[llvm] 2a2d242 - [DAGCombine] foldVSelectOfConstants - ensure constants are same type

[Simon Pilgrim via llvm-commits]

Author: Simon Pilgrim
Date: 2020-03-12T20:02:05Z
New Revision: 2a2d24201750117fca9db7aceff862ac6e16f2cf

URL: https://github.com/llvm/llvm-project/commit/2a2d24201750117fca9db7aceff862ac6e16f2cf
DIFF: https://github.com/llvm/llvm-project/commit/2a2d24201750117fca9db7aceff862ac6e16f2cf.diff

LOG: [DAGCombine] foldVSelectOfConstants - ensure constants are same type

Fix bug identified by https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21167, foldVSelectOfConstants must ensure that the 2 build vectors have scalars of the same type before trying to compare APInt values.

Added: 
    

Modified: 
    llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
    llvm/test/CodeGen/X86/vselect-constants.ll

Removed: 
    


################################################################################
diff  --git a/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp b/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
index 85a2302e1a28..b9bbf5179884 100644
--- a/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
+++ b/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
@@ -8975,6 +8975,8 @@ SDValue DAGCombiner::foldVSelectOfConstants(SDNode *N) {
     SDValue N2Elt = N2.getOperand(i);
     if (N1Elt.isUndef() || N2Elt.isUndef())
       continue;
+    if (N1Elt.getValueType() != N2Elt.getValueType())
+      continue;
 
     const APInt &C1 = cast<ConstantSDNode>(N1Elt)->getAPIntValue();
     const APInt &C2 = cast<ConstantSDNode>(N2Elt)->getAPIntValue();

diff  --git a/llvm/test/CodeGen/X86/vselect-constants.ll b/llvm/test/CodeGen/X86/vselect-constants.ll
index d19318441903..f0ac42d1455f 100644
--- a/llvm/test/CodeGen/X86/vselect-constants.ll
+++ b/llvm/test/CodeGen/X86/vselect-constants.ll
@@ -256,3 +256,42 @@ define <4 x i32> @cmp_sel_0_or_1_vec(<4 x i32> %x, <4 x i32> %y) {
   ret <4 x i32> %add
 }
 
+; https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21167
+define <2 x i37> @ossfuzz21167(<2 x i37> %x, <2 x i37> %y) {
+; SSE-LABEL: ossfuzz21167:
+; SSE:       # %bb.0: # %BB
+; SSE-NEXT:    psllq $27, %xmm1
+; SSE-NEXT:    movdqa %xmm1, %xmm0
+; SSE-NEXT:    psrad $27, %xmm0
+; SSE-NEXT:    pshufd {{.*#+}} xmm0 = xmm0[1,3,2,3]
+; SSE-NEXT:    psrlq $27, %xmm1
+; SSE-NEXT:    pshufd {{.*#+}} xmm1 = xmm1[0,2,2,3]
+; SSE-NEXT:    punpckldq {{.*#+}} xmm1 = xmm1[0],xmm0[0],xmm1[1],xmm0[1]
+; SSE-NEXT:    movdqa {{.*#+}} xmm0 = [2147483648,2147483648]
+; SSE-NEXT:    pxor %xmm0, %xmm1
+; SSE-NEXT:    movdqa %xmm1, %xmm2
+; SSE-NEXT:    pcmpgtd %xmm0, %xmm2
+; SSE-NEXT:    pcmpeqd %xmm0, %xmm1
+; SSE-NEXT:    pshufd {{.*#+}} xmm1 = xmm1[1,1,3,3]
+; SSE-NEXT:    pand %xmm2, %xmm1
+; SSE-NEXT:    pshufd {{.*#+}} xmm0 = xmm2[1,1,3,3]
+; SSE-NEXT:    por %xmm1, %xmm0
+; SSE-NEXT:    pand {{.*}}(%rip), %xmm0
+; SSE-NEXT:    retq
+;
+; AVX-LABEL: ossfuzz21167:
+; AVX:       # %bb.0: # %BB
+; AVX-NEXT:    vpsllq $27, %xmm1, %xmm0
+; AVX-NEXT:    vpsrad $27, %xmm0, %xmm1
+; AVX-NEXT:    vpsrlq $27, %xmm0, %xmm0
+; AVX-NEXT:    vpblendw {{.*#+}} xmm0 = xmm0[0,1],xmm1[2,3],xmm0[4,5],xmm1[6,7]
+; AVX-NEXT:    vpxor %xmm1, %xmm1, %xmm1
+; AVX-NEXT:    vpcmpgtq %xmm1, %xmm0, %xmm0
+; AVX-NEXT:    vpsrlq $63, %xmm0, %xmm0
+; AVX-NEXT:    retq
+BB:
+  %c0 = icmp sgt <2 x i37> %y, zeroinitializer
+  %xor_x = xor <2 x i37> undef, undef
+  %smax96 = select <2 x i1> %c0, <2 x i37> %xor_x, <2 x i37> zeroinitializer
+  ret <2 x i37> %smax96
+}