Skip to content

[AArch64][GlobalISel] Don't crash when legalising vector G_SHL #168848

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cofibrant merged 4 commits into from
Dec 2, 2025
Merged

[AArch64][GlobalISel] Don't crash when legalising vector G_SHL #168848

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7683b54
[AArch64][GlobalISel] Don't crash when legalising vector G_SHL
cofibrant Nov 20, 2025
92db3f7
Modify handling of `G_*SH*` opcodes in `LegalizerHelper::moreElements…
cofibrant Dec 1, 2025
8e7ad65
Relocate test case
cofibrant Dec 1, 2025
0425039
Make sure the test case won't be optimised out
cofibrant Dec 1, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions llvm/lib/Target/AArch64/GISel/AArch64LegalizerInfo.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -216,15 +216,15 @@ AArch64LegalizerInfo::AArch64LegalizerInfo(const AArch64Subtarget &ST)
.widenScalarToNextPow2(0)
.clampScalar(1, s32, s64)
.clampScalar(0, s32, s64)
.minScalarSameAs(1, 0)
.minScalarEltSameAsIf(isVector(0), 1, 0)
.maxScalarEltSameAsIf(isVector(0), 1, 0)
.clampNumElements(0, v8s8, v16s8)
.clampNumElements(0, v4s16, v8s16)
.clampNumElements(0, v2s32, v4s32)
.clampNumElements(0, v2s64, v2s64)
.moreElementsToNextPow2(0)
.minScalarSameAs(1, 0)
.scalarizeIf(scalarOrEltWiderThan(0, 64), 0)
.minScalarEltSameAsIf(isVector(0), 1, 0)
.maxScalarEltSameAsIf(isVector(0), 1, 0);
.scalarizeIf(scalarOrEltWiderThan(0, 64), 0);
Copy link
Contributor

@arsenm arsenm Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This seems fine but the rules should probably not be so fragile as to crash if you order them wrong

Copy link
Contributor Author

@cofibrant cofibrant Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a code path where an action can fail with UnableToLegalize but we continue to apply other rules before returning to retry the failing rule after observing a change? If so I can add a check somewhere sensible for a more robust fix.

Copy link
Contributor

@aemerson aemerson Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, once we hit Unable the whole process will abort.

Copy link
Contributor Author

@cofibrant cofibrant Nov 21, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, not sure I have a better fix... Basically the action responsible for padding vectors with more undef elements only accepts a single type to expand to, and when applied to binary operations naïvely uses this type for both input operands:

llvm-project/llvm/lib/CodeGen/GlobalISel/LegalizerHelper.cpp

Lines 6688 to 6697 in 59ed6df

case TargetOpcode::G_SHL:
case TargetOpcode::G_ASHR:
case TargetOpcode::G_LSHR: {
Observer.changingInstr(MI);
moreElementsVectorSrc(MI, MoreTy, 1);
moreElementsVectorSrc(MI, MoreTy, 2);
moreElementsVectorDst(MI, MoreTy, 0);
Observer.changedInstr(MI);
return Legalized;
}

In other words, it assumes the inputs already agree on their scalar type. One option, I suppose, would be to have this code infer the number of elements from MoreTy, but inherit the scalar element types from each operand for each call to moreElementsVector*(). What do you think?

Copy link
Contributor

@arsenm arsenm Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We probably should have validation that the reported rule makes sense for the given operation as part of the rule parsing. The failure ideally wouldn't be deferred all the way to the application


getActionDefinitionsBuilder(G_PTR_ADD)
.legalFor({{p0, s64}, {v2p0, v2s64}})
Expand Down
29 changes: 29 additions & 0 deletions llvm/test/CodeGen/AArch64/GlobalISel/legalize-shl-crash.ll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
; NOTE: Assertions have been autogenerated by utils/update_llc_test_checks.py UTC_ARGS: --version 6
; RUN: llc -global-isel -o - %s | FileCheck %s

target triple = "aarch64-unknown-unknown"

; Check we don't crash here.

define <2 x i8> @test() {
; CHECK-LABEL: test:
; CHECK: // %bb.0: // %entry
; CHECK-NEXT: mov w8, #1 // =0x1
; CHECK-NEXT: mov w9, #0 // =0x0
; CHECK-NEXT: fmov s0, w8
; CHECK-NEXT: fmov s1, w9
; CHECK-NEXT: mov v0.b[1], w8
; CHECK-NEXT: mov v1.b[1], w9
; CHECK-NEXT: ushl v0.8b, v0.8b, v1.8b
; CHECK-NEXT: umov w8, v0.b[0]
; CHECK-NEXT: umov w9, v0.b[1]
; CHECK-NEXT: fmov s0, w8
; CHECK-NEXT: mov v0.s[1], w9
; CHECK-NEXT: // kill: def $d0 killed $d0 killed $q0
; CHECK-NEXT: ret
entry:
%zeroes = zext <2 x i1> zeroinitializer to <2 x i32>
%ones = shl <2 x i32> splat (i32 1), %zeroes
%ones.trunc = trunc <2 x i32> %ones to <2 x i8>
ret <2 x i8> %ones.trunc
}