Skip to content

Commit acab142

Browse files
topperctopperc
committed
[LegalizeDAG] Freeze index when converting insert_elt/insert_subvector to load/store on stack.
We try clamp the index to be within the bounds of the stack object we create, but if we don't freeze it, poison can propagate into the clamp code. This can cause the access to leave the bounds of the stack object. We have other instances of this issue in type legalization and extract_elt/subvector, but posting this patch first for direction check. Fixes #86717
1 parent 0d7ea50 commit acab142

File tree

6 files changed

+82
-63
lines changed

6 files changed

+82
-63
lines changed

‎llvm/lib/CodeGen/SelectionDAG/LegalizeDAG.cpp‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1455,6 +1455,9 @@ SDValue SelectionDAGLegalize::ExpandInsertToVectorThroughStack(SDValue Op) {
14551455
// First store the whole vector.
14561456
SDValue Ch = DAG.getStore(DAG.getEntryNode(), dl, Vec, StackPtr, PtrInfo);
14571457

1458+
// Freeze the index so we don't poison the clamping code we're about to emit.
1459+
Idx = DAG.getFreeze(Idx);
1460+
14581461
// Then store the inserted part.
14591462
if (PartVT.isVector()) {
14601463
SDValue SubStackPtr =

‎llvm/test/CodeGen/AArch64/pr86717.ll‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,10 @@ define <16 x i8> @f(i32 %0) {
1010
; CHECK-NEXT: mov w8, #1 // =0x1
1111
; CHECK-NEXT: mov x9, sp
1212
; CHECK-NEXT: sub w8, w8, w0
13-
; CHECK-NEXT: mov w10, #3 // =0x3
14-
; CHECK-NEXT: orr x8, x9, x8
13+
; CHECK-NEXT: bfxil x9, x8, #0, #4
14+
; CHECK-NEXT: mov w8, #3 // =0x3
1515
; CHECK-NEXT: str q0, [sp]
16-
; CHECK-NEXT: strb w10, [x8]
16+
; CHECK-NEXT: strb w8, [x9]
1717
; CHECK-NEXT: ldr q0, [sp], #16
1818
; CHECK-NEXT: ret
1919
%2 = sub nuw i32 1, %0

