Skip to content

Commit a0c7a29

Browse files
committed
[GlobalISel] IRTranslator::translateGetElementPtr - don't assume a gep constant offset is representable as i64
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65052
1 parent 797fee6 commit a0c7a29

File tree

2 files changed

+47
-2
lines changed

2 files changed

+47
-2
lines changed

llvm/lib/CodeGen/GlobalISel/IRTranslator.cpp

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1550,8 +1550,10 @@ bool IRTranslator::translateGetElementPtr(const User &U,
15501550
// If this is a scalar constant or a splat vector of constants,
15511551
// handle it quickly.
15521552
if (const auto *CI = dyn_cast<ConstantInt>(Idx)) {
1553-
Offset += ElementSize * CI->getSExtValue();
1554-
continue;
1553+
if (std::optional<int64_t> Val = CI->getValue().trySExtValue()) {
1554+
Offset += ElementSize * *Val;
1555+
continue;
1556+
}
15551557
}
15561558

15571559
if (Offset != 0) {

llvm/test/CodeGen/AArch64/GlobalISel/arm64-irtranslator-gep.ll

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,3 +52,46 @@ define i32 @cse_gep(ptr %ptr, i32 %idx) {
5252
%res = add i32 %v1, %v2
5353
ret i32 %res
5454
}
55+
56+
; OSS Fuzz https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65052
57+
define void @ossfuzz65052() {
58+
; O0-LABEL: name: ossfuzz65052
59+
; O0: bb.1 (%ir-block.0):
60+
; O0-NEXT: successors: %bb.2(0x80000000)
61+
; O0-NEXT: {{ $}}
62+
; O0-NEXT: [[DEF:%[0-9]+]]:_(p0) = G_IMPLICIT_DEF
63+
; O0-NEXT: [[C:%[0-9]+]]:_(s128) = G_CONSTANT i128 -170141183460469231731687303715884105728
64+
; O0-NEXT: [[TRUNC:%[0-9]+]]:_(s64) = G_TRUNC [[C]](s128)
65+
; O0-NEXT: [[C1:%[0-9]+]]:_(s64) = G_CONSTANT i64 16
66+
; O0-NEXT: [[MUL:%[0-9]+]]:_(s64) = G_MUL [[TRUNC]], [[C1]]
67+
; O0-NEXT: [[PTR_ADD:%[0-9]+]]:_(p0) = G_PTR_ADD [[DEF]], [[MUL]](s64)
68+
; O0-NEXT: [[COPY:%[0-9]+]]:_(p0) = COPY [[PTR_ADD]](p0)
69+
; O0-NEXT: G_BR %bb.2
70+
; O0-NEXT: {{ $}}
71+
; O0-NEXT: bb.2.BB:
72+
; O0-NEXT: successors: %bb.2(0x80000000)
73+
; O0-NEXT: {{ $}}
74+
; O0-NEXT: G_BR %bb.2
75+
;
76+
; O3-LABEL: name: ossfuzz65052
77+
; O3: bb.1 (%ir-block.0):
78+
; O3-NEXT: successors: %bb.2(0x80000000)
79+
; O3-NEXT: {{ $}}
80+
; O3-NEXT: [[DEF:%[0-9]+]]:_(p0) = G_IMPLICIT_DEF
81+
; O3-NEXT: [[C:%[0-9]+]]:_(s128) = G_CONSTANT i128 -170141183460469231731687303715884105728
82+
; O3-NEXT: [[TRUNC:%[0-9]+]]:_(s64) = G_TRUNC [[C]](s128)
83+
; O3-NEXT: [[C1:%[0-9]+]]:_(s64) = G_CONSTANT i64 16
84+
; O3-NEXT: [[MUL:%[0-9]+]]:_(s64) = G_MUL [[TRUNC]], [[C1]]
85+
; O3-NEXT: [[PTR_ADD:%[0-9]+]]:_(p0) = G_PTR_ADD [[DEF]], [[MUL]](s64)
86+
; O3-NEXT: [[COPY:%[0-9]+]]:_(p0) = COPY [[PTR_ADD]](p0)
87+
; O3-NEXT: {{ $}}
88+
; O3-NEXT: bb.2.BB:
89+
; O3-NEXT: successors: %bb.2(0x80000000)
90+
; O3-NEXT: {{ $}}
91+
; O3-NEXT: G_BR %bb.2
92+
%G15 = getelementptr i128, ptr poison, i128 -170141183460469231731687303715884105728
93+
br label %BB
94+
95+
BB: ; preds = %BB, %0
96+
br label %BB
97+
}

0 commit comments

Comments
 (0)