[DAG] Fix an assertion failure caused by an invalid cast in method 'BuildVectorSDNode::isConstantSplat'

This patch renames method 'isConstantSplat' as 'getConstantSplatValue'
(mainly for consistency reasons), and rewrites its logic to ensure
that we always perform a legal 'cast<ConstantSDNode>'.

Added test shift-combine-crash.ll to verify that DAGCombiner no longer crashes with an assertion failure in the attempt to simplify a vector shift by a vector of all undef counts.

llvm-svn: 204536

4 files changed, 69 insertions, 12 deletions

diff --git a/llvm/include/llvm/CodeGen/SelectionDAGNodes.h b/llvm/include/llvm/CodeGen/SelectionDAGNodes.h
index a6c72ca2d1c..fd915b01d60 100644
--- a/llvm/include/llvm/CodeGen/SelectionDAGNodes.h
+++ b/llvm/include/llvm/CodeGen/SelectionDAGNodes.h
@@ -1522,10 +1522,11 @@ public:
                        unsigned MinSplatBits = 0,
                        bool isBigEndian = false) const;
 
-  /// isConstantSplat - Simpler form of isConstantSplat. Get the constant splat
-  /// when you only care about the value. Returns nullptr if this isn't a
-  /// constant splat vector.
-  ConstantSDNode *isConstantSplat() const;
+  /// getConstantSplatValue - Check if this is a constant splat, and if so,
+  /// return the splat value only if it is a ConstantSDNode. Otherwise
+  /// return nullptr. This is a simpler form of isConstantSplat.
+  /// Get the constant splat only if you care about the splat value.
+  ConstantSDNode *getConstantSplatValue() const;
 
   bool isConstant() const;
 
diff --git a/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp b/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
index 2b2bbf9e296..a9983c7faa5 100644
--- a/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
+++ b/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp
@@ -667,7 +667,7 @@ static ConstantSDNode *isConstOrConstSplat(SDValue N) {
     return CN;
 
   if (BuildVectorSDNode *BV = dyn_cast<BuildVectorSDNode>(N))
-    return BV->isConstantSplat();
+    return BV->getConstantSplatValue();
 
   return nullptr;
 }
diff --git a/llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp b/llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp
index df8d423ab22..029011cffcc 100644
--- a/llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp
+++ b/llvm/lib/CodeGen/SelectionDAG/SelectionDAG.cpp
@@ -6573,15 +6573,14 @@ bool BuildVectorSDNode::isConstantSplat(APInt &SplatValue,
   return true;
 }
 
-ConstantSDNode *BuildVectorSDNode::isConstantSplat() const {
+ConstantSDNode *BuildVectorSDNode::getConstantSplatValue() const {
   SDValue Op0 = getOperand(0);
-  for (unsigned i = 0, e = getNumOperands(); i != e; ++i) {
-    SDValue Opi = getOperand(i);
-    unsigned Opc = Opi.getOpcode();
-    if ((Opc != ISD::UNDEF && Opc != ISD::Constant && Opc != ISD::ConstantFP) ||
-        Opi != Op0)
+  if (Op0.getOpcode() != ISD::Constant)
+    return nullptr;
+
+  for (unsigned i = 1, e = getNumOperands(); i != e; ++i)
+    if (getOperand(i) != Op0)
       return nullptr;
-  }
 
   return cast<ConstantSDNode>(Op0);
 }
diff --git a/llvm/test/CodeGen/X86/shift-combine-crash.ll b/llvm/test/CodeGen/X86/shift-combine-crash.ll
new file mode 100644
index 00000000000..a69a907d41b
--- /dev/null
+++ b/llvm/test/CodeGen/X86/shift-combine-crash.ll
@@ -0,0 +1,57 @@
+; RUN: llc < %s -mtriple=x86_64-unknown-linux-gnu -mcpu=corei7 > /dev/null
+
+; Verify that DAGCombiner doesn't crash with an assertion failure in the
+; attempt to cast a ISD::UNDEF node to a ConstantSDNode.
+
+; During type legalization, the vector shift operation in function @test1 is
+; split into two legal shifts that work on <2 x i64> elements.
+; The first shift of the legalized sequence would be a shift by all undefs.
+; DAGCombiner will then try to simplify the vector shift and check if the
+; vector of shift counts is a splat. Make sure that llc doesn't crash
+; at that stage.
+
+
+define <4 x i64> @test1(<4 x i64> %A) {
+  %shl = shl <4 x i64> %A, <i64 undef, i64 undef, i64 1, i64 2>
+  ret <4 x i64> %shl
+}
+
+; Also, verify that DAGCombiner doesn't crash when trying to combine shifts
+; with different combinations of undef elements in the vector shift count.
+
+define <4 x i64> @test2(<4 x i64> %A) {
+  %shl = shl <4 x i64> %A, <i64 2, i64 3, i64 undef, i64 undef>
+  ret <4 x i64> %shl
+}
+
+define <4 x i64> @test3(<4 x i64> %A) {
+  %shl = shl <4 x i64> %A, <i64 2, i64 undef, i64 3, i64 undef>
+  ret <4 x i64> %shl
+}
+
+define <4 x i64> @test4(<4 x i64> %A) {
+  %shl = shl <4 x i64> %A, <i64 undef, i64 2, i64 undef, i64 3>
+  ret <4 x i64> %shl
+}
+
+define <4 x i64> @test5(<4 x i64> %A) {
+  %shl = shl <4 x i64> %A, <i64 2, i64 undef, i64 undef, i64 undef>
+  ret <4 x i64> %shl
+}
+
+define <4 x i64> @test6(<4 x i64> %A) {
+  %shl = shl <4 x i64> %A, <i64 undef, i64 undef, i64 3, i64 undef>
+  ret <4 x i64> %shl
+}
+
+define <4 x i64> @test7(<4 x i64> %A) {
+  %shl = shl <4 x i64> %A, <i64 undef, i64 undef, i64 undef, i64 3>
+  ret <4 x i64> %shl
+}
+
+define <4 x i64> @test8(<4 x i64> %A) {
+  %shl = shl <4 x i64> %A, <i64 undef, i64 undef, i64 undef, i64 undef>
+  ret <4 x i64> %shl
+}
+
+