[llvm] 7a618a2 - [RISCV] Fix assertion in combineBinOpOfExtractToReduceTree on type mismatch (#202201)

[via llvm-commits]

Author: Tanmay Gulhane
Date: 2026-08-03T00:01:14Z
New Revision: 7a618a2e7fd15d4fea352f2f5d7f67b07e0ccd24

URL: https://github.com/llvm/llvm-project/commit/7a618a2e7fd15d4fea352f2f5d7f67b07e0ccd24
DIFF: https://github.com/llvm/llvm-project/commit/7a618a2e7fd15d4fea352f2f5d7f67b07e0ccd24.diff

LOG: [RISCV] Fix assertion in combineBinOpOfExtractToReduceTree on type mismatch (#202201)

combineBinOpOfExtractToReduceTree asserts that the extract source
vector's element type equals the binop's value type
(SrcVecVT.getVectorElementType() == VT). This invariant does not hold
for all valid inputs.

A <1 x i1> binary operation under -mattr=+zve32x reaches this point with
the source vector element type differing from VT, which trips the
assertion in an assertions-enabled build and silently proceeds on a
false assumption otherwise.

Convert the assertion into an early return, so the combine declines when
its precondition is not met. This matches the existing bail-out style in
the same function (the isScalableVector and getScalarSizeInBits() >
getELen() checks immediately following). The change only ever skips the
fold; it never alters correct output.

Generative AI was used for the test case. The fix
is mine. Bug found by fuzzing with llvm-stress (seed 96) and reduced
with llvm-reduce.

Signed-off-by: Tanmay Gulhane <tanmaygulhane12 at gmail.com>

Added: 
    llvm/test/CodeGen/RISCV/rvv/fold-binary-reduce-zve32x-crash.ll

Modified: 
    llvm/lib/Target/RISCV/RISCVISelLowering.cpp

Removed: 
    


################################################################################
diff  --git a/llvm/lib/Target/RISCV/RISCVISelLowering.cpp b/llvm/lib/Target/RISCV/RISCVISelLowering.cpp
index aad62e7d40c54..e23427482c1e4 100644
--- a/llvm/lib/Target/RISCV/RISCVISelLowering.cpp
+++ b/llvm/lib/Target/RISCV/RISCVISelLowering.cpp
@@ -16874,7 +16874,8 @@ combineBinOpOfExtractToReduceTree(SDNode *N, SelectionDAG &DAG,
   uint64_t RHSIdx = cast<ConstantSDNode>(RHS.getOperand(1))->getLimitedValue();
   SDValue SrcVec = RHS.getOperand(0);
   EVT SrcVecVT = SrcVec.getValueType();
-  assert(SrcVecVT.getVectorElementType() == VT);
+  if (SrcVecVT.getVectorElementType() != VT)
+    return SDValue();
   if (SrcVecVT.isScalableVector())
     return SDValue();
 

diff  --git a/llvm/test/CodeGen/RISCV/rvv/fold-binary-reduce-zve32x-crash.ll b/llvm/test/CodeGen/RISCV/rvv/fold-binary-reduce-zve32x-crash.ll
new file mode 100644
index 0000000000000..86f7e718d47fe
--- /dev/null
+++ b/llvm/test/CodeGen/RISCV/rvv/fold-binary-reduce-zve32x-crash.ll
@@ -0,0 +1,17 @@
+; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
+; RUN: llc -mtriple=riscv64 -mattr=+zve32x -verify-machineinstrs < %s | FileCheck %s
+
+; Regression test for combineBinOpOfExtractToReduceTree, which asserted
+; SrcVecVT.getVectorElementType() == VT and crashed on a <1 x i1> binop
+; under zve32x, where the extract source element type does not match the
+; node value type. The combine must decline instead of asserting.
+
+define <1 x i1> @fold_or_v1i1_extract(<1 x i1> %a, <1 x i1> %b) {
+; CHECK-LABEL: fold_or_v1i1_extract:
+; CHECK:       # %bb.0:
+; CHECK-NEXT:    mv a0, a1
+; CHECK-NEXT:    ret
+  %x = xor <1 x i1> %a, %a
+  %r = or <1 x i1> %b, %x
+  ret <1 x i1> %r
+}