[llvm-branch-commits] [llvm] 41042ad - [ARM] Fix miscompile in MAC for 64b values (#231702)
Tobias Hieta via llvm-branch-commits
llvm-branch-commits at lists.llvm.org
Sun Oct 18 11:36:17 PDT 2026
Author: Nick Desaulniers
Date: 2026-10-18T20:36:08+02:00
New Revision: 41042adf8339ceb09302ab4476436348dc643134
URL: https://github.com/llvm/llvm-project/commit/41042adf8339ceb09302ab4476436348dc643134
DIFF: https://github.com/llvm/llvm-project/commit/41042adf8339ceb09302ab4476436348dc643134.diff
LOG: [ARM] Fix miscompile in MAC for 64b values (#231702)
AddCombineTo64BitSMLAL16 is invoked from PerformADDECombine where the
combined node N is AddeNode, but it returned SDValue(AddcNode, 0).
Because RV.getNode() != N, DAGCombiner::Run did not stop replacing and
called DAG.ReplaceAllUsesWith(AddeNode, AddcNode), replacing uses of
the high-word carry/overflow flag (AddeNode, 1) with the low-word
addition flag (AddcNode, 1).
Assisted-by: Gemini
Fixes: e9113618cba6 ("[ARM] Custom Lowering for SADDO_CARRY and
SSUBO_CARRY (#154419)")
(cherry picked from commit 28999cd08f23dd7baeb63b7ca4addef4214999e3)
Added:
llvm/test/CodeGen/ARM/longMAC-overflow.ll
Modified:
llvm/lib/Target/ARM/ARMISelLowering.cpp
Removed:
################################################################################
diff --git a/llvm/lib/Target/ARM/ARMISelLowering.cpp b/llvm/lib/Target/ARM/ARMISelLowering.cpp
index 16f1d3c7fc6264..b218678da95115 100644
--- a/llvm/lib/Target/ARM/ARMISelLowering.cpp
+++ b/llvm/lib/Target/ARM/ARMISelLowering.cpp
@@ -12854,10 +12854,10 @@ static SDValue AddCombineTo64BitSMLAL16(SDNode *AddcNode, SDNode *AddeNode,
DAG.ReplaceAllUsesOfValueWith(SDValue(AddcNode, 0), LoMLALResult);
DAG.ReplaceAllUsesOfValueWith(SDValue(AddeNode, 0), HiMLALResult);
+ DCI.recursivelyDeleteUnusedNodes(AddeNode);
// Return original node to notify the driver to stop replacing.
- SDValue resNode(AddcNode, 0);
- return resNode;
+ return SDValue(AddeNode, 0);
}
static SDValue AddCombineTo64bitMLAL(SDNode *AddeSubeNode,
diff --git a/llvm/test/CodeGen/ARM/longMAC-overflow.ll b/llvm/test/CodeGen/ARM/longMAC-overflow.ll
new file mode 100644
index 00000000000000..28a27733ac93dd
--- /dev/null
+++ b/llvm/test/CodeGen/ARM/longMAC-overflow.ll
@@ -0,0 +1,259 @@
+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py UTC_ARGS: --version 5
+; RUN: llc -mtriple=armv7-eabi %s -o - | FileCheck %s --check-prefix=ARM
+; RUN: llc -mtriple=thumbv7-eabi %s -o - | FileCheck %s --check-prefix=THUMB2
+
+; FIXME: SMLALBB does not set flags, so forming SMLALBB when the ADDE overflow
+; flag is used duplicates the multiply-accumulate (SMULBB+ADDS+ADCS and SMLALBB).