‎llvm/test/CodeGen/LoongArch/lasx/ir-instruction/insertelement.ll‎

Lines changed: 24 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -123,9 +123,10 @@ define void @insert_32xi8_idx(ptr %src, ptr %dst, i8 %in, i32 %idx) nounwind {
123123
; CHECK-NEXT: bstrins.d $sp, $zero, 4, 0
124124
; CHECK-NEXT: xvld $xr0, $a0, 0
125125
; CHECK-NEXT: xvst $xr0, $sp, 0
126-
; CHECK-NEXT: addi.d $a0, $sp, 0
127-
; CHECK-NEXT: bstrins.d $a0, $a3, 4, 0
128-
; CHECK-NEXT: st.b $a2, $a0, 0
126+
; CHECK-NEXT: bstrpick.d $a0, $a3, 31, 0
127+
; CHECK-NEXT: addi.d $a3, $sp, 0
128+
; CHECK-NEXT: bstrins.d $a3, $a0, 4, 0
129+
; CHECK-NEXT: st.b $a2, $a3, 0
129130
; CHECK-NEXT: xvld $xr0, $sp, 0
130131
; CHECK-NEXT: xvst $xr0, $a1, 0
131132
; CHECK-NEXT: addi.d $sp, $fp, -64
@@ -149,9 +150,10 @@ define void @insert_16xi16_idx(ptr %src, ptr %dst, i16 %in, i32 %idx) nounwind {
149150
; CHECK-NEXT: bstrins.d $sp, $zero, 4, 0
150151
; CHECK-NEXT: xvld $xr0, $a0, 0
151152
; CHECK-NEXT: xvst $xr0, $sp, 0
152-
; CHECK-NEXT: addi.d $a0, $sp, 0
153-
; CHECK-NEXT: bstrins.d $a0, $a3, 4, 1
154-
; CHECK-NEXT: st.h $a2, $a0, 0
153+
; CHECK-NEXT: bstrpick.d $a0, $a3, 31, 0
154+
; CHECK-NEXT: addi.d $a3, $sp, 0
155+
; CHECK-NEXT: bstrins.d $a3, $a0, 4, 1
156+
; CHECK-NEXT: st.h $a2, $a3, 0
155157
; CHECK-NEXT: xvld $xr0, $sp, 0
156158
; CHECK-NEXT: xvst $xr0, $a1, 0
157159
; CHECK-NEXT: addi.d $sp, $fp, -64
@@ -175,9 +177,10 @@ define void @insert_8xi32_idx(ptr %src, ptr %dst, i32 %in, i32 %idx) nounwind {
175177
; CHECK-NEXT: bstrins.d $sp, $zero, 4, 0
176178
; CHECK-NEXT: xvld $xr0, $a0, 0
177179
; CHECK-NEXT: xvst $xr0, $sp, 0
178-
; CHECK-NEXT: addi.d $a0, $sp, 0
179-
; CHECK-NEXT: bstrins.d $a0, $a3, 4, 2
180-
; CHECK-NEXT: st.w $a2, $a0, 0
180+
; CHECK-NEXT: bstrpick.d $a0, $a3, 31, 0
181+
; CHECK-NEXT: addi.d $a3, $sp, 0
182+
; CHECK-NEXT: bstrins.d $a3, $a0, 4, 2
183+
; CHECK-NEXT: st.w $a2, $a3, 0
181184
; CHECK-NEXT: xvld $xr0, $sp, 0
182185
