[PATCH][DAG] Fix assertion failure caused by an invalid cast in method 'BuildVectorSDNode::isConstantSplat'.

[Andrea Di Biagio]

Hi,

This patch fixes an assertion failure in method
'BuildVectorSDNode::isConstantSplat'   caused by an illegal cast to
ConstantSDNode.

This is a regression introduced by revision 204071;  method
'BuildVectorSDNode::isConstantSplat'  has been introduced to simplify
part of the logic in DAGCombiner to retrieve the splat value from a
build vector of integer constants.

The static cast in method 'BuildVectorSDNode::isConstantSplat' is
invalid because the splat value found might not be always an instance
of ConstantSDNode.
For example, the found splat value would be UNDEF if method
'isConstantSplat' is called on a build vector of all UNDEF values.
Another example is the case where method 'isConstantSplat' is called
on a splat of a ConstantFPSNode.

Test 'shift-combine-crash.ll' is a reproducible for the assertion failure.

This patch renames method 'isConstantSplat' as 'getConstantSplatValue'
(mainly for consistency reasons), and rewrites its logic to ensure
that we always perform a legal 'cast<ConstantSDNode>'.

Please let me know if ok to submit.

Thanks,
Andrea Di Biagio
SN Systems - Sony Computer Entertainment
-------------- next part --------------
Index: lib/CodeGen/SelectionDAG/SelectionDAG.cpp
===================================================================
--- lib/CodeGen/SelectionDAG/SelectionDAG.cpp	(revision 204238)
+++ lib/CodeGen/SelectionDAG/SelectionDAG.cpp	(working copy)
@@ -6573,15 +6573,14 @@
   return true;
 }
 
-ConstantSDNode *BuildVectorSDNode::isConstantSplat() const {
+ConstantSDNode *BuildVectorSDNode::getConstantSplatValue() const {
   SDValue Op0 = getOperand(0);
-  for (unsigned i = 0, e = getNumOperands(); i != e; ++i) {
-    SDValue Opi = getOperand(i);
-    unsigned Opc = Opi.getOpcode();
-    if ((Opc != ISD::UNDEF && Opc != ISD::Constant && Opc != ISD::ConstantFP) ||
-        Opi != Op0)
+  if (Op0.getOpcode() != ISD::Constant)
+    return nullptr;
+
+  for (unsigned i = 1, e = getNumOperands(); i != e; ++i)
+    if (getOperand(i) != Op0)
       return nullptr;
-  }
 
   return cast<ConstantSDNode>(Op0);
 }
Index: lib/CodeGen/SelectionDAG/DAGCombiner.cpp
===================================================================
--- lib/CodeGen/SelectionDAG/DAGCombiner.cpp	(revision 204238)
+++ lib/CodeGen/SelectionDAG/DAGCombiner.cpp	(working copy)
@@ -667,7 +667,7 @@
     return CN;
 
   if (BuildVectorSDNode *BV = dyn_cast<BuildVectorSDNode>(N))
-    return BV->isConstantSplat();
+    return BV->getConstantSplatValue();
 
   return nullptr;
 }
Index: test/CodeGen/X86/shift-combine-crash.ll
===================================================================
--- test/CodeGen/X86/shift-combine-crash.ll	(revision 0)
+++ test/CodeGen/X86/shift-combine-crash.ll	(working copy)
@@ -0,0 +1,18 @@
+; RUN: llc < %s -mtriple=x86_64-unknown-linux-gnu -mcpu=corei7 > /dev/null
+
+; Verify that DAGCombiner doesn't crash with an assertion failure in the
+; attempt to cast a ISD::UNDEF node to a ConstantSDNode.
+
+; During type legalization, the vector shift operation in function @foo is
+; split into two legal shifts that work on <2 x i64> elements.
+; The first shift of the legalized sequence would be a shift by all undefs.
+; DAGCombiner will then try to simplify the vector shift and check if the
+; vector of shift counts is a splat. Make sure that llc doesn't crash
+; at that stage.
+
+
+define <4 x i64> @foo(<4 x i64> %A) {
+  %shl = shl <4 x i64> %A, <i64 undef, i64 undef, i64 1, i64 2>
+  ret <4 x i64> %shl
+}
+
Index: include/llvm/CodeGen/SelectionDAGNodes.h
===================================================================
--- include/llvm/CodeGen/SelectionDAGNodes.h	(revision 204238)
+++ include/llvm/CodeGen/SelectionDAGNodes.h	(working copy)
@@ -1522,10 +1522,11 @@
                        unsigned MinSplatBits = 0,
                        bool isBigEndian = false) const;
 
-  /// isConstantSplat - Simpler form of isConstantSplat. Get the constant splat
-  /// when you only care about the value. Returns nullptr if this isn't a
-  /// constant splat vector.
-  ConstantSDNode *isConstantSplat() const;
+  /// getConstantSplatValue - Check if this is a constant splat, and if so,
+  /// return the splat value only if it is a ConstantSDNode. Otherwise
+  /// return nullptr. This is a simpler form of isConstantSplat.
+  /// Get the constant splat only if you care about the splat value.
+  ConstantSDNode *getConstantSplatValue() const;
 
   bool isConstant() const;