Skip to content

Commit 68c9124

Browse files
committed
[NaryReassociate] Fix crash from pointer width / index width confusion
NaryReassociate would crash on expressions like the one in the added test that involved pointers where the size of the type was greater than the index width of the pointer, causing calls to SCEV's zext expression on types that didn't need to be zero-extended. This commit fixes the issue.
1 parent 96d46c6 commit 68c9124

File tree

2 files changed

+20
-5
lines changed

2 files changed

+20
-5
lines changed

llvm/lib/Transforms/Scalar/NaryReassociate.cpp

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -402,16 +402,20 @@ NaryReassociatePass::tryReassociateGEPAtIndex(GetElementPtrInst *GEP,
402402
IndexExprs.push_back(SE->getSCEV(Index));
403403
// Replace the I-th index with LHS.
404404
IndexExprs[I] = SE->getSCEV(LHS);
405+
Type *GEPArgType = GEP->getOperand(I)->getType();
406+
Type *LHSType = LHS->getType();
407+
size_t LHSSize = DL->getTypeSizeInBits(LHSType).getFixedValue();
408+
size_t GEPArgSize = DL->getTypeSizeInBits(GEPArgType).getFixedValue();
409+
// For pointers, we need to look at the index size, not the total type size.
410+
if (isa<PointerType>(GEPArgType))
411+
GEPArgSize = DL->getIndexTypeSizeInBits(GEPArgType);
405412
if (isKnownNonNegative(LHS, SimplifyQuery(*DL, DT, AC, GEP)) &&
406-
DL->getTypeSizeInBits(LHS->getType()).getFixedValue() <
407-
DL->getTypeSizeInBits(GEP->getOperand(I)->getType())
408-
.getFixedValue()) {
413+
LHSSize < GEPArgSize) {
409414
// Zero-extend LHS if it is non-negative. InstCombine canonicalizes sext to
410415
// zext if the source operand is proved non-negative. We should do that
411416
// consistently so that CandidateExpr more likely appears before. See
412417
// @reassociate_gep_assume for an example of this canonicalization.
413-
IndexExprs[I] =
414-
SE->getZeroExtendExpr(IndexExprs[I], GEP->getOperand(I)->getType());
418+
IndexExprs[I] = SE->getZeroExtendExpr(IndexExprs[I], GEPArgType);
415419
}
416420
const SCEV *CandidateExpr = SE->getGEPExpr(cast<GEPOperator>(GEP),
417421
IndexExprs);

llvm/test/Transforms/NaryReassociate/nary-gep.ll

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,17 @@ define void @no_sext_fat_pointer(ptr addrspace(2) %a, i32 %i, i32 %j) {
2121
ret void
2222
}
2323

24+
define ptr addrspace(2) @zext_fat_pointer_crash() {
25+
; CHECK-LABEL: @zext_fat_pointer_crash(
26+
; CHECK-NEXT: [[C:%.*]] = add i32 0, 0
27+
; CHECK-NEXT: [[Q:%.*]] = getelementptr double, ptr addrspace(2) null, i32 [[C]]
28+
; CHECK-NEXT: ret ptr addrspace(2) [[Q]]
29+
;
30+
%c = add i32 0, 0
31+
%q = getelementptr double, ptr addrspace(2) null, i32 %c
32+
ret ptr addrspace(2) %q
33+
}
34+
2435
define void @or_disjoint(ptr addrspace(2) %a, i32 %i, i32 %j, i32 %k) {
2536
; CHECK-LABEL: @or_disjoint(
2637
; CHECK-NEXT: [[OR:%.*]] = or disjoint i32 [[I:%.*]], [[J:%.*]]

0 commit comments

Comments
 (0)