[llvm] [AMDGPU] PromoteAlloca: handle out-of-bounds GEP for shufflevector (PR #139700)
Robert Imschweiler via llvm-commits
llvm-commits at lists.llvm.org
Wed May 21 04:52:40 PDT 2025
https://github.com/ro-i updated https://github.com/llvm/llvm-project/pull/139700
>From dce5aea73ced4c3bc48a6443dd49f34b9353c468 Mon Sep 17 00:00:00 2001
From: Robert Imschweiler <robert.imschweiler at amd.com>
Date: Wed, 21 May 2025 04:40:56 -0500
Subject: [PATCH 1/3] [AMDGPU] PromoteAlloca: handle out-of-bounds GEP for
shufflevector
This LLVM defect was identified via the AMD Fuzzing project.
---
.../lib/Target/AMDGPU/AMDGPUPromoteAlloca.cpp | 4 +-
.../AMDGPU/promote-alloca-shufflevector.ll | 45 +++++++++++++++++++
2 files changed, 48 insertions(+), 1 deletion(-)
create mode 100644 llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll
diff --git a/llvm/lib/Target/AMDGPU/AMDGPUPromoteAlloca.cpp b/llvm/lib/Target/AMDGPU/AMDGPUPromoteAlloca.cpp
index 933ee6ceeaf4a..517d05f6514d5 100644
--- a/llvm/lib/Target/AMDGPU/AMDGPUPromoteAlloca.cpp
+++ b/llvm/lib/Target/AMDGPU/AMDGPUPromoteAlloca.cpp
@@ -666,7 +666,9 @@ static Value *promoteAllocaUserToVector(
SmallVector<int> Mask;
for (unsigned Idx = 0; Idx < VectorTy->getNumElements(); ++Idx) {
if (Idx >= DestBegin && Idx < DestBegin + NumCopied) {
- Mask.push_back(SrcBegin++);
+ Mask.push_back(SrcBegin < VectorTy->getNumElements()
+ ? SrcBegin++
+ : PoisonMaskElem);
} else {
Mask.push_back(Idx);
}
diff --git a/llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll b/llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll
new file mode 100644
index 0000000000000..82f3ded6e9267
--- /dev/null
+++ b/llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll
@@ -0,0 +1,45 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 5
+; RUN: opt -mtriple amdgcn -passes=amdgpu-promote-alloca-to-vector -S < %s | FileCheck %s
+
+; Skip promote-alloca in case of an index which is known to be out of bounds.
+
+define amdgpu_kernel void @out_of_bounds() {
+; CHECK-LABEL: define amdgpu_kernel void @out_of_bounds() {
+; CHECK-NEXT: [[PTR:%.*]] = freeze <4 x float> poison
+; CHECK-NEXT: [[TMP1:%.*]] = shufflevector <4 x float> [[PTR]], <4 x float> poison, <4 x i32> <i32 poison, i32 poison, i32 2, i32 3>
+; CHECK-NEXT: ret void
+;
+ %ptr = alloca [4 x float], align 4, addrspace(5)
+ %elem_ptr = getelementptr [4 x float], ptr addrspace(5) %ptr, i32 0, i32 42
+ call void @llvm.memcpy.p5.p5.i32(ptr addrspace(5) %ptr, ptr addrspace(5) %elem_ptr, i32 8, i1 false)
+ ret void
+}
+
+define amdgpu_kernel void @memcpy_partially_out_of_bounds() {
+; CHECK-LABEL: define amdgpu_kernel void @partially_out_of_bounds() {
+; CHECK-NEXT: [[PTR:%.*]] = freeze <3 x float> poison
+; CHECK-NEXT: [[TMP1:%.*]] = shufflevector <3 x float> [[PTR]], <3 x float> poison, <3 x i32> <i32 2, i32 poison, i32 2>
+; CHECK-NEXT: ret void
+;
+ %ptr = alloca [3 x float], align 4, addrspace(5)
+ %elem_ptr = getelementptr [3 x float], ptr addrspace(5) %ptr, i32 0, i32 2
+ call void @llvm.memcpy.p5.p5.i32(ptr addrspace(5) %ptr, ptr addrspace(5) %elem_ptr, i32 8, i1 false)
+ ret void
+}
+
+define amdgpu_kernel void @in_bounds() {
+; CHECK-LABEL: define amdgpu_kernel void @in_bounds() {
+; CHECK-NEXT: [[PTR:%.*]] = freeze <4 x float> poison
+; CHECK-NEXT: [[TMP1:%.*]] = shufflevector <4 x float> [[PTR]], <4 x float> poison, <4 x i32> <i32 2, i32 3, i32 2, i32 3>
+; CHECK-NEXT: ret void
+;
+ %ptr = alloca [4 x float], align 4, addrspace(5)
+ %elem_ptr = getelementptr [4 x float], ptr addrspace(5) %ptr, i32 0, i32 2
+ call void @llvm.memcpy.p5.p5.i32(ptr addrspace(5) %ptr, ptr addrspace(5) %elem_ptr, i32 8, i1 false)
+ ret void
+}
+
+; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: readwrite)
+declare void @llvm.memcpy.p5.p5.i32(ptr addrspace(5) writeonly captures(none), ptr addrspace(5) readonly captures(none), i32, i1 immarg) #0
+
+attributes #0 = { nocallback nofree nounwind willreturn memory(argmem: readwrite) }
>From 04afda3ed5defd3725262afb43833ab92adf967d Mon Sep 17 00:00:00 2001
From: Robert Imschweiler <robert.imschweiler at amd.com>
Date: Wed, 21 May 2025 06:51:38 -0500
Subject: [PATCH 2/3] fix typo
---
llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll b/llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll
index 82f3ded6e9267..7aa650377e317 100644
--- a/llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll
+++ b/llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll
@@ -16,7 +16,7 @@ define amdgpu_kernel void @out_of_bounds() {
}
define amdgpu_kernel void @memcpy_partially_out_of_bounds() {
-; CHECK-LABEL: define amdgpu_kernel void @partially_out_of_bounds() {
+; CHECK-LABEL: define amdgpu_kernel void @memcpy_partially_out_of_bounds() {
; CHECK-NEXT: [[PTR:%.*]] = freeze <3 x float> poison
; CHECK-NEXT: [[TMP1:%.*]] = shufflevector <3 x float> [[PTR]], <3 x float> poison, <3 x i32> <i32 2, i32 poison, i32 2>
; CHECK-NEXT: ret void
>From 74378e118ff03fff83e2e9edc35a3cfb630b4547 Mon Sep 17 00:00:00 2001
From: Robert Imschweiler <robert.imschweiler at amd.com>
Date: Wed, 21 May 2025 13:52:32 +0200
Subject: [PATCH 3/3] Update
llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll
Co-authored-by: Matt Arsenault <arsenm2 at gmail.com>
---
llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll | 1 -
1 file changed, 1 deletion(-)
diff --git a/llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll b/llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll
index 7aa650377e317..c16d0e8381ecd 100644
--- a/llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll
+++ b/llvm/test/CodeGen/AMDGPU/promote-alloca-shufflevector.ll
@@ -39,7 +39,6 @@ define amdgpu_kernel void @in_bounds() {
ret void
}
-; Function Attrs: nocallback nofree nounwind willreturn memory(argmem: readwrite)
declare void @llvm.memcpy.p5.p5.i32(ptr addrspace(5) writeonly captures(none), ptr addrspace(5) readonly captures(none), i32, i1 immarg) #0
attributes #0 = { nocallback nofree nounwind willreturn memory(argmem: readwrite) }
More information about the llvm-commits
mailing list