[llvm] r340015 - [DAGCombiner] extractShiftForRotate - fix out of range shift issue

[Simon Pilgrim via llvm-commits]

Author: rksimon
Date: Fri Aug 17 05:25:18 2018
New Revision: 340015

URL: http://llvm.org/viewvc/llvm-project?rev=340015&view=rev
Log:
[DAGCombiner] extractShiftForRotate - fix out of range shift issue

Don't just check for negative shift amounts.

Fixes OSS Fuzz #9935
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9935

Modified:
    llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
    llvm/trunk/test/CodeGen/X86/combine-rotates.ll

Modified: llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp?rev=340015&r1=340014&r2=340015&view=diff
==============================================================================
--- llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp (original)
+++ llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp Fri Aug 17 05:25:18 2018
@@ -5276,9 +5276,9 @@ static SDValue extractShiftForRotate(Sel
 
   // Compute the shift amount we need to extract to complete the rotate.
   const unsigned VTWidth = ShiftedVT.getScalarSizeInBits();
-  APInt NeededShiftAmt = VTWidth - OppShiftCst->getAPIntValue();
-  if (NeededShiftAmt.isNegative())
+  if (OppShiftCst->getAPIntValue().ugt(VTWidth))
     return SDValue();
+  APInt NeededShiftAmt = VTWidth - OppShiftCst->getAPIntValue();
   // Normalize the bitwidth of the two mul/udiv/shift constant operands.
   APInt ExtractFromAmt = ExtractFromCst->getAPIntValue();
   APInt OppLHSAmt = OppLHSCst->getAPIntValue();

Modified: llvm/trunk/test/CodeGen/X86/combine-rotates.ll
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/CodeGen/X86/combine-rotates.ll?rev=340015&r1=340014&r2=340015&view=diff
==============================================================================
--- llvm/trunk/test/CodeGen/X86/combine-rotates.ll (original)
+++ llvm/trunk/test/CodeGen/X86/combine-rotates.ll Fri Aug 17 05:25:18 2018
@@ -341,3 +341,16 @@ define <4 x i32> @rotate_demanded_bits_3
   %9 = or <4 x i32> %5, %8
   ret <4 x i32> %9
 }
+
+; OSS Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=9935
+define i32 @fuzz9935() {
+; CHECK-LABEL: fuzz9935:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    movl $-1, %eax
+; CHECK-NEXT:    retq
+  %1 = trunc i40 549755813887 to i32
+  %2 = mul i32 %1, %1
+  %3 = lshr i32 %2, %1
+  %4 = or i32 %3, %2
+  ret i32 %4
+}