From: George Burgess IV <george.burgess.iv@gmail.com>
Date: Thu, 28 Sep 2017 06:17:19 +0000 (+0000)
Subject: [DAGCombiner] Fix an off-by-one error in vector logic
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e6d6266fc76a11aad5d9470ba7c4ad64ee7f1b9e;p=llvm

[DAGCombiner] Fix an off-by-one error in vector logic

Without this, we could end up trying to get the Nth (0-indexed) element
from a subvector of size N.

Differential Revision: https://reviews.llvm.org/D37880


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@314380 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/lib/CodeGen/SelectionDAG/DAGCombiner.cpp b/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
index c171d76e2ce..35d7ccb78c4 100644
--- a/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
+++ b/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
@@ -14501,8 +14501,8 @@ SDValue DAGCombiner::reduceBuildVecToShuffle(SDNode *N) {
     }
 
     NearestPow2 = PowerOf2Ceil(MaxIndex);
-    if (InVT.isSimple() && (NearestPow2 > 2) &&
-        ((NumElems * 2) < NearestPow2)) {
+    if (InVT.isSimple() && NearestPow2 > 2 && MaxIndex < NearestPow2 &&
+        NumElems * 2 < NearestPow2) {
       unsigned SplitSize = NearestPow2 / 2;
       EVT SplitVT = EVT::getVectorVT(*DAG.getContext(),
                                      InVT.getVectorElementType(), SplitSize);
diff --git a/test/CodeGen/ARM/crash-on-pow2-shufflevector.ll b/test/CodeGen/ARM/crash-on-pow2-shufflevector.ll
new file mode 100644
index 00000000000..8395674e880
--- /dev/null
+++ b/test/CodeGen/ARM/crash-on-pow2-shufflevector.ll
@@ -0,0 +1,24 @@
+; RUN: llc < %s -mtriple=armv7 | FileCheck %s
+;
+; Ensure that don't crash given a largeish power-of-two shufflevector index.
+
+%struct.desc = type { i32, [7 x i32] }
+
+define i32 @foo(%struct.desc* %descs, i32 %num, i32 %cw) local_unnamed_addr #0 {
+; CHECK-LABEL: foo:
+; CHECK:       @ BB#0: @ %entry
+; CHECK-NEXT:    mov r1, #32
+; CHECK-NEXT:    vld1.32 {d16, d17}, [r0], r1
+; CHECK-NEXT:    vld1.32 {d18, d19}, [r0]
+; CHECK-NEXT:    vtrn.32 q8, q9
+; CHECK-NEXT:    vadd.i32 d16, d16, d16
+; CHECK-NEXT:    vmov.32 r0, d16[1]
+; CHECK-NEXT:    bx lr
+entry:
+  %descs.vec = bitcast %struct.desc* %descs to <16 x i32>*
+  %wide.vec = load <16 x i32>, <16 x i32>* %descs.vec, align 4
+  %strided.vec = shufflevector <16 x i32> %wide.vec, <16 x i32> undef, <2 x i32> <i32 0, i32 8>
+  %bin.rdx20 = add <2 x i32> %strided.vec, %strided.vec
+  %0 = extractelement <2 x i32> %bin.rdx20, i32 1
+  ret i32 %0
+}