[llvm] r327424 - [DAGCombine] visitREM - Don't assume that one divrem isn't driving another

[Simon Pilgrim via llvm-commits]

Author: rksimon
Date: Tue Mar 13 10:17:15 2018
New Revision: 327424

URL: http://llvm.org/viewvc/llvm-project?rev=327424&view=rev
Log:
[DAGCombine] visitREM - Don't assume that one divrem isn't driving another

Under some circumstances the divrems won't have been combined together before getting to this code.

So replace the assertion with a if() guard to not expand to X-((X/C)*C) to give the other combine chance to happen.

Reduced from OSS-Fuzz #6883
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6883

Modified:
    llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
    llvm/trunk/test/CodeGen/X86/combine-srem.ll

Modified: llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp?rev=327424&r1=327423&r2=327424&view=diff
==============================================================================
--- llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp (original)
+++ llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp Tue Mar 13 10:17:15 2018
@@ -3068,9 +3068,9 @@ SDValue DAGCombiner::visitREM(SDNode *N)
     SDValue Div = DAG.getNode(DivOpcode, DL, VT, N0, N1);
     AddToWorklist(Div.getNode());
     SDValue OptimizedDiv = combine(Div.getNode());
-    if (OptimizedDiv.getNode() && OptimizedDiv.getNode() != Div.getNode()) {
-      assert((OptimizedDiv.getOpcode() != ISD::UDIVREM) &&
-             (OptimizedDiv.getOpcode() != ISD::SDIVREM));
+    if (OptimizedDiv.getNode() && OptimizedDiv.getNode() != Div.getNode() &&
+        OptimizedDiv.getOpcode() != ISD::UDIVREM &&
+        OptimizedDiv.getOpcode() != ISD::SDIVREM) {
       SDValue Mul = DAG.getNode(ISD::MUL, DL, VT, OptimizedDiv, N1);
       SDValue Sub = DAG.getNode(ISD::SUB, DL, VT, N0, Mul);
       AddToWorklist(Mul.getNode());

Modified: llvm/trunk/test/CodeGen/X86/combine-srem.ll
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/CodeGen/X86/combine-srem.ll?rev=327424&r1=327423&r2=327424&view=diff
==============================================================================
--- llvm/trunk/test/CodeGen/X86/combine-srem.ll (original)
+++ llvm/trunk/test/CodeGen/X86/combine-srem.ll Tue Mar 13 10:17:15 2018
@@ -131,3 +131,33 @@ define <4 x i32> @combine_vec_srem_by_po
   %2 = srem <4 x i32> %1, <i32 1, i32 4, i32 8, i32 16>
   ret <4 x i32> %2
 }
+
+; OSS-Fuzz #6883
+; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6883
+define i32 @ossfuzz6883() {
+; CHECK-LABEL: ossfuzz6883:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    movl (%rax), %ecx
+; CHECK-NEXT:    movl %ecx, %eax
+; CHECK-NEXT:    cltd
+; CHECK-NEXT:    idivl %ecx
+; CHECK-NEXT:    movl %edx, %esi
+; CHECK-NEXT:    movl $1, %edi
+; CHECK-NEXT:    cltd
+; CHECK-NEXT:    idivl %edi
+; CHECK-NEXT:    movl %edx, %edi
+; CHECK-NEXT:    xorl %edx, %edx
+; CHECK-NEXT:    movl %ecx, %eax
+; CHECK-NEXT:    divl %edi
+; CHECK-NEXT:    andl %esi, %eax
+; CHECK-NEXT:    retq
+  %B17 = or i32 0, 2147483647
+  %L6 = load i32, i32* undef
+  %B11 = sdiv i32 %L6, %L6
+  %B13 = udiv i32 %B17, %B17
+  %B14 = srem i32 %B11, %B13
+  %B16 = srem i32 %L6, %L6
+  %B10 = udiv i32 %L6, %B14
+  %B6 = and i32 %B16, %B10
+  ret i32 %B6
+}