[all-commits] [llvm/llvm-project] e9e21f: Revert [X86] EltsFromConsecutiveLoads - handle tru...

[Adam Scott via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: e9e21f520ccd8f4c292686dfdeb04eae080110e3
      https://github.com/llvm/llvm-project/commit/e9e21f520ccd8f4c292686dfdeb04eae080110e3
  Author: Adam Scott <adamscott200322 at gmail.com>
  Date:   2026-07-12 (Sun, 12 Jul 2026)

  Changed paths:
    M llvm/lib/Target/X86/X86ISelLowering.cpp
    M llvm/test/CodeGen/X86/avx512-calling-conv.ll
    M llvm/test/CodeGen/X86/avx512-ext.ll
    M llvm/test/CodeGen/X86/avx512-insert-extract.ll
    M llvm/test/CodeGen/X86/avx512-load-store.ll
    M llvm/test/CodeGen/X86/avx512-mask-op.ll
    M llvm/test/CodeGen/X86/avx512-masked_memop-16-8.ll
    M llvm/test/CodeGen/X86/avx512fp16-mov.ll
    M llvm/test/CodeGen/X86/build-vector-128.ll
    M llvm/test/CodeGen/X86/build-vector-256.ll
    M llvm/test/CodeGen/X86/build-vector-512.ll
    R llvm/test/CodeGen/X86/buildvec-strided-loads.ll
    M llvm/test/CodeGen/X86/masked_gather_scatter_widen.ll
    M llvm/test/CodeGen/X86/vector-compress.ll

  Log Message:
  -----------
  Revert [X86] EltsFromConsecutiveLoads - handle trunc(wideload()) patterns (#199371) (#208960)

Reverts llvm/llvm-project#199371.

The strided path emits wide loads without checking that the widened
range is dereferenceable. The last wide load reads up to (stride -
element) bytes past the last element and faults when the data ends at a
page boundary. Flagged by @nikic in
https://github.com/llvm/llvm-project/pull/199371#issuecomment-4947406318.

Reproducer on current main **MADE WITH CLAUDE OPUS**

strided.ll, 8 x i16 at a 4 byte stride, the source only touches bytes
[0, 30):
```llvm
define void @strided8i16(ptr %p, ptr %out) {
  %g0 = getelementptr inbounds i8, ptr %p, i64 0
  %g1 = getelementptr inbounds i8, ptr %p, i64 4
  %g2 = getelementptr inbounds i8, ptr %p, i64 8
  %g3 = getelementptr inbounds i8, ptr %p, i64 12
  %g4 = getelementptr inbounds i8, ptr %p, i64 16
  %g5 = getelementptr inbounds i8, ptr %p, i64 20
  %g6 = getelementptr inbounds i8, ptr %p, i64 24
  %g7 = getelementptr inbounds i8, ptr %p, i64 28
  %v0 = load i16, ptr %g0, align 1
  %v1 = load i16, ptr %g1, align 1
  %v2 = load i16, ptr %g2, align 1
  %v3 = load i16, ptr %g3, align 1
  %v4 = load i16, ptr %g4, align 1
  %v5 = load i16, ptr %g5, align 1
  %v6 = load i16, ptr %g6, align 1
  %v7 = load i16, ptr %g7, align 1
  %r0 = insertelement <8 x i16> undef, i16 %v0, i32 0
  %r1 = insertelement <8 x i16> %r0,   i16 %v1, i32 1
  %r2 = insertelement <8 x i16> %r1,   i16 %v2, i32 2
  %r3 = insertelement <8 x i16> %r2,   i16 %v3, i32 3
  %r4 = insertelement <8 x i16> %r3,   i16 %v4, i32 4
  %r5 = insertelement <8 x i16> %r4,   i16 %v5, i32 5
  %r6 = insertelement <8 x i16> %r5,   i16 %v6, i32 6
  %r7 = insertelement <8 x i16> %r6,   i16 %v7, i32 7
  store <8 x i16> %r7, ptr %out, align 1
  ret void
}
```

driver.c, puts the 30 data bytes flush against a PROT_NONE page:
```c
#include <sys/mman.h>
#include <unistd.h>
#include <string.h>
#include <stdint.h>
#include <stdio.h>
void strided8i16(void *p, void *out);
int main(void) {
  long pg = sysconf(_SC_PAGESIZE);
  char *m = mmap(0, 2*pg, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
  mprotect(m + pg, pg, PROT_NONE);        /* unmapped guard page right after */
  memset(m, 0x11, pg);
  char *p = m + pg - 30;                  /* data [0,30) ends exactly at page end */
  uint16_t out[8];
  strided8i16(p, out);                    /* source touches only bytes [0,30) */
  printf("  returned OK, out[0]=%u\n", out[0]);
  return 0;
}
```

```
$ llc -mtriple=x86_64-unknown-linux-gnu -mattr=+avx2 -filetype=obj strided.ll -o strided.o
$ cc driver.c strided.o -o repro
$ ./repro; echo "exit: $?"
Segmentation fault (core dumped)
exit: 139

$ llc -mtriple=x86_64-unknown-linux-gnu -mattr=+sse2 -filetype=obj strided.ll -o strided_sse2.o
$ cc driver.c strided_sse2.o -o repro_sse2
$ ./repro_sse2; echo "exit: $?"
  returned OK, out[0]=4369
exit: 0
```

With +avx2 the fold fires and emits a 32 byte `vmovdqu (%rdi), %ymm0`
over the 30 byte footprint. With plain sse2 the buildvector stays scalar
and only the accessed bytes are read.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications