[llvm] 822392d - [VectorCombine] reject out-of-bounds extract indexes in foldExtractExtract (#194381)

[via llvm-commits]

Author: Arda Serdar Pektezol
Date: 2026-04-27T22:57:22Z
New Revision: 822392d2dda851139b840b24672294378d5cc29f

URL: https://github.com/llvm/llvm-project/commit/822392d2dda851139b840b24672294378d5cc29f
DIFF: https://github.com/llvm/llvm-project/commit/822392d2dda851139b840b24672294378d5cc29f.diff

LOG: [VectorCombine] reject out-of-bounds extract indexes in foldExtractExtract (#194381)

Fixes #194355

`VectorCombine::foldExtractExtract()` matches any constant-index
`extractelement` operands, but it never verifies that they are in range
for a fixed-width vector.

Added: 
    llvm/test/Transforms/VectorCombine/X86/extract-extract-oob.ll

Modified: 
    llvm/lib/Transforms/Vectorize/VectorCombine.cpp

Removed: 
    


################################################################################
diff  --git a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
index 29eced7ee9de1..5ba344ea9a808 100644
--- a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
+++ b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
@@ -660,6 +660,13 @@ bool VectorCombine::foldExtractExtract(Instruction &I) {
       V0->getType() != V1->getType())
     return false;
 
+  // For fixed-width vectors, reject out-of-bounds extract indexes
+  if (auto *FixedVecTy = dyn_cast<FixedVectorType>(V0->getType())) {
+    unsigned NumElts = FixedVecTy->getNumElements();
+    if (C0 >= NumElts || C1 >= NumElts)
+      return false;
+  }
+
   // If the scalar value 'I' is going to be re-inserted into a vector, then try
   // to create an extract to that same element. The extract/insert can be
   // reduced to a "select shuffle".

diff  --git a/llvm/test/Transforms/VectorCombine/X86/extract-extract-oob.ll b/llvm/test/Transforms/VectorCombine/X86/extract-extract-oob.ll
new file mode 100644
index 0000000000000..789d17733e807
--- /dev/null
+++ b/llvm/test/Transforms/VectorCombine/X86/extract-extract-oob.ll
@@ -0,0 +1,15 @@
+; NOTE: Assertions have been autogenerated by utils/update_test_checks.py UTC_ARGS: --version 6
+; RUN: opt -passes=vector-combine -S -mtriple=x86_64-- < %s | FileCheck %s
+
+define i8 @PR194355() {
+; CHECK-LABEL: define i8 @PR194355() {
+; CHECK-NEXT:    [[X:%.*]] = extractelement <8 x i8> zeroinitializer, i32 133769
+; CHECK-NEXT:    [[Y:%.*]] = extractelement <8 x i8> zeroinitializer, i32 1
+; CHECK-NEXT:    [[Z:%.*]] = mul i8 [[X]], [[Y]]
+; CHECK-NEXT:    ret i8 [[Z]]
+;
+  %x = extractelement <8 x i8> zeroinitializer, i32 133769
+  %y = extractelement <8 x i8> zeroinitializer, i32 1
+  %z = mul i8 %x, %y
+  ret i8 %z
+}