[llvm] [VectorCombine] Fix assertion failure with out of bounds extractelement (PR #206489)

[Nikita Popov via llvm-commits]

https://github.com/nikic created https://github.com/llvm/llvm-project/pull/206489

Bail out if the extractelement index is out of bounds, otherwise we'll assert when trying to create the shuffle mask.

>From 0ca535fcdf0508a43fa55c8aa5e0b53fdf9bf075 Mon Sep 17 00:00:00 2001
From: Nikita Popov <npopov at redhat.com>
Date: Mon, 29 Jun 2026 15:18:24 +0200
Subject: [PATCH] [VectorCombine] Fix assertion failure with out of bounds
 extractelement

Bail out if the extractelement index is out of bounds, otherwise
we'll assert when trying to create the shuffle mask.
---
 llvm/lib/Transforms/Vectorize/VectorCombine.cpp |  3 +++
 .../VectorCombine/X86/extract-cmp-binop.ll      | 17 +++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
index c1d4c528a6158..7ac57cd13609b 100644
--- a/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
+++ b/llvm/lib/Transforms/Vectorize/VectorCombine.cpp
@@ -1516,6 +1516,9 @@ bool VectorCombine::foldExtractedCmps(Instruction &I) {
   if (!VecTy)
     return false;
 
+  if (Index0 >= VecTy->getNumElements() || Index1 >= VecTy->getNumElements())
+    return false;
+
   InstructionCost Ext0Cost =
       TTI.getVectorInstrCost(*Ext0, VecTy, CostKind, Index0);
   InstructionCost Ext1Cost =
diff --git a/llvm/test/Transforms/VectorCombine/X86/extract-cmp-binop.ll b/llvm/test/Transforms/VectorCombine/X86/extract-cmp-binop.ll
index 7bcdba6cc8904..105c6e69af826 100644
--- a/llvm/test/Transforms/VectorCombine/X86/extract-cmp-binop.ll
+++ b/llvm/test/Transforms/VectorCombine/X86/extract-cmp-binop.ll
@@ -246,3 +246,20 @@ define i1 @different_source_vec(<4 x i32> %a, <4 x i32> %b) {
   %r = and i1 %cmp1, %cmp2
   ret i1 %r
 }
+
+define i1 @oob_extract_index(<4 x i32> %x) {
+; CHECK-LABEL: @oob_extract_index(
+; CHECK-NEXT:    [[E0:%.*]] = extractelement <4 x i32> [[X:%.*]], i32 100
+; CHECK-NEXT:    [[E1:%.*]] = extractelement <4 x i32> [[X]], i32 1
+; CHECK-NEXT:    [[C0:%.*]] = icmp eq i32 [[E0]], 7
+; CHECK-NEXT:    [[C1:%.*]] = icmp eq i32 [[E1]], 9
+; CHECK-NEXT:    [[R:%.*]] = and i1 [[C0]], [[C1]]
+; CHECK-NEXT:    ret i1 [[R]]
+;
+  %e0 = extractelement <4 x i32> %x, i32 100
+  %e1 = extractelement <4 x i32> %x, i32 1
+  %c0 = icmp eq i32 %e0, 7
+  %c1 = icmp eq i32 %e1, 9
+  %r = and i1 %c0, %c1
+  ret i1 %r
+}