[PATCH] D129306: [InstCombine] Do not fold 'and (sext (ashr X, Shift)), C' if Shift < 0

[Daniel Bertalan via Phabricator via llvm-commits]

BertalanD created this revision.
BertalanD added reviewers: fhahn, spatel.
Herald added a subscriber: hiraditya.
Herald added a project: All.
BertalanD requested review of this revision.
Herald added a project: LLVM.
Herald added a subscriber: llvm-commits.

The 'and (sext (ashr X, ShiftC)), C' --> 'lshr (sext X), ShiftC'
transformation would access out of bounds bits in APInt::getLowBitsSet
if the shift count was larger than X's bit width or negative.

Fixes #56424


https://reviews.llvm.org/D129306

Files:
  llvm/lib/Transforms/InstCombine/InstCombineAndOrXor.cpp
  llvm/test/Transforms/InstCombine/pr56424.ll


Index: llvm/test/Transforms/InstCombine/pr56424.ll
===================================================================
--- /dev/null
+++ llvm/test/Transforms/InstCombine/pr56424.ll
@@ -0,0 +1,26 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
+; RUN: opt < %s -instcombine -S | FileCheck %s
+
+; This would crash if we didn't check for a negative shift.
+define i64 @test(i1, i32) {
+; CHECK-LABEL: @test(
+; CHECK-NEXT:  entry:
+; CHECK-NEXT:    br i1 [[TMP0:%.*]], label [[IF_THEN:%.*]], label [[IF_END:%.*]]
+; CHECK:       if.then:
+; CHECK-NEXT:    br label [[IF_END]]
+; CHECK:       if.end:
+; CHECK-NEXT:    ret i64 0
+;
+entry:
+  br i1 %0, label %if.then, label %if.end
+
+if.then:
+  %shr  = ashr i32 %1, -2
+  %sext = sext i32 %shr to i64
+  br label %if.end
+
+if.end:
+  %val = phi i64 [ %sext, %if.then ], [ 0, %entry ]
+  %and = and i64 -81, %val
+  ret i64 %and
+}
Index: llvm/lib/Transforms/InstCombine/InstCombineAndOrXor.cpp
===================================================================
--- llvm/lib/Transforms/InstCombine/InstCombineAndOrXor.cpp
+++ llvm/lib/Transforms/InstCombine/InstCombineAndOrXor.cpp
@@ -1808,7 +1808,8 @@
 
     unsigned Width = Ty->getScalarSizeInBits();
     const APInt *ShiftC;
-    if (match(Op0, m_OneUse(m_SExt(m_AShr(m_Value(X), m_APInt(ShiftC)))))) {
+    if (match(Op0, m_OneUse(m_SExt(m_AShr(m_Value(X), m_APInt(ShiftC))))) &&
+        ShiftC->ult(Width)) {
       if (*C == APInt::getLowBitsSet(Width, Width - ShiftC->getZExtValue())) {
         // We are clearing high bits that were potentially set by sext+ashr:
         // and (sext (ashr X, ShiftC)), C --> lshr (sext X), ShiftC


-------------- next part --------------
A non-text attachment was scrubbed...
Name: D129306.442955.patch
Type: text/x-patch
Size: 1676 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/llvm-commits/attachments/20220707/8321473d/attachment.bin>