm.org/cgi-bin/<wbr>mailman/listinfo/llvm-commits</a><br>
<br></blockquote></div><br></div>