; CHECK-NEXT: xvst $xr0, $a1, 0
183186
; CHECK-NEXT: addi.d $sp, $fp, -64
@@ -201,9 +204,10 @@ define void @insert_4xi64_idx(ptr %src, ptr %dst, i64 %in, i32 %idx) nounwind {
201204
; CHECK-NEXT: bstrins.d $sp, $zero, 4, 0
202205
; CHECK-NEXT: xvld $xr0, $a0, 0
203206
; CHECK-NEXT: xvst $xr0, $sp, 0
204-
; CHECK-NEXT: addi.d $a0, $sp, 0
205-
; CHECK-NEXT: bstrins.d $a0, $a3, 4, 3
206-
; CHECK-NEXT: st.d $a2, $a0, 0
207+
; CHECK-NEXT: bstrpick.d $a0, $a3, 31, 0
208+
; CHECK-NEXT: addi.d $a3, $sp, 0
209+
; CHECK-NEXT: bstrins.d $a3, $a0, 4, 3
210+
; CHECK-NEXT: st.d $a2, $a3, 0
207211
; CHECK-NEXT: xvld $xr0, $sp, 0
208212
; CHECK-NEXT: xvst $xr0, $a1, 0
209213
; CHECK-NEXT: addi.d $sp, $fp, -64
@@ -227,9 +231,10 @@ define void @insert_8xfloat_idx(ptr %src, ptr %dst, float %in, i32 %idx) nounwin
227231
; CHECK-NEXT: bstrins.d $sp, $zero, 4, 0
228232
; CHECK-NEXT: xvld $xr1, $a0, 0
229233
; CHECK-NEXT: xvst $xr1, $sp, 0
230-
; CHECK-NEXT: addi.d $a0, $sp, 0
231-
; CHECK-NEXT: bstrins.d $a0, $a2, 4, 2
232-
; CHECK-NEXT: fst.s $fa0, $a0, 0
234+
; CHECK-NEXT: bstrpick.d $a0, $a2, 31, 0
235+
; CHECK-NEXT: addi.d $a2, $sp, 0
236+
; CHECK-NEXT: bstrins.d $a2, $a0, 4, 2
237+
; CHECK-NEXT: fst.s $fa0, $a2, 0
233238
; CHECK-NEXT: xvld $xr0, $sp, 0
234239
; CHECK-NEXT: xvst $xr0, $a1, 0
235240
; CHECK-NEXT: addi.d $sp, $fp, -64
@@ -253,9 +258,10 @@ define void @insert_4xdouble_idx(ptr %src, ptr %dst, double %in, i32 %idx) nounw
253258
; CHECK-NEXT: bstrins.d $sp, $zero, 4, 0
254259
; CHECK-NEXT: xvld $xr1, $a0, 0
255260
; CHECK-NEXT: xvst $xr1, $sp, 0
256-
; CHECK-NEXT: addi.d $a0, $sp, 0
257-
; CHECK-NEXT: bstrins.d $a0, $a2, 4, 3
258-
; CHECK-NEXT: fst.d $fa0, $a0, 0
261+
; CHECK-NEXT: bstrpick.d $a0, $a2, 31, 0
262+
; CHECK-NEXT: addi.d $a2, $sp, 0
263+
; CHECK-NEXT: bstrins.d $a2, $a0, 4, 3
264+
; CHECK-NEXT: fst.d $fa0, $a2, 0
259265
; CHECK-NEXT: xvld $xr0, $sp, 0
260266
; CHECK-NEXT: xvst $xr0, $a1, 0
261267
; CHECK-NEXT: addi.d $sp, $fp, -64

