Constant expression as fmul operand in InstCombiner asserts

[pawel.jurek]

Summary

In InstCombiner pass, visitFMul function uses a helper function: isFiniteNonZeroFp.
This function does a dyn_cast on result from getAggregateElement, which can be nullptr in case of constant expression operand.
This leads to null pointer dereference in isa<> template, and assert:
assert(Val && "isa<> used on a null pointer");

[majnemer]

LGTM

lib/Transforms/InstCombine/InstCombineMulDivRem.cpp

static void detectLog2OfHalf(Value *&Op, Value *&Y, IntrinsicInst *&Log2) {
   else if (match(I->getOperand(1), m_SpecificFP(0.5)))
     Y = I->getOperand(0);
 }
 
 static bool isFiniteNonZeroFp(Constant *C) {
   if (C->getType()->isVectorTy()) {
     for (unsigned I = 0, E = C->getType()->getVectorNumElements(); I != E;
          ++I) {
-      ConstantFP *CFP