Skip to content

Commit 4d71f20

Browse files
authored
[GlobalISel] prevent G_UNMERGE_VALUES for vectors with different elements (#133335)
This commit prevents building a G_UNMERGE_VALUES instruction with different source and destination vector elements in `LegalizationArtifactCombiner::ArtifactValueFinder::tryCombineMergeLike()`, e.g.: `%1:_(<2 x s8>), %2:_(<2 x s8>) = G_UNMERGE_VALUES %0:_(<2 x s16>)` This LLVM defect was identified via the AMD Fuzzing project.
1 parent 10f29a6 commit 4d71f20

File tree

2 files changed

+59
-1
lines changed

2 files changed

+59
-1
lines changed

llvm/include/llvm/CodeGen/GlobalISel/LegalizationArtifactCombiner.h

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -997,6 +997,7 @@ class LegalizationArtifactCombiner {
997997

998998
// Recognize UnmergeSrc that can be unmerged to DstTy directly.
999999
// Types have to be either both vector or both non-vector types.
1000+
// In case of vector types, the scalar elements need to match.
10001001
// Merge-like opcodes are combined one at the time. First one creates new
10011002
// unmerge, following should use the same unmerge (builder performs CSE).
10021003
//
@@ -1005,7 +1006,9 @@ class LegalizationArtifactCombiner {
10051006
// %AnotherDst:_(DstTy) = G_merge_like_opcode %2:_(EltTy), %3
10061007
//
10071008
// %Dst:_(DstTy), %AnotherDst = G_UNMERGE_VALUES %UnmergeSrc
1008-
if ((DstTy.isVector() == UnmergeSrcTy.isVector()) &&
1009+
if (((!DstTy.isVector() && !UnmergeSrcTy.isVector()) ||
1010+
(DstTy.isVector() && UnmergeSrcTy.isVector() &&
1011+
DstTy.getScalarType() == UnmergeSrcTy.getScalarType())) &&
10091012
(Elt0UnmergeIdx % NumMIElts == 0) &&
10101013
getCoverTy(UnmergeSrcTy, DstTy) == UnmergeSrcTy) {
10111014
if (!isSequenceFromUnmerge(MI, 0, Unmerge, Elt0UnmergeIdx, NumMIElts,

llvm/test/CodeGen/AMDGPU/GlobalISel/insertelement.ll

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6506,3 +6506,58 @@ entry:
65066506
%insert = insertelement <5 x double> %vec, double %val, i32 %idx
65076507
ret <5 x double> %insert
65086508
}
6509+
6510+
; Found by fuzzer, reduced with llvm-reduce.
6511+
define amdgpu_kernel void @insert_very_small_from_very_large(<32 x i16> %L3, ptr %ptr) {
6512+
; GPRIDX-LABEL: insert_very_small_from_very_large:
6513+
; GPRIDX: ; %bb.0: ; %bb
6514+
; GPRIDX-NEXT: s_load_dwordx16 s[12:27], s[8:9], 0x0
6515+
; GPRIDX-NEXT: s_load_dwordx2 s[0:1], s[8:9], 0x40
6516+
; GPRIDX-NEXT: s_waitcnt lgkmcnt(0)
6517+
; GPRIDX-NEXT: s_lshr_b32 s2, s12, 1
6518+
; GPRIDX-NEXT: s_and_b32 s2, s2, 1
6519+
; GPRIDX-NEXT: s_lshl_b32 s2, s2, 1
6520+
; GPRIDX-NEXT: v_mov_b32_e32 v0, s0
6521+
; GPRIDX-NEXT: v_mov_b32_e32 v2, s2
6522+
; GPRIDX-NEXT: v_mov_b32_e32 v1, s1
6523+
; GPRIDX-NEXT: flat_store_byte v[0:1], v2
6524+
; GPRIDX-NEXT: s_endpgm
6525+
;
6526+
; GFX10-LABEL: insert_very_small_from_very_large:
6527+
; GFX10: ; %bb.0: ; %bb
6528+
; GFX10-NEXT: s_clause 0x1
6529+
; GFX10-NEXT: s_load_dwordx16 s[12:27], s[8:9], 0x0
6530+
; GFX10-NEXT: s_load_dwordx2 s[0:1], s[8:9], 0x40
6531+
; GFX10-NEXT: s_waitcnt lgkmcnt(0)
6532+
; GFX10-NEXT: s_lshr_b32 s2, s12, 1
6533+
; GFX10-NEXT: v_mov_b32_e32 v0, s0
6534+
; GFX10-NEXT: s_and_b32 s2, s2, 1
6535+
; GFX10-NEXT: v_mov_b32_e32 v1, s1
6536+
; GFX10-NEXT: s_lshl_b32 s2, s2, 1
6537+
; GFX10-NEXT: v_mov_b32_e32 v2, s2
6538+
; GFX10-NEXT: flat_store_byte v[0:1], v2
6539+
; GFX10-NEXT: s_endpgm
6540+
;
6541+
; GFX11-LABEL: insert_very_small_from_very_large:
6542+
; GFX11: ; %bb.0: ; %bb
6543+
; GFX11-NEXT: s_clause 0x1
6544+
; GFX11-NEXT: s_load_b512 s[8:23], s[4:5], 0x0
6545+
; GFX11-NEXT: s_load_b64 s[0:1], s[4:5], 0x40
6546+
; GFX11-NEXT: s_waitcnt lgkmcnt(0)
6547+
; GFX11-NEXT: s_lshr_b32 s2, s8, 1
6548+
; GFX11-NEXT: v_mov_b32_e32 v0, s0
6549+
; GFX11-NEXT: s_and_b32 s2, s2, 1
6550+
; GFX11-NEXT: v_mov_b32_e32 v1, s1
6551+
; GFX11-NEXT: s_lshl_b32 s2, s2, 1
6552+
; GFX11-NEXT: v_mov_b32_e32 v2, s2
6553+
; GFX11-NEXT: flat_store_b8 v[0:1], v2
6554+
; GFX11-NEXT: s_endpgm
6555+
bb:
6556+
%a = bitcast <32 x i16> %L3 to i512
6557+
%b = trunc i512 %a to i8
6558+
%c = trunc i8 %b to i2
6559+
%d = bitcast i2 %c to <2 x i1>
6560+
%insert = insertelement <2 x i1> %d, i1 false, i32 0
6561+
store <2 x i1> %insert, ptr %ptr, align 1
6562+
ret void
6563+
}

0 commit comments

Comments
 (0)