[llvm] 67299aa - [InstCombine] add check for integer source type from cast to prevent crash

[Sanjay Patel via llvm-commits]

Author: Sanjay Patel
Date: 2021-11-10T09:44:55-05:00
New Revision: 67299aa84f50876b7f5472b38ee2e0f00714788a

URL: https://github.com/llvm/llvm-project/commit/67299aa84f50876b7f5472b38ee2e0f00714788a
DIFF: https://github.com/llvm/llvm-project/commit/67299aa84f50876b7f5472b38ee2e0f00714788a.diff

LOG: [InstCombine] add check for integer source type from cast to prevent crash

A problem was noted in the post-commit review for
c36b7e21bd8f04a44d6 / D113035 :

If the source type is not integer or integer vector,
then we could crash when trying to ComputeNumSignBits().

Added: 
    

Modified: 
    llvm/lib/Transforms/InstCombine/InstCombineAndOrXor.cpp
    llvm/test/Transforms/InstCombine/logical-select.ll

Removed: 
    


################################################################################
diff  --git a/llvm/lib/Transforms/InstCombine/InstCombineAndOrXor.cpp b/llvm/lib/Transforms/InstCombine/InstCombineAndOrXor.cpp
index 9b9b0c0c9af3..a42caeb4e638 100644
--- a/llvm/lib/Transforms/InstCombine/InstCombineAndOrXor.cpp
+++ b/llvm/lib/Transforms/InstCombine/InstCombineAndOrXor.cpp
@@ -2235,10 +2235,12 @@ Value *InstCombinerImpl::getSelectCondition(Value *A, Value *B) {
     // element. That could allow poison in lanes where it was not present in the
     // original code.
     A = peekThroughBitcast(A);
-    unsigned NumSignBits = ComputeNumSignBits(A);
-    if (NumSignBits == A->getType()->getScalarSizeInBits() &&
-        NumSignBits <= Ty->getScalarSizeInBits())
-      return Builder.CreateTrunc(A, CmpInst::makeCmpResultType(A->getType()));
+    if (A->getType()->isIntOrIntVectorTy()) {
+      unsigned NumSignBits = ComputeNumSignBits(A);
+      if (NumSignBits == A->getType()->getScalarSizeInBits() &&
+          NumSignBits <= Ty->getScalarSizeInBits())
+        return Builder.CreateTrunc(A, CmpInst::makeCmpResultType(A->getType()));
+    }
     return nullptr;
   }
 

diff  --git a/llvm/test/Transforms/InstCombine/logical-select.ll b/llvm/test/Transforms/InstCombine/logical-select.ll
index 3e3cc11e6591..1ec5b308277b 100644
--- a/llvm/test/Transforms/InstCombine/logical-select.ll
+++ b/llvm/test/Transforms/InstCombine/logical-select.ll
@@ -768,3 +768,62 @@ define <2 x i16> @bitcast_vec_cond_commute3(<4 x i8> %cond, <2 x i16> %pc, <2 x
   %r = or <2 x i16> %t11, %t12
   ret <2 x i16> %r
 }
+
+; Don't crash on invalid type for compute signbits.
+
+define <2 x i64> @bitcast_fp_vec_cond(<2 x double> %s, <2 x i64> %c, <2 x i64> %d) {
+; CHECK-LABEL: @bitcast_fp_vec_cond(
+; CHECK-NEXT:    [[T9:%.*]] = bitcast <2 x double> [[S:%.*]] to <2 x i64>
+; CHECK-NEXT:    [[NOTT9:%.*]] = xor <2 x i64> [[T9]], <i64 -1, i64 -1>
+; CHECK-NEXT:    [[T11:%.*]] = and <2 x i64> [[NOTT9]], [[C:%.*]]
+; CHECK-NEXT:    [[T12:%.*]] = and <2 x i64> [[T9]], [[D:%.*]]
+; CHECK-NEXT:    [[R:%.*]] = or <2 x i64> [[T11]], [[T12]]
+; CHECK-NEXT:    ret <2 x i64> [[R]]
+;
+  %t9 = bitcast <2 x double> %s to <2 x i64>
+  %nott9 = xor <2 x i64> %t9, <i64 -1, i64 -1>
+  %t11 = and <2 x i64> %nott9, %c
+  %t12 = and <2 x i64> %t9, %d
+  %r = or <2 x i64> %t11, %t12
+  ret <2 x i64> %r
+}
+
+; Wider source type would be ok except poison could leak across elements.
+
+define <2 x i64> @bitcast_int_vec_cond(i1 %b, <2 x i64> %c, <2 x i64> %d) {
+; CHECK-LABEL: @bitcast_int_vec_cond(
+; CHECK-NEXT:    [[S:%.*]] = sext i1 [[B:%.*]] to i128
+; CHECK-NEXT:    [[T9:%.*]] = bitcast i128 [[S]] to <2 x i64>
+; CHECK-NEXT:    [[NOTT9:%.*]] = xor <2 x i64> [[T9]], <i64 -1, i64 -1>
+; CHECK-NEXT:    [[T11:%.*]] = and <2 x i64> [[NOTT9]], [[C:%.*]]
+; CHECK-NEXT:    [[T12:%.*]] = and <2 x i64> [[T9]], [[D:%.*]]
+; CHECK-NEXT:    [[R:%.*]] = or <2 x i64> [[T11]], [[T12]]
+; CHECK-NEXT:    ret <2 x i64> [[R]]
+;
+  %s = sext i1 %b to i128
+  %t9 = bitcast i128 %s to <2 x i64>
+  %nott9 = xor <2 x i64> %t9, <i64 -1, i64 -1>
+  %t11 = and <2 x i64> %nott9, %c
+  %t12 = and <2 x i64> %t9, %d
+  %r = or <2 x i64> %t11, %t12
+  ret <2 x i64> %r
+}
+
+; Converting integer logic ops to vector select is allowed.
+
+define i64 @bitcast_int_scalar_cond(<2 x i1> %b, i64 %c, i64 %d) {
+; CHECK-LABEL: @bitcast_int_scalar_cond(
+; CHECK-NEXT:    [[TMP1:%.*]] = bitcast i64 [[D:%.*]] to <2 x i32>
+; CHECK-NEXT:    [[TMP2:%.*]] = bitcast i64 [[C:%.*]] to <2 x i32>
+; CHECK-NEXT:    [[TMP3:%.*]] = select <2 x i1> [[B:%.*]], <2 x i32> [[TMP1]], <2 x i32> [[TMP2]]
+; CHECK-NEXT:    [[TMP4:%.*]] = bitcast <2 x i32> [[TMP3]] to i64
+; CHECK-NEXT:    ret i64 [[TMP4]]
+;
+  %s = sext <2 x i1> %b to <2 x i32>
+  %t9 = bitcast <2 x i32> %s to i64
+  %nott9 = xor i64 %t9, -1
+  %t11 = and i64 %nott9, %c
+  %t12 = and i64 %t9, %d
+  %r = or i64 %t11, %t12
+  ret i64 %r
+}