[ConstantInt] Check active bits before calling getZExtValue.

[fhahn]

Summary

Without this check, we hit an assertion in getZExtValue, if the constant
value does not fit into an uint64_t.

As getZExtValue returns an uint64_t, should we update
getAggregateElement to take an uin64_t as well?

This fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=6109.

[efriedma]

LGTM; arrays/struct types are currently limited to 2^64 elements anyway.

should we update getAggregateElement to take an uin64_t as well?

Yes, all the ConstantAggregate-related code should use uint64_t to match the type system. See also https://reviews.llvm.org/D55169, where this just came up.

[fhahn]

In D55547#1327337, @efriedma wrote:

LGTM; arrays/struct types are currently limited to 2^64 elements anyway.

should we update getAggregateElement to take an uin64_t as well?

Yes, all the ConstantAggregate-related code should use uint64_t to match the type system. See also https://reviews.llvm.org/D55169, where this just came up.

Thanks Eli, I'll see if I can put together a follow-up patch in the next few days.

include/llvm/IR/Constant.h

public:
   /// generate a relocation entry.  This must be conservative, so if it might
   /// codegen to a relocatable entry, it should say so.
   ///
   /// FIXME: This really should not be in IR.
   bool needsRelocation() const;
 
   /// For aggregates (struct/array/vector) return the constant that corresponds
   /// to the specified element if possible, or null if not. This can return null
-  /// if the element index is a ConstantExpr, or if 'this' is a constant expr.
+  /// if the element index is a ConstantExpr, if 'this' is a constant expr or
+  /// if the constant does not fit into an uint64_t.
   Constant *getAggregateElement(unsigned Elt) const;
   Constant *getAggregateElement(Constant *Elt) const;
 
   /// If this is a splat vector constant, meaning that all of the elements have
   /// the same value, return that value. Otherwise return 0.
   Constant *getSplatValue() const;
 
   /// If C is a constant integer then return its value, otherwise C must be a

lib/IR/Constants.cpp

Constant *Constant::getAggregateElement(unsigned Elt) const {
   if (const ConstantDataSequential *CDS =dyn_cast<ConstantDataSequential>(this))
     return Elt < CDS->getNumElements() ? CDS->getElementAsConstant(Elt)
                                        : nullptr;
   return nullptr;
 }
 
 Constant *Constant::getAggregateElement(Constant *Elt) const {
   assert(isa<IntegerType>(Elt->getType()) && "Index must be an integer");
-  if (ConstantInt *CI = dyn_cast<ConstantInt>(Elt))
+  if (ConstantInt *CI = dyn_cast<ConstantInt>(Elt)) {
+    // Check if the constant fits into an uint64_t.
+    if (CI->getValue().getActiveBits() > 64)
+      return nullptr;
     return getAggregateElement(CI->getZExtValue());
+  }
   return nullptr;
 }
 
 void Constant::destroyConstant() {
   /// First call destroyConstantImpl on the subclass.  This gives the subclass
   /// a chance to remove the constant from any maps/pools it's contained in.
   switch (getValueID()) {
   default:

test/Transforms/SCCP/apint-bigint2.ll

-; RUN: opt < %s -sccp -S | not grep load
+; RUN: opt < %s -sccp -S | FileCheck %s
 
 @Y = constant [6 x i101] [ i101 12, i101 123456789000000, i101 -12,
                            i101 -123456789000000, i101 0,i101 9123456789000000]
 
-define i101 @array()
-{
-Head:
+; CHECK-LABEL: @array
+; CHECK-NEXT: ret i101 123456789000000
+define i101 @array() {
    %A = getelementptr [6 x i101], [6 x i101]* @Y, i32 0, i32 1
    %B = load i101, i101* %A
    %D = and i101 %B, 1
    %DD = or i101 %D, 1
    %E = trunc i101 %DD to i32
    %F = getelementptr [6 x i101], [6 x i101]* @Y, i32 0, i32 %E
    %G = load i101, i101* %F
  
    ret i101 %G
 }
+
+; CHECK-LABEL: @large_aggregate
+; CHECK-NEXT: ret i101 undef
+define i101 @large_aggregate() {
+  %B = load i101, i101* undef
+  %D = and i101 %B, 1
+  %DD = or i101 %D, 1
+  %F = getelementptr [6 x i101], [6 x i101]* @Y, i32 0, i32 5
+  %G = getelementptr i101, i101* %F, i101 %DD
+  %L3 = load i101, i101* %G
+  ret i101 %L3
+}