[llvm-bugs] [Bug 51281] New: [X86][AVX] Incorrect decoding of constant vector data from X86ISD::SUBV_BROADCAST_LOAD nodes

[via llvm-bugs]

https://bugs.llvm.org/show_bug.cgi?id=51281

            Bug ID: 51281
           Summary: [X86][AVX] Incorrect decoding of constant vector data
                    from X86ISD::SUBV_BROADCAST_LOAD nodes
           Product: libraries
           Version: trunk
          Hardware: PC
                OS: Windows NT
            Status: NEW
          Severity: enhancement
          Priority: P
         Component: Backend: X86
          Assignee: llvm-dev at redking.me.uk
          Reporter: llvm-dev at redking.me.uk
                CC: craig.topper at gmail.com, llvm-bugs at lists.llvm.org,
                    llvm-dev at redking.me.uk, pengfei.wang at intel.com,
                    spatel+llvm at rotateright.com

Internal fuzz tests have found an issue that appeared after rGc8472db0a88701.

The more aggressive creation of X86ISD::SUBV_BROADCAST_LOAD nodes has exposed
an existing bug with incorrect constant decoding in
getTargetConstantBitsFromNode if its referencing a constant pool entry larger
than the subvector size.

define <16 x float> @shuffc(<8 x float> %a0) {
  %shuffle = shufflevector <8 x float> %a0, <8 x float> <float poison, float
0x3FD6BB78C0000000, float poison, float poison, float poison, float poison,
float 0.000000e+00, float poison>, <16 x i32> <i32 7, i32 7, i32 1, i32 1, i32
6, i32 3, i32 6, i32 0, i32 14, i32 0, i32 9, i32 9, i32 7, i32 1, i32 5, i32
9>
  ret <16 x float> %shuffle
}

https://c.godbolt.org/z/b9W3xKe1e

codegen (same for trunk and 12.x):

shuffc:                                 # @shuffc
        vextractf128    xmm1, ymm0, 1
        vperm2f128      ymm3, ymm0, ymm0, 1     # ymm3 = ymm0[2,3,0,1]
        vshufps xmm2, xmm0, xmm1, 49            # xmm2 = xmm0[1,0],xmm1[3,0]
        vshufps xmm1, xmm2, xmm1, 210           # xmm1 = xmm2[2,0],xmm1[1,3]
        vmovsldup       xmm2, xmm0              # xmm2 = xmm0[0,0,2,2]
        vblendps        ymm0, ymm3, ymm0, 66            # ymm0 =
ymm3[0],ymm0[1],ymm3[2,3,4,5],ymm0[6],ymm3[7]
        vpermilps       ymm0, ymm0, ymmword ptr [rip + .LCPI0_1] # ymm0 =
ymm0[3,3,1,1,6,7,6,4]
        vinsertf128     ymm1, ymm2, xmm1, 1
        vblendps        ymm1, ymm1, ymmword ptr [rip + .LCPI0_0], 141 # ymm1 =
mem[0],ymm1[1],mem[2,3],ymm1[4,5,6],mem[7]
        ret

trunk constant table:

.LCPI0_0:
        .long   0x00000000                      # float 0
        .zero   4
        .long   0x3eb5dbc6                      # float 0.355192363
        .long   0x3eb5dbc6                      # float 0.355192363
        .zero   4
        .long   0x3eb5dbc6                      # float 0.355192363
        .zero   4
        .zero   4

12.x constant table:

.LCPI0_0:
        .long   0x00000000                      # float 0
        .zero   4
        .long   0x3eb5dbc6                      # float 0.355192363
        .long   0x3eb5dbc6                      # float 0.355192363
        .zero   4
        .long   0x3eb5dbc6                      # float 0.355192363
        .long   0x3eb5dbc6                      # float 0.355192363
        .long   0x3eb5dbc6                      # float 0.355192363

I'm currently working on a patch.

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20210730/733f662f/attachment.html>