Skip to content

Commit 380beae

Browse files
authored
Fix potential crash in SLPVectorizer caused by missing check (#95937)
I'm not super familiar with this code, but it seems that we were just missing a check. The original code that triggered this did not have uselistorders but llvm-reduce created them and it reproduces the same issue in a way more compact way. Fixes llvm/llvm-project#95016
1 parent 1846523 commit 380beae

File tree

2 files changed

+45
-2
lines changed

2 files changed

+45
-2
lines changed

llvm/lib/Transforms/Vectorize/SLPVectorizer.cpp

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -835,11 +835,11 @@ static InstructionsState getSameOpcode(ArrayRef<Value *> VL,
835835
auto *CallBase = cast<CallInst>(IBase);
836836
if (Call->getCalledFunction() != CallBase->getCalledFunction())
837837
return InstructionsState(VL[BaseIndex], nullptr, nullptr);
838-
if (Call->hasOperandBundles() &&
838+
if (Call->hasOperandBundles() && (!CallBase->hasOperandBundles() ||
839839
!std::equal(Call->op_begin() + Call->getBundleOperandsStartIndex(),
840840
Call->op_begin() + Call->getBundleOperandsEndIndex(),
841841
CallBase->op_begin() +
842-
CallBase->getBundleOperandsStartIndex()))
842+
CallBase->getBundleOperandsStartIndex())))
843843
return InstructionsState(VL[BaseIndex], nullptr, nullptr);
844844
Intrinsic::ID ID = getVectorIntrinsicIDForCall(Call, &TLI);
845845
if (ID != BaseID)
Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
2+
; RUN: opt < %s -passes=slp-vectorizer -S -pass-remarks-missed=slp-vectorizer 2>&1 | FileCheck %s
3+
4+
target datalayout = "e-m:e-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128"
5+
target triple = "aarch64-unknown-linux-gnu"
6+
7+
; This test has UB but the crash in #95016 only happens with it
8+
define void @uselistorder_test() {
9+
; CHECK-LABEL: @uselistorder_test(
10+
; CHECK-NEXT: [[TMP1:%.*]] = insertelement <2 x double> poison, double 0.000000e+00, i32 0
11+
; CHECK-NEXT: [[TMP2:%.*]] = insertelement <2 x double> [[TMP1]], double 0.000000e+00, i32 1
12+
; CHECK-NEXT: [[TMP3:%.*]] = fadd <2 x double> [[TMP2]], zeroinitializer
13+
; CHECK-NEXT: [[TMP4:%.*]] = fmul <2 x double> zeroinitializer, [[TMP3]]
14+
; CHECK-NEXT: [[TMP5:%.*]] = fmul <2 x double> [[TMP4]], zeroinitializer
15+
; CHECK-NEXT: [[TMP6:%.*]] = select <2 x i1> zeroinitializer, <2 x double> zeroinitializer, <2 x double> [[TMP5]]
16+
; CHECK-NEXT: [[TMP7:%.*]] = fmul <2 x double> [[TMP6]], zeroinitializer
17+
; CHECK-NEXT: [[TMP8:%.*]] = fadd <2 x double> [[TMP7]], zeroinitializer
18+
; CHECK-NEXT: store <2 x double> [[TMP8]], ptr null, align 8
19+
; CHECK-NEXT: ret void
20+
;
21+
%max1 = call double @llvm.maximum.f64(double 0.000000e+00, double 0.000000e+00) [ "a_list"(ptr null) ]
22+
%add1 = fadd double %max1, 0.000000e+00
23+
%mul1 = fmul double 0.000000e+00, %add1
24+
%mul2 = fmul double %mul1, 0.000000e+00
25+
%sel1 = select i1 false, double 0.000000e+00, double %mul2
26+
%max2 = call double @llvm.maximum.f64(double 0.000000e+00, double 0.000000e+00)
27+
%add2 = fadd double %max2, 0.000000e+00
28+
%mul3 = fmul double 0.000000e+00, %add2
29+
%mul4 = fmul double %mul3, 0.000000e+00
30+
%sel2 = select i1 false, double 0.000000e+00, double %mul4
31+
%mul5 = fmul double %sel2, 0.000000e+00
32+
%add3 = fadd double 0.000000e+00, %mul5
33+
%gep1 = getelementptr { double, [1 x [2 x double]] }, ptr null, i64 0, i32 1
34+
store double %add3, ptr %gep1, align 8
35+
%mul6 = fmul double %sel1, 0.000000e+00
36+
%add4 = fadd double %mul6, 0.000000e+00
37+
store double %add4, ptr null, align 8
38+
ret void
39+
}
40+
41+
declare double @llvm.maximum.f64(double, double) #0
42+
43+
attributes #0 = { nocallback nofree nosync nounwind speculatable willreturn memory(none) }

0 commit comments

Comments
 (0)