‎llvm/test/CodeGen/LoongArch/lsx/ir-instruction/insertelement.ll‎

Lines changed: 24 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,10 @@ define void @insert_16xi8_idx(ptr %src, ptr %dst, i8 %ins, i32 %idx) nounwind {
8787
; CHECK-NEXT: addi.d $sp, $sp, -16
8888
; CHECK-NEXT: vld $vr0, $a0, 0
8989
; CHECK-NEXT: vst $vr0, $sp, 0
90-
; CHECK-NEXT: addi.d $a0, $sp, 0
91-
; CHECK-NEXT: bstrins.d $a0, $a3, 3, 0
92-
; CHECK-NEXT: st.b $a2, $a0, 0
90+
; CHECK-NEXT: bstrpick.d $a0, $a3, 31, 0
91+
; CHECK-NEXT: addi.d $a3, $sp, 0
92+
; CHECK-NEXT: bstrins.d $a3, $a0, 3, 0
93+
; CHECK-NEXT: st.b $a2, $a3, 0
9394
; CHECK-NEXT: vld $vr0, $sp, 0
9495
; CHECK-NEXT: vst $vr0, $a1, 0
9596
; CHECK-NEXT: addi.d $sp, $sp, 16
@@ -106,9 +107,10 @@ define void @insert_8xi16_idx(ptr %src, ptr %dst, i16 %ins, i32 %idx) nounwind {
106107
; CHECK-NEXT: addi.d $sp, $sp, -16
107108
; CHECK-NEXT: vld $vr0, $a0, 0
108109
; CHECK-NEXT: vst $vr0, $sp, 0
109-
; CHECK-NEXT: addi.d $a0, $sp, 0
110-
; CHECK-NEXT: bstrins.d $a0, $a3, 3, 1
111-
; CHECK-NEXT: st.h $a2, $a0, 0
110+
; CHECK-NEXT: bstrpick.d $a0, $a3, 31, 0
111+
; CHECK-NEXT: addi.d $a3, $sp, 0
112+
; CHECK-NEXT: bstrins.d $a3, $a0, 3, 1
113+
; CHECK-NEXT: st.h $a2, $a3, 0
112114
; CHECK-NEXT: vld $vr0, $sp, 0
113115
; CHECK-NEXT: vst $vr0, $a1, 0
114116
; CHECK-NEXT: addi.d $sp, $sp, 16
@@ -125,9 +127,10 @@ define void @insert_4xi32_idx(ptr %src, ptr %dst, i32 %ins, i32 %idx) nounwind {
125127
; CHECK-NEXT: addi.d $sp, $sp, -16
126128
; CHECK-NEXT: vld $vr0, $a0, 0
127129
; CHECK-NEXT: vst $vr0, $sp, 0
128-
; CHECK-NEXT: addi.d $a0, $sp, 0
129-
; CHECK-NEXT: bstrins.d $a0, $a3, 3, 2
130-
; CHECK-NEXT: st.w $a2, $a0, 0
130+
; CHECK-NEXT: bstrpick.d $a0, $a3, 31, 0
131+
; CHECK-NEXT: addi.d $a3, $sp, 0
132+
; CHECK-NEXT: bstrins.d $a3, $a0, 3, 2
133+
; CHECK-NEXT: st.w $a2, $a3, 0
131134
; CHECK-NEXT: vld $vr0, $sp, 0
132135
; CHECK-NEXT: vst $vr0, $a1, 0
133136
; CHECK-NEXT: addi.d $sp, $sp, 16
@@ -144,9 +147,10 @@ define void @insert_2xi64_idx(ptr %src, ptr %dst, i64 %ins, i32 %idx) nounwind {
144147
; CHECK-NEXT: addi.d $sp, $sp, -16
145148
; CHECK-NEXT: vld $vr0, $a0, 0
146149
; CHECK-NEXT: vst $vr0, $sp, 0
147-
; CHECK-NEXT: addi.d $a0, $sp, 0
148-
; CHECK-NEXT: bstrins.d $a0, $a3, 3, 3
149-
; CHECK-NEXT: st.d $a2, $a0, 0
150+
; CHECK-NEXT: bstrpick.d $a0, $a3, 31, 0
151+
; CHECK-NEXT: addi.d $a3, $sp, 0
152+
; CHECK-NEXT: bstrins.d $a3, $a0, 3, 3
153+
; CHECK-NEXT: st.d $a2, $a3, 0
150154
; CHECK-NEXT: vld $vr0, $sp, 0
151155
; CHECK-NEXT: vst $vr0, $a1, 0
152156
; CHECK-NEXT: addi.d $sp, $sp, 16
@@ -163,9 +167,10 @@ define void @insert_4xfloat_idx(ptr %src, ptr %dst, float %ins, i32 %idx) nounwi
163167
; CHECK-NEXT: addi.d $sp, $sp, -16
164168
; CHECK-NEXT: vld $vr1, $a0, 0
165169
; CHECK-NEXT: vst $vr1, $sp, 0
166-
; CHECK-NEXT: addi.d $a0, $sp, 0
167-
; CHECK-NEXT: bstrins.d $a0, $a2, 3, 2
168-
; CHECK-NEXT: fst.s $fa0, $a0, 0
170+
; CHECK-NEXT: bstrpick.d $a0, $a2, 31, 0
171+
; CHECK-NEXT: addi.d $a2, $sp, 0
172+
; CHECK-NEXT: bstrins.d $a2, $a0, 3, 2
173+
; CHECK-NEXT: fst.s $fa0, $a2, 0
169174
; CHECK-NEXT: vld $vr0, $sp, 0
170175
; CHECK-NEXT: vst $vr0, $a1, 0
171176
; CHECK-NEXT: addi.d $sp, $sp, 16
@@ -182,9 +187,10 @@ define void @insert_2xdouble_idx(ptr %src, ptr %dst, double %ins, i32 %idx) noun
182187
; CHECK-NEXT: addi.d $sp, $sp, -16
183188
; CHECK-NEXT: vld $vr1, $a0, 0
184189
; CHECK-NEXT: vst $vr1, $sp, 0
185-
; CHECK-NEXT: addi.d $a0, $sp, 0
186-
; CHECK-NEXT: bstrins.d $a0, $a2, 3, 3
187-
; CHECK-NEXT: fst.d $fa0, $a0, 0
190+
; CHECK-NEXT: bstrpick.d $a0, $a2, 31, 0
191+
; CHECK-NEXT: addi.d $a2, $sp, 0
192+
; CHECK-NEXT: bstrins.d $a2, $a0, 3, 3
193+
; CHECK-NEXT: fst.d $fa0, $a2, 0
188194
; CHECK-NEXT: vld $vr0, $sp, 0
189195
; CHECK-NEXT: vst $vr0, $a1, 0
190196
; CHECK-NEXT: addi.d $sp, $sp, 16

