| Issue |
92193
|
| Summary |
[DAGCombine][RISC-V] VSelect miscompile at -O1
|
| Labels |
new issue
|
| Assignees |
|
| Reporter |
patrick-rivos
|
Reduced LLVM IR:
``` llvm ir
target datalayout = "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128"
target triple = "riscv64-unknown-linux-gnu"
@g.var.0 = global i8 5
@g.arr.0 = global i32 0
define i8 @foo() {
entry:
store i32 4, ptr @g.arr.0, align 32
%g.var.0.val = load i8, ptr @g.var.0, align 1
%loaded.arr = insertelement <4 x i8> <i8 1, i8 1, i8 1, i8 1>, i8 %g.var.0.val, i64 0
%g.arr.elem.0 = load i32, ptr @g.arr.0, align 32
%insert.0 = insertelement <4 x i32> zeroinitializer, i32 %g.arr.elem.0, i64 0
%cmp.0 = icmp ult <4 x i32> %insert.0, <i32 1, i32 1, i32 1, i32 1>
%shuffle.0 = shufflevector <4 x i32> %insert.0, <4 x i32> zeroinitializer, <4 x i32> zeroinitializer
%or.0 = or <4 x i32> %shuffle.0, <i32 1, i32 1, i32 1, i32 1>
%sel.0 = select <4 x i1> %cmp.0, <4 x i32> zeroinitializer, <4 x i32> %or.0
%trunc.0 = trunc <4 x i32> %sel.0 to <4 x i8>
%mul.0 = mul <4 x i8> %loaded.arr, %trunc.0
%reduced.mul.0 = call i8 @llvm.vector.reduce.mul.v4i8(<4 x i8> %mul.0)
ret i8 %reduced.mul.0
}
```
This should return 0 but instead returns 24 when invoking llc with -O1 or above.
Found via fuzzer.
Root of the issue is here:
https://github.com/llvm/llvm-project/blob/c5cd049566a795ba5de88dfbb2eb563cad4a9d8a/llvm/lib/CodeGen/SelectionDAG/DAGCombiner.cpp#L12145-L12146
We continue without invalidating `bool AllAddOne = true;` and `bool AllSubOne = true;`.
This means at the end of the loop both `AllAddOne=true` and `AllSubOne=true` which isn't possible.
I'll file a PR shortly.
![]()
_______________________________________________
llvm-bugs mailing list
llvm-bugs@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-bugs
