diff options
| author | Philip Reames <listmail@philipreames.com> | 2019-04-12 18:26:56 +0000 |
|---|---|---|
| committer | Philip Reames <listmail@philipreames.com> | 2019-04-12 18:26:56 +0000 |
| commit | b091cc081df43b1789cde9189936b485da0c1b2d (patch) | |
| tree | 0a3ed74eec8f954b66777544d4e256bb006e3447 | |
| parent | 00a0d5d1de58da3651f7efe74d9f17ebfd2cbb01 (diff) | |
| download | bcm5719-llvm-b091cc081df43b1789cde9189936b485da0c1b2d.tar.gz bcm5719-llvm-b091cc081df43b1789cde9189936b485da0c1b2d.zip | |
[InstCombine] Fix a nasty miscompile introduced w/masked.gather demanded elts
This fixes a miscompile which was introduced in r356510 (https://reviews.llvm.org/D57372).
The problem is that the original patch removed pointer operands where the load results we're demanded, but without considering the legality of the load itself. If the masked.gather had active, but undemanded, lanes, then we could end up creating a load which loaded from an undef address. The result could be a segfault, or, in theory, an arbitrary read from a random memory location into an used register.
llvm-svn: 358299
| -rw-r--r-- | llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp | 6 | ||||
| -rw-r--r-- | llvm/test/Transforms/InstCombine/masked_intrinsics.ll | 3 |
2 files changed, 6 insertions, 3 deletions
diff --git a/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp b/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp index 2dea7eea404..1d52938d1f8 100644 --- a/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp +++ b/llvm/lib/Transforms/InstCombine/InstCombineSimplifyDemanded.cpp @@ -1437,7 +1437,11 @@ Value *InstCombiner::SimplifyDemandedVectorElts(Value *V, APInt DemandedElts, switch (II->getIntrinsicID()) { case Intrinsic::masked_gather: // fallthrough case Intrinsic::masked_load: { - APInt DemandedPtrs(DemandedElts), DemandedPassThrough(DemandedElts); + // Subtlety: If we load from a pointer, the pointer must be valid + // regardless of whether the element is demanded. Doing otherwise risks + // segfaults which didn't exist in the original program. + APInt DemandedPtrs(APInt::getAllOnesValue(VWidth)), + DemandedPassThrough(DemandedElts); if (auto *CV = dyn_cast<ConstantVector>(II->getOperand(2))) for (unsigned i = 0; i < VWidth; i++) { Constant *CElt = CV->getAggregateElement(i); diff --git a/llvm/test/Transforms/InstCombine/masked_intrinsics.ll b/llvm/test/Transforms/InstCombine/masked_intrinsics.ll index 48c8f78f990..582fd8f5c82 100644 --- a/llvm/test/Transforms/InstCombine/masked_intrinsics.ll +++ b/llvm/test/Transforms/InstCombine/masked_intrinsics.ll @@ -56,10 +56,9 @@ define <2 x double> @load_lane0(<2 x double>* %ptr, double %pt) { ret <2 x double> %res } -; FIXME: the output here demonstrates a miscompile! define double @load_all(double* %base, double %pt) { ; CHECK-LABEL: @load_all( -; CHECK-NEXT: [[PTRS:%.*]] = getelementptr double, double* [[BASE:%.*]], <4 x i64> <i64 undef, i64 undef, i64 2, i64 undef> +; CHECK-NEXT: [[PTRS:%.*]] = getelementptr double, double* [[BASE:%.*]], <4 x i64> <i64 0, i64 undef, i64 2, i64 3> ; CHECK-NEXT: [[RES:%.*]] = call <4 x double> @llvm.masked.gather.v4f64.v4p0f64(<4 x double*> [[PTRS]], i32 4, <4 x i1> <i1 true, i1 false, i1 true, i1 true>, <4 x double> undef) ; CHECK-NEXT: [[ELT:%.*]] = extractelement <4 x double> [[RES]], i64 2 ; CHECK-NEXT: ret double [[ELT]] |
