[PATCH] D99792: [InstCombine] Fix out-of-bounds ashr(shl) optimization

[Jeroen Dobbelaere via Phabricator via llvm-commits]

jeroen.dobbelaere created this revision.
jeroen.dobbelaere added reviewers: fhahn, spatel, lebedev.ri, Bhramar.vatsa, craig.topper, RKSimon.
Herald added a subscriber: hiraditya.
jeroen.dobbelaere requested review of this revision.
Herald added a project: LLVM.
Herald added a subscriber: llvm-commits.

This fixes a crash found by the oss fuzzer and reported by @fhahn.
The suggestion of @RKSimon seems to be the correct fix here. (See D91343 <https://reviews.llvm.org/D91343>).

The oss fuzz report can be found here: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32759


https://reviews.llvm.org/D99792

Files:
  llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp
  llvm/test/Transforms/InstCombine/oss_fuzz_32759.ll


Index: llvm/test/Transforms/InstCombine/oss_fuzz_32759.ll
===================================================================
--- /dev/null
+++ llvm/test/Transforms/InstCombine/oss_fuzz_32759.ll
@@ -0,0 +1,29 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
+; RUN: opt < %s -instcombine -S | FileCheck %s
+target datalayout = "n32"
+
+define i1 @oss_fuzz_32759(i1 %y) {
+; CHECK-LABEL: @oss_fuzz_32759(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    br i1 undef, label [[COND_TRUE:%.*]], label [[END:%.*]]
+; CHECK:       cond.true:
+; CHECK-NEXT:    br label [[END]]
+; CHECK:       end:
+; CHECK-NEXT:    ret i1 false
+;
+entry:
+  br i1 undef, label %cond.true, label %end
+
+cond.true:                                        ; preds = %entry
+  %zy = zext i1 %y to i32
+  %B6 = shl i32 %zy, 2147483647
+  %B3 = ashr i32 %B6, 2147483647
+  %B7 = srem i32 %B3, 123
+  %cond = xor i32 %B7, %B3
+  br label %end
+
+end:                                              ; preds = %cond.true, %entry
+  %p = phi i32 [ %cond, %cond.true ], [ -1, %entry ]
+  %r = icmp eq i32 %p, 0
+  ret i1 %r
+}
Index: llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp
===================================================================
--- llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp
+++ llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp
@@ -927,7 +927,7 @@
     unsigned BitWidth = DemandedMask.getBitWidth();
     if (match(I,
               m_AShr(m_Shl(m_Value(X), m_APInt(ShiftLC)), m_APInt(ShiftRC))) &&
-        ShiftLC == ShiftRC &&
+        ShiftLC == ShiftRC && ShiftLC->ult(BitWidth) &&
         DemandedMask.isSubsetOf(APInt::getLowBitsSet(
             BitWidth, BitWidth - ShiftRC->getZExtValue()))) {
       return X;


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D99792.334934.patch
Type: text/x-patch
Size: 1784 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20210402/9bf44db0/attachment.bin>