RPCS3/llvm-mirror
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm-mirror.git synced 2025-01-31 12:41:49 +01:00
Code Issues Projects Releases Wiki Activity

[X86] Remove extra getOperand(0) call from recently introduced store(extract_element(vtrunc)) to truncated store combine.

Browse Source 
The IsExtractedElement already called getOperand(0) so Extract
here is the source vector. We shouldn't call getOperand(0). This
worked for the original test cases because the result was a
bitcast so the getOperand(0) accidently peeked through the bitcast
which is what we wanted.

In the failing case here, the operand turns out to be undef so
the getOperand(0) asserts because undef has no operands.

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25184

Differential Revision: https://reviews.llvm.org/D86428
This commit is contained in:
Craig Topper 2020-08-25 16:00:12 -07:00
parent acd8515dc0
commit 6834e4eb7e
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/Target/X86/X86ISelLowering.cpp
View File

@ -44622,7 +44622,7 @@ static SDValue combineStore(SDNode *N, SelectionDAG &DAG,
return SDValue();
};
if (SDValue Extract = IsExtractedElement(StoredVal)) {
SDValue Trunc = peekThroughOneUseBitcasts(Extract.getOperand(0));
SDValue Trunc = peekThroughOneUseBitcasts(Extract);
if (Trunc.getOpcode() == X86ISD::VTRUNC) {
SDValue Src = Trunc.getOperand(0);
MVT DstVT = Trunc.getSimpleValueType();

18
test/CodeGen/X86/oss-fuzz-25184.ll Normal file
View File

@ -0,0 +1,18 @@
; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py
; RUN: llc < %s -mtriple=x86_64-apple-darwin19.5.0 | FileCheck %s
; OSS fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25184
define <2 x double> @test_fpext() {
; CHECK-LABEL: test_fpext:
; CHECK: ## %bb.0:
; CHECK-NEXT: movsd {{.*#+}} xmm0 = mem[0],zero
; CHECK-NEXT: retq
%tmp12 = insertelement <4 x float> undef, float 0.000000e+00, i32 3
%tmp5 = fpext <4 x float> %tmp12 to <4 x double>
%ret = shufflevector <4 x double> %tmp5, <4 x double> undef, <2 x i32> <i32 0, i32 1>
%E1 = extractelement <4 x double> %tmp5, i16 undef
%I2 = insertelement <2 x double> %ret, double 4.940660e-324, i16 undef
store double %E1, double* undef, align 8
ret <2 x double> %I2
}