+define { i64, i1 } @saddo_smlalbb(i64 %acc, i16 %a, i16 %b) {
+; ARM-LABEL: saddo_smlalbb:
+; ARM: @ %bb.0: @ %entry
+; ARM-NEXT: .save {r4, lr}
+; ARM-NEXT: push {r4, lr}
+; ARM-NEXT: smulbb lr, r2, r3
+; ARM-NEXT: sxth r4, r3
+; ARM-NEXT: mov r12, r0
+; ARM-NEXT: sxth r2, r2
+; ARM-NEXT: mov r3, r1
+; ARM-NEXT: smlalbb r12, r3, r2, r4
+; ARM-NEXT: mov r2, #0
+; ARM-NEXT: adds r0, r0, lr
+; ARM-NEXT: adcs r0, r1, lr, asr #31
+; ARM-NEXT: movwvs r2, #1
+; ARM-NEXT: mov r0, r12
+; ARM-NEXT: mov r1, r3
+; ARM-NEXT: pop {r4, pc}
+;
+; THUMB2-LABEL: saddo_smlalbb:
+; THUMB2: @ %bb.0: @ %entry
+; THUMB2-NEXT: .save {r4, lr}
+; THUMB2-NEXT: push {r4, lr}
+; THUMB2-NEXT: smulbb lr, r2, r3
+; THUMB2-NEXT: sxth r4, r3
+; THUMB2-NEXT: mov r12, r0
+; THUMB2-NEXT: sxth r2, r2
+; THUMB2-NEXT: mov r3, r1
+; THUMB2-NEXT: smlalbb r12, r3, r2, r4
+; THUMB2-NEXT: movs r2, #0
+; THUMB2-NEXT: adds.w r0, r0, lr
+; THUMB2-NEXT: adcs.w r0, r1, lr, asr #31
+; THUMB2-NEXT: it vs
+; THUMB2-NEXT: movvs r2, #1
+; THUMB2-NEXT: mov r0, r12
+; THUMB2-NEXT: mov r1, r3
+; THUMB2-NEXT: pop {r4, pc}
+entry:
+ %sext.a = sext i16 %a to i32
+ %sext.b = sext i16 %b to i32
+ %mul = mul nsw i32 %sext.a, %sext.b
+ %sext.mul = sext i32 %mul to i64
+ %res = tail call { i64, i1 } @llvm.sadd.with.overflow.i64(i64 %acc, i64 %sext.mul)
+ ret { i64, i1 } %res
+}
+
+; FIXME: SMLALBB does not set flags, so forming SMLALBB when the ADDE carry
+; flag is used duplicates the multiply-accumulate (SMULBB+ADDS+ADCS and SMLALBB).
+define { i64, i1 } @uaddo_smlalbb(i64 %acc, i16 %a, i16 %b) {
+; ARM-LABEL: uaddo_smlalbb:
+; ARM: @ %bb.0: @ %entry
+; ARM-NEXT: .save {r4, lr}
+; ARM-NEXT: push {r4, lr}
+; ARM-NEXT: smulbb lr, r2, r3
+; ARM-NEXT: sxth r4, r3
+; ARM-NEXT: mov r12, r0
+; ARM-NEXT: sxth r2, r2
+; ARM-NEXT: mov r3, r1
+; ARM-NEXT: smlalbb r12, r3, r2, r4
+; ARM-NEXT: mov r2, #0
+; ARM-NEXT: adds r0, r0, lr
+; ARM-NEXT: adcs r0, r1, lr, asr #31
+; ARM-NEXT: adc r2, r2, #0
+; ARM-NEXT: mov r0, r12
+; ARM-NEXT: mov r1, r3
+; ARM-NEXT: pop {r4, pc}
+;
+; THUMB2-LABEL: uaddo_smlalbb:
+; THUMB2: @ %bb.0: @ %entry
+; THUMB2-NEXT: .save {r4, lr}
+; THUMB2-NEXT: push {r4, lr}
+; THUMB2-NEXT: smulbb lr, r2, r3
+; THUMB2-NEXT: sxth r4, r3
+; THUMB2-NEXT: mov r12, r0
+; THUMB2-NEXT: sxth r2, r2
+; THUMB2-NEXT: mov r3, r1
+; THUMB2-NEXT: smlalbb r12, r3, r2, r4
+; THUMB2-NEXT: movs r2, #0
+; THUMB2-NEXT: adds.w r0, r0, lr
+; THUMB2-NEXT: adcs.w r0, r1, lr, asr #31
+; THUMB2-NEXT: adc r2, r2, #0
+; THUMB2-NEXT: mov r0, r12
+; THUMB2-NEXT: mov r1, r3
+; THUMB2-NEXT: pop {r4, pc}
+entry:
+ %sext.a = sext i16 %a to i32
+ %sext.b = sext i16 %b to i32
+ %mul = mul nsw i32 %sext.a, %sext.b
+ %sext.mul = sext i32 %mul to i64
+ %res = tail call { i64, i1 } @llvm.uadd.with.overflow.i64(i64 %acc, i64 %sext.mul)
+ ret { i64, i1 } %res
+}
+
+; FIXME: SMLAL does not set flags, so forming SMLAL when the ADDE overflow flag
+; is used duplicates the multiply-accumulate (SMULL+ADDS+ADCS and SMLAL).
+define { i64, i1 } @saddo_smlal(i64 %acc, i32 %a, i32 %b) {
+; ARM-LABEL: saddo_smlal:
+; ARM: @ %bb.0: @ %entry
+; ARM-NEXT: .save {r4, r5, r11, lr}
+; ARM-NEXT: push {r4, r5, r11, lr}
+; ARM-NEXT: smull r4, r5, r2, r3
+; ARM-NEXT: mov r12, r0
+; ARM-NEXT: mov lr, r1
+; ARM-NEXT: smlal r12, lr, r2, r3
+; ARM-NEXT: mov r2, #0
+; ARM-NEXT: adds r0, r0, r4
+; ARM-NEXT: adcs r0, r1, r5
+; ARM-NEXT: movwvs r2, #1
+; ARM-NEXT: mov r0, r12
+; ARM-NEXT: mov r1, lr
+; ARM-NEXT: pop {r4, r5, r11, pc}
+;
+; THUMB2-LABEL: saddo_smlal:
+; THUMB2: @ %bb.0: @ %entry
+; THUMB2-NEXT: .save {r4, r5, r7, lr}
+; THUMB2-NEXT: push {r4, r5, r7, lr}
+; THUMB2-NEXT: smull r4, r5, r2, r3
+; THUMB2-NEXT: mov r12, r0
+; THUMB2-NEXT: mov lr, r1
+; THUMB2-NEXT: smlal r12, lr, r2, r3
+; THUMB2-NEXT: movs r2, #0
+; THUMB2-NEXT: adds r0, r0, r4
+; THUMB2-NEXT: adcs.w r0, r1, r5
+; THUMB2-NEXT: it vs
+; THUMB2-NEXT: movvs r2, #1
+; THUMB2-NEXT: mov r0, r12
+; THUMB2-NEXT: mov r1, lr
+; THUMB2-NEXT: pop {r4, r5, r7, pc}
+entry:
+ %sext.a = sext i32 %a to i64
+ %sext.b = sext i32 %b to i64
+ %mul = mul nsw i64 %sext.a, %sext.b
+ %res = tail call { i64, i1 } @llvm.sadd.with.overflow.i64(i64 %acc, i64 %mul)
+ ret { i64, i1 } %res
+}
+
+; FIXME: UMLAL does not set flags, so forming UMLAL when the ADDE carry flag
+; is used duplicates the multiply-accumulate (UMULL+ADDS+ADCS and UMLAL).
+define { i64, i1 } @uaddo_umlal(i64 %acc, i32 %a, i32 %b) {
+; ARM-LABEL: uaddo_umlal:
+; ARM: @ %bb.0: @ %entry
+; ARM-NEXT: .save {r4, r5, r11, lr}
+; ARM-NEXT: push {r4, r5, r11, lr}
+; ARM-NEXT: umull r4, r5, r2, r3
+; ARM-NEXT: mov r12, r0
+; ARM-NEXT: mov lr, r1
+; ARM-NEXT: umlal r12, lr, r2, r3
+; ARM-NEXT: mov r2, #0
+; ARM-NEXT: adds r0, r0, r4
+; ARM-NEXT: adcs r0, r1, r5
+; ARM-NEXT: adc r2, r2, #0
+; ARM-NEXT: mov r0, r12
+; ARM-NEXT: mov r1, lr
+; ARM-NEXT: pop {r4, r5, r11, pc}
+;
+; THUMB2-LABEL: uaddo_umlal:
+; THUMB2: @ %bb.0: @ %entry
+; THUMB2-NEXT: .save {r4, r5, r7, lr}
+; THUMB2-NEXT: push {r4, r5, r7, lr}
+; THUMB2-NEXT: umull r4, r5, r2, r3
+; THUMB2-NEXT: mov r12, r0
+; THUMB2-NEXT: mov lr, r1
+; THUMB2-NEXT: umlal r12, lr, r2, r3
+; THUMB2-NEXT: movs r2, #0
+; THUMB2-NEXT: adds r0, r0, r4
+; THUMB2-NEXT: adcs.w r0, r1, r5
+; THUMB2-NEXT: adc r2, r2, #0
+; THUMB2-NEXT: mov r0, r12
+; THUMB2-NEXT: mov r1, lr
+; THUMB2-NEXT: pop {r4, r5, r7, pc}
+entry:
+ %zext.a = zext i32 %a to i64
+ %zext.b = zext i32 %b to i64
+ %mul = mul nuw i64 %zext.a, %zext.b
+ %res = tail call { i64, i1 } @llvm.uadd.with.overflow.i64(i64 %acc, i64 %mul)
+ ret { i64, i1 } %res
+}
+
+define { i64, i1 } @ssubo_smlal(i64 %acc, i32 %a, i32 %b) {
+; ARM-LABEL: ssubo_smlal:
+; ARM: @ %bb.0: @ %entry
+; ARM-NEXT: smull r3, r12, r2, r3
+; ARM-NEXT: mov r2, #0
+; ARM-NEXT: subs r0, r0, r3
+; ARM-NEXT: sbcs r1, r1, r12
+; ARM-NEXT: movwvs r2, #1
+; ARM-NEXT: bx lr
+;
+; THUMB2-LABEL: ssubo_smlal:
+; THUMB2: @ %bb.0: @ %entry
+; THUMB2-NEXT: smull r3, r12, r2, r3
+; THUMB2-NEXT: movs r2, #0
+; THUMB2-NEXT: subs r0, r0, r3
+; THUMB2-NEXT: sbcs.w r1, r1, r12
+; THUMB2-NEXT: it vs
+; THUMB2-NEXT: movvs r2, #1
+; THUMB2-NEXT: bx lr
+entry:
+ %sext.a = sext i32 %a to i64
+ %sext.b = sext i32 %b to i64
+ %mul = mul nsw i64 %sext.a, %sext.b
+ %res = tail call { i64, i1 } @llvm.ssub.with.overflow.i64(i64 %acc, i64 %mul)
+ ret { i64, i1 } %res
+}
+
+; FIXME: UMAAL does not set flags, so forming UMAAL when the ADDE carry flag
+; is used duplicates the multiply-accumulate.
+define { i64, i1 } @uaddo_umaal(i32 %a, i32 %b, i32 %lo, i32 %hi) {
+; ARM-LABEL: uaddo_umaal:
+; ARM: @ %bb.0: @ %entry
+; ARM-NEXT: .save {r4, r5, r11, lr}
+; ARM-NEXT: push {r4, r5, r11, lr}
+; ARM-NEXT: mov lr, r2
+; ARM-NEXT: mov r4, #0
+; ARM-NEXT: mov r5, lr
+; ARM-NEXT: mov r12, r3
+; ARM-NEXT: umlal r5, r4, r0, r1
+; ARM-NEXT: mov r2, #0
+; ARM-NEXT: umaal lr, r12, r0, r1
+; ARM-NEXT: adds r0, r5, r3
+; ARM-NEXT: adcs r0, r4, #0
+; ARM-NEXT: adc r2, r2, #0
+; ARM-NEXT: mov r0, lr
+; ARM-NEXT: mov r1, r12
+; ARM-NEXT: pop {r4, r5, r11, pc}
+;
+; THUMB2-LABEL: uaddo_umaal:
+; THUMB2: @ %bb.0: @ %entry
+; THUMB2-NEXT: .save {r4, r5, r7, lr}
+; THUMB2-NEXT: push {r4, r5, r7, lr}
+; THUMB2-NEXT: mov lr, r2
+; THUMB2-NEXT: movs r4, #0
+; THUMB2-NEXT: mov r5, lr
+; THUMB2-NEXT: mov r12, r3
+; THUMB2-NEXT: umlal r5, r4, r0, r1
+; THUMB2-NEXT: movs r2, #0
+; THUMB2-NEXT: umaal lr, r12, r0, r1
+; THUMB2-NEXT: adds r0, r5, r3
+; THUMB2-NEXT: adcs r0, r4, #0
+; THUMB2-NEXT: adc r2, r2, #0
+; THUMB2-NEXT: mov r0, lr
+; THUMB2-NEXT: mov r1, r12
+; THUMB2-NEXT: pop {r4, r5, r7, pc}
+entry:
+ %zext.a = zext i32 %a to i64
+ %zext.b = zext i32 %b to i64
+ %mul = mul nuw i64 %zext.a, %zext.b
+ %zext.lo = zext i32 %lo to i64
+ %add = add nuw i64 %mul, %zext.lo
+ %zext.hi = zext i32 %hi to i64
+ %res = tail call { i64, i1 } @llvm.uadd.with.overflow.i64(i64 %add, i64 %zext.hi)
+ ret { i64, i1 } %res
+}
More information about the llvm-branch-commits
mailing list