‎llvm/test/CodeGen/X86/2009-06-05-VariableIndexInsert.ll‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,11 @@ define <2 x i64> @_mm_insert_epi16(<2 x i64> %a, i32 %b, i32 %imm) nounwind read
99
; X86-NEXT: movl %esp, %ebp
1010
; X86-NEXT: andl $-16, %esp
1111
; X86-NEXT: subl $32, %esp
12-
; X86-NEXT: movzwl 8(%ebp), %eax
13-
; X86-NEXT: movl 12(%ebp), %ecx
14-
; X86-NEXT: andl $7, %ecx
12+
; X86-NEXT: movl 12(%ebp), %eax
13+
; X86-NEXT: movzwl 8(%ebp), %ecx
14+
; X86-NEXT: andl $7, %eax
1515
; X86-NEXT: movaps %xmm0, (%esp)
16-
; X86-NEXT: movw %ax, (%esp,%ecx,2)
16+
; X86-NEXT: movw %cx, (%esp,%eax,2)
1717
; X86-NEXT: movaps (%esp), %xmm0
1818
; X86-NEXT: movl %ebp, %esp
1919
; X86-NEXT: popl %ebp

‎llvm/test/CodeGen/X86/insertelement-var-index.ll‎

Lines changed: 24 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1009,18 +1009,19 @@ define <2 x i64> @arg_i64_v2i64(<2 x i64> %v, i64 %x, i32 %y) nounwind {
10091009
; X86AVX2-NEXT: pushl %esi
10101010
; X86AVX2-NEXT: andl $-16, %esp
10111011
; X86AVX2-NEXT: subl $48, %esp
1012-
; X86AVX2-NEXT: movl 8(%ebp), %eax
1013-
; X86AVX2-NEXT: movl 12(%ebp), %ecx
1014-
; X86AVX2-NEXT: movl 16(%ebp), %edx
1012+
; X86AVX2-NEXT: movl 8(%ebp), %edx
1013+
; X86AVX2-NEXT: movl 12(%ebp), %eax
1014+
; X86AVX2-NEXT: movl 16(%ebp), %ecx
10151015
; X86AVX2-NEXT: vmovaps %xmm0, (%esp)
1016-
; X86AVX2-NEXT: leal (%edx,%edx), %esi
1016+
; X86AVX2-NEXT: addl %ecx, %ecx
1017+
; X86AVX2-NEXT: movl %ecx, %esi
10171018
; X86AVX2-NEXT: andl $3, %esi
1018-
; X86AVX2-NEXT: movl %eax, (%esp,%esi,4)
1019+
; X86AVX2-NEXT: movl %edx, (%esp,%esi,4)
10191020
; X86AVX2-NEXT: vmovaps (%esp), %xmm0
10201021
; X86AVX2-NEXT: vmovaps %xmm0, {{[0-9]+}}(%esp)
1021-
; X86AVX2-NEXT: leal 1(%edx,%edx), %eax
1022-
; X86AVX2-NEXT: andl $3, %eax
1023-
; X86AVX2-NEXT: movl %ecx, 16(%esp,%eax,4)
1022+
; X86AVX2-NEXT: incl %ecx
1023+
; X86AVX2-NEXT: andl $3, %ecx
1024+
; X86AVX2-NEXT: movl %eax, 16(%esp,%ecx,4)
10241025
; X86AVX2-NEXT: vmovaps {{[0-9]+}}(%esp), %xmm0
10251026
; X86AVX2-NEXT: leal -4(%ebp), %esp
10261027
; X86AVX2-NEXT: popl %esi
@@ -1362,12 +1363,13 @@ define <2 x i64> @load_i64_v2i64(<2 x i64> %v, ptr %p, i32 %y) nounwind {
13621363
; X86AVX2-NEXT: movl (%ecx), %edx
13631364
; X86AVX2-NEXT: movl 4(%ecx), %ecx
13641365
; X86AVX2-NEXT: vmovaps %xmm0, (%esp)
1365-
; X86AVX2-NEXT: leal (%eax,%eax), %esi
1366+
; X86AVX2-NEXT: addl %eax, %eax
1367+
; X86AVX2-NEXT: movl %eax, %esi
13661368
; X86AVX2-NEXT: andl $3, %esi
13671369
; X86AVX2-NEXT: movl %edx, (%esp,%esi,4)
13681370
; X86AVX2-NEXT: vmovaps (%esp), %xmm0
13691371
; X86AVX2-NEXT: vmovaps %xmm0, {{[0-9]+}}(%esp)
1370-
; X86AVX2-NEXT: leal 1(%eax,%eax), %eax
1372+
; X86AVX2-NEXT: incl %eax
13711373
; X86AVX2-NEXT: andl $3, %eax
13721374
; X86AVX2-NEXT: movl %ecx, 16(%esp,%eax,4)
13731375
; X86AVX2-NEXT: vmovaps {{[0-9]+}}(%esp), %xmm0
@@ -1742,18 +1744,19 @@ define <4 x i64> @arg_i64_v4i64(<4 x i64> %v, i64 %x, i32 %y) nounwind {
17421744
; X86AVX2-NEXT: pushl %esi
17431745
; X86AVX2-NEXT: andl $-32, %esp
17441746
; X86AVX2-NEXT: subl $96, %esp
1745-
; X86AVX2-NEXT: movl 8(%ebp), %eax
1746-
; X86AVX2-NEXT: movl 12(%ebp), %ecx
1747-
; X86AVX2-NEXT: movl 16(%ebp), %edx
1747+
; X86AVX2-NEXT: movl 8(%ebp), %edx
1748+
; X86AVX2-NEXT: movl 12(%ebp), %eax
1749+
; X86AVX2-NEXT: movl 16(%ebp), %ecx
17481750
; X86AVX2-NEXT: vmovaps %ymm0, (%esp)
1749-
; X86AVX2-NEXT: leal (%edx,%edx), %esi
1751+
; X86AVX2-NEXT: addl %ecx, %ecx
1752+
; X86AVX2-NEXT: movl %ecx, %esi
17501753
; X86AVX2-NEXT: andl $7, %esi
1751-
; X86AVX2-NEXT: movl %eax, (%esp,%esi,4)
1754+
; X86AVX2-NEXT: movl %edx, (%esp,%esi,4)
17521755
; X86AVX2-NEXT: vmovaps (%esp), %ymm0
17531756
; X86AVX2-NEXT: vmovaps %ymm0, {{[0-9]+}}(%esp)
1754-
; X86AVX2-NEXT: leal 1(%edx,%edx), %eax
1755-
; X86AVX2-NEXT: andl $7, %eax
1756-
; X86AVX2-NEXT: movl %ecx, 32(%esp,%eax,4)
1757+
; X86AVX2-NEXT: incl %ecx
1758+
; X86AVX2-NEXT: andl $7, %ecx
1759+
; X86AVX2-NEXT: movl %eax, 32(%esp,%ecx,4)
17571760
; X86AVX2-NEXT: vmovaps {{[0-9]+}}(%esp), %ymm0
17581761
; X86AVX2-NEXT: leal -4(%ebp), %esp
17591762
; X86AVX2-NEXT: popl %esi
@@ -2128,12 +2131,13 @@ define <4 x i64> @load_i64_v4i64(<4 x i64> %v, ptr %p, i32 %y) nounwind {
21282131
; X86AVX2-NEXT: movl (%ecx), %edx
21292132
; X86AVX2-NEXT: movl 4(%ecx), %ecx
21302133
; X86AVX2-NEXT: vmovaps %ymm0, (%esp)
2131-
; X86AVX2-NEXT: leal (%eax,%eax), %esi
2134+
; X86AVX2-NEXT: addl %eax, %eax
2135+
; X86AVX2-NEXT: movl %eax, %esi
21322136
; X86AVX2-NEXT: andl $7, %esi
21332137
; X86AVX2-NEXT: movl %edx, (%esp,%esi,4)
21342138
; X86AVX2-NEXT: vmovaps (%esp), %ymm0
21352139
; X86AVX2-NEXT: vmovaps %ymm0, {{[0-9]+}}(%esp)
2136-
; X86AVX2-NEXT: leal 1(%eax,%eax), %eax
2140+
; X86AVX2-NEXT: incl %eax
21372141
; X86AVX2-NEXT: andl $7, %eax
21382142
; X86AVX2-NEXT: movl %ecx, 32(%esp,%eax,4)
21392143
; X86AVX2-NEXT: vmovaps {{[0-9]+}}(%esp), %ymm0

0 commit comments

Comments
 (0)