[X86] Avoid miscompile in combineOr (X86ISelLowering.cpp)

[bjope]

Summary

In combineOr (X86ISelLowering.cpp) there is a DAG combine that rewrite
a "(0 - SetCC) | C" pattern into something simpler given that a LEA
can be used. Another requirement is that C has some specific value,
for example 1 or 7. When checking those requirements the code used a
32-bit unsigned variable to store the value of C. So for a 64-bit OR
this could miscompile in case any of the 32 most significant bits in
C were non zero.

This patch adds fixes the bug by using a large enough type for the
C value.

The faulty code seem to have been introduced by commit 9bceb8981d32fe
(D131358).

[RKSimon]

Nice catch!

[bjope]

For the record, we found this problem after having merged

commit d1baed7c9c8341c43c696cce1b7ec846c21b0b45
Author: Amaury Séchet <[e-mail]>
Date:   Fri Aug 5 13:33:07 2022 +0000

    [DAG] select Cond, -1, C --> or (sext Cond), C if Cond is MVT::i1
    
    This seems to be beneficial overall, except for midpoint-int.ll .
    
    The X86 backend seems to generate zeroing that are not necesary.
    
    Reviewed By: shchenz
    
    Differential Revision: https://reviews.llvm.org/D131260

even though the bug seems to have been around since Aug 7 (commit 9bceb8981d32fe).

llvm/lib/Target/X86/X86ISelLowering.cpp

if ((VT == MVT::i32 || VT == MVT::i64) &&
       N0.getOpcode() == ISD::SUB && N0.hasOneUse() &&
       isNullConstant(N0.getOperand(0))) {
     SDValue Cond = N0.getOperand(1);
     if (Cond.getOpcode() == ISD::ZERO_EXTEND && Cond.hasOneUse())
       Cond = Cond.getOperand(0);
 
     if (Cond.getOpcode() == X86ISD::SETCC && Cond.hasOneUse()) {
       if (auto *CN = dyn_cast<ConstantSDNode>(N1)) {
-        unsigned Val = CN->getZExtValue();
+        uint64_t Val = CN->getZExtValue();
         if (Val == 1 || Val == 2 || Val == 3 || Val == 4 || Val == 7 || Val == 8) {
           X86::CondCode CCode = (X86::CondCode)Cond.getConstantOperandVal(0);
           CCode = X86::GetOppositeBranchCondition(CCode);
           SDValue NotCond = getSETCC(CCode, Cond.getOperand(1), SDLoc(Cond), DAG);
 
           SDValue R = DAG.getZExtOrTrunc(NotCond, dl, VT);
           R = DAG.getNode(ISD::MUL, dl, VT, R, DAG.getConstant(Val + 1, dl, VT));
           R = DAG.getNode(ISD::SUB, dl, VT, R, DAG.getConstant(1, dl, VT));

llvm/test/CodeGen/X86/or-lea.ll

 ; X86-NEXT:    negl %eax
 ; X86-NEXT:    sbbl %edx, %edx
 ; X86-NEXT:    orl $1, %eax
 ; X86-NEXT:    orl $128, %edx
 ; X86-NEXT:    retl
 ;
 ; X64-LABEL: or_large_constant:
 ; X64:       # %bb.0: # %entry
-; X64-NEXT:    xorl %eax, %eax
+; X64-NEXT:    xorl %ecx, %ecx
 ; X64-NEXT:    cmpq $2, %rdi
-; X64-NEXT:    setl %al
-; X64-NEXT:    leaq -1(%rax,%rax), %rax
+; X64-NEXT:    setge %cl
+; X64-NEXT:    negq %rcx
+; X64-NEXT:    movabsq $549755813889, %rax # imm = 0x8000000001
+; X64-NEXT:    orq %rcx, %rax
 ; X64-NEXT:    retq
 entry:
   %cmp = icmp sgt i64 %x, 1
   %zext = zext i1 %cmp to i64
   %sub = sub i64 0, %zext
   %or = or i64 %sub, 549755813889   ; 0x8000000001
   ret i64 %or
 }