[llvm] r356667 - [DAGCombine] SimplifySelectCC - call FoldSetCC with the setcc result type

[Simon Pilgrim via llvm-commits]

Author: rksimon
Date: Thu Mar 21 07:07:18 2019
New Revision: 356667

URL: http://llvm.org/viewvc/llvm-project?rev=356667&view=rev
Log:
[DAGCombine] SimplifySelectCC - call FoldSetCC with the setcc result type

We were calling FoldSetCC with the compare operand type instead of the result type.

Found by OSS-Fuzz #13838 (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13838)

Modified:
    llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
    llvm/trunk/test/CodeGen/X86/sse-minmax.ll

Modified: llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp?rev=356667&r1=356666&r2=356667&view=diff
==============================================================================
--- llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp (original)
+++ llvm/trunk/lib/CodeGen/SelectionDAG/DAGCombiner.cpp Thu Mar 21 07:07:18 2019
@@ -18948,13 +18948,14 @@ SDValue DAGCombiner::SimplifySelectCC(co
   if (N2 == N3) return N2;
 
   EVT CmpOpVT = N0.getValueType();
+  EVT CmpResVT = getSetCCResultType(CmpOpVT);
   EVT VT = N2.getValueType();
   auto *N1C = dyn_cast<ConstantSDNode>(N1.getNode());
   auto *N2C = dyn_cast<ConstantSDNode>(N2.getNode());
   auto *N3C = dyn_cast<ConstantSDNode>(N3.getNode());
 
   // Determine if the condition we're dealing with is constant.
-  if (SDValue SCC = DAG.FoldSetCC(VT, N0, N1, CC, DL)) {
+  if (SDValue SCC = DAG.FoldSetCC(CmpResVT, N0, N1, CC, DL)) {
     AddToWorklist(SCC.getNode());
     if (auto *SCCC = dyn_cast<ConstantSDNode>(SCC)) {
       // fold select_cc true, x, y -> x
@@ -19021,7 +19022,7 @@ SDValue DAGCombiner::SimplifySelectCC(co
     SDValue Temp, SCC;
     // zext (setcc n0, n1)
     if (LegalTypes) {
-      SCC = DAG.getSetCC(DL, getSetCCResultType(CmpOpVT), N0, N1, CC);
+      SCC = DAG.getSetCC(DL, CmpResVT, N0, N1, CC);
       if (VT.bitsLT(SCC.getValueType()))
         Temp = DAG.getZeroExtendInReg(SCC, SDLoc(N2), VT);
       else

Modified: llvm/trunk/test/CodeGen/X86/sse-minmax.ll
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/CodeGen/X86/sse-minmax.ll?rev=356667&r1=356666&r2=356667&view=diff
==============================================================================
--- llvm/trunk/test/CodeGen/X86/sse-minmax.ll (original)
+++ llvm/trunk/test/CodeGen/X86/sse-minmax.ll Thu Mar 21 07:07:18 2019
@@ -1345,3 +1345,19 @@ define <3 x float> @test_minps_illegal_v
   ret <3 x float> %min
 }
 
+; OSS-Fuzz #13838
+; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=13838
+define float @ossfuzz13838(float %x) {
+; ALL-LABEL: ossfuzz13838:
+; ALL:       # %bb.0: # %bb
+; ALL-NEXT:    movss {{.*#+}} xmm0 = mem[0],zero,zero,zero
+; ALL-NEXT:    retq
+bb:
+  %cmp2 = fcmp fast olt float %x, 2.550000e+02
+  %B1 = urem i1 %cmp2, %cmp2
+  %min = select i1 %B1, float %x, float 2.550000e+02
+  %B = frem float %min, 0x47EFFFFFE0000000
+  %cmp1 = fcmp fast olt float %B, 1.000000e+00
+  %r = select i1 %cmp1, float 1.000000e+00, float %min
+  ret float %r
+}