Page MenuHomePhabricator

[X86] Avoid miscompile in combineOr (X86ISelLowering.cpp)
ClosedPublic

Authored by bjope on Sep 29 2022, 9:32 AM.

Details

Summary

In combineOr (X86ISelLowering.cpp) there is a DAG combine that rewrite
a "(0 - SetCC) | C" pattern into something simpler given that a LEA
can be used. Another requirement is that C has some specific value,
for example 1 or 7. When checking those requirements the code used a
32-bit unsigned variable to store the value of C. So for a 64-bit OR
this could miscompile in case any of the 32 most significant bits in
C were non zero.

This patch adds fixes the bug by using a large enough type for the
C value.

The faulty code seem to have been introduced by commit 9bceb8981d32fe
(D131358).

Diff Detail

Event Timeline

bjope created this revision.Sep 29 2022, 9:32 AM
Herald added a project: Restricted Project. · View Herald TranscriptSep 29 2022, 9:32 AM
bjope requested review of this revision.Sep 29 2022, 9:32 AM
Herald added a project: Restricted Project. · View Herald TranscriptSep 29 2022, 9:32 AM
RKSimon accepted this revision.Sep 29 2022, 10:23 AM

Nice catch!

This revision is now accepted and ready to land.Sep 29 2022, 10:23 AM
This revision was landed with ongoing or failed builds.Sep 29 2022, 12:26 PM
This revision was automatically updated to reflect the committed changes.
bjope added a comment.Sep 29 2022, 2:04 PM

For the record, we found this problem after having merged

commit d1baed7c9c8341c43c696cce1b7ec846c21b0b45
Author: Amaury Séchet <deadalnix@gmail.com>
Date:   Fri Aug 5 13:33:07 2022 +0000

    [DAG] select Cond, -1, C --> or (sext Cond), C if Cond is MVT::i1
    
    This seems to be beneficial overall, except for midpoint-int.ll .
    
    The X86 backend seems to generate zeroing that are not necesary.
    
    Reviewed By: shchenz
    
    Differential Revision: https://reviews.llvm.org/D131260

even though the bug seems to have been around since Aug 7 (commit 9bceb8981d32fe).