[llvm] [VectorCombine] reject out-of-bounds extract indexes in foldExtractExtract (PR #194381)

[Arda Serdar Pektezol via llvm-commits]

https://github.com/pektezol updated https://github.com/llvm/llvm-project/pull/194381

>From acd504243dea54eab1e66f4b8e8c276446027a12 Mon Sep 17 00:00:00 2001
From: Arda Serdar Pektezol <arda at pektezol.dev>
Date: Mon, 27 Apr 2026 17:05:16 +0300
Subject: [PATCH 1/2] [VectorCombine] reject out-of-bounds extract indexes in
 foldExtractExtract

---
 llvm/lib/Transforms/Vectorize/VectorCombine.cpp |  7 +++++++
 .../VectorCombine/X86/extract-extract-oob.ll    | 17 +++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 llvm/test/Transforms/VectorCombine/X86/extract-extract-oob.ll

diff --git a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
index 29eced7ee9de1..b59d0d827e6ed 100644
--- a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
+++ b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
@@ -659,6 +659,13 @@ bool VectorCombine::foldExtractExtract(Instruction &I) {
       !match(I1, m_ExtractElt(m_Value(V1), m_ConstantInt(C1))) ||
       V0->getType() != V1->getType())
     return false;
+  
+  // For fixed-width vectors, reject out-of-bounds extract indexes
+  if (auto *FixedVecTy = dyn_cast<FixedVectorType>(V0->getType())) {
+    unsigned NumElts = FixedVecTy->getNumElements();
+    if (C0 >= NumElts || C1 >= NumElts)
+      return false;
+  }
 
   // If the scalar value 'I' is going to be re-inserted into a vector, then try
   // to create an extract to that same element. The extract/insert can be
diff --git a/llvm/test/Transforms/VectorCombine/X86/extract-extract-oob.ll b/llvm/test/Transforms/VectorCombine/X86/extract-extract-oob.ll
new file mode 100644
index 0000000000000..6358acf79032f
--- /dev/null
+++ b/llvm/test/Transforms/VectorCombine/X86/extract-extract-oob.ll
@@ -0,0 +1,17 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 6
+; RUN: opt -passes=vector-combine -S -mtriple=x86_64-- < %s | FileCheck %s
+
+define i8 @f() {
+; CHECK-LABEL: define i8 @f() {
+; CHECK-NEXT:  [[BB:.*:]]
+; CHECK-NEXT:    [[E:%.*]] = extractelement <8 x i8> zeroinitializer, i32 133769
+; CHECK-NEXT:    [[E6:%.*]] = extractelement <8 x i8> zeroinitializer, i32 1
+; CHECK-NEXT:    [[B:%.*]] = mul i8 [[E]], [[E6]]
+; CHECK-NEXT:    ret i8 [[B]]
+;
+BB:
+  %E = extractelement <8 x i8> zeroinitializer, i32 133769
+  %E6 = extractelement <8 x i8> zeroinitializer, i32 1
+  %B = mul i8 %E, %E6
+  ret i8 %B
+}

>From e432064800aeaecfb2b4a199ecbd240d721a7aa8 Mon Sep 17 00:00:00 2001
From: Arda Serdar Pektezol <arda at pektezol.dev>
Date: Mon, 27 Apr 2026 17:50:00 +0300
Subject: [PATCH 2/2] [VectorCombine] update test case extract-extract-oob.ll

---
 .../VectorCombine/X86/extract-extract-oob.ll  | 22 +++++++++----------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/llvm/test/Transforms/VectorCombine/X86/extract-extract-oob.ll b/llvm/test/Transforms/VectorCombine/X86/extract-extract-oob.ll
index 6358acf79032f..789d17733e807 100644
--- a/llvm/test/Transforms/VectorCombine/X86/extract-extract-oob.ll
+++ b/llvm/test/Transforms/VectorCombine/X86/extract-extract-oob.ll
@@ -1,17 +1,15 @@
 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 6
 ; RUN: opt -passes=vector-combine -S -mtriple=x86_64-- < %s | FileCheck %s
 
-define i8 @f() {
-; CHECK-LABEL: define i8 @f() {
-; CHECK-NEXT:  [[BB:.*:]]
-; CHECK-NEXT:    [[E:%.*]] = extractelement <8 x i8> zeroinitializer, i32 133769
-; CHECK-NEXT:    [[E6:%.*]] = extractelement <8 x i8> zeroinitializer, i32 1
-; CHECK-NEXT:    [[B:%.*]] = mul i8 [[E]], [[E6]]
-; CHECK-NEXT:    ret i8 [[B]]
+define i8 @PR194355() {
+; CHECK-LABEL: define i8 @PR194355() {
+; CHECK-NEXT:    [[X:%.*]] = extractelement <8 x i8> zeroinitializer, i32 133769
+; CHECK-NEXT:    [[Y:%.*]] = extractelement <8 x i8> zeroinitializer, i32 1
+; CHECK-NEXT:    [[Z:%.*]] = mul i8 [[X]], [[Y]]
+; CHECK-NEXT:    ret i8 [[Z]]
 ;
-BB:
-  %E = extractelement <8 x i8> zeroinitializer, i32 133769
-  %E6 = extractelement <8 x i8> zeroinitializer, i32 1
-  %B = mul i8 %E, %E6
-  ret i8 %B
+  %x = extractelement <8 x i8> zeroinitializer, i32 133769
+  %y = extractelement <8 x i8> zeroinitializer, i32 1
+  %z = mul i8 %x, %y
+  ret i8 %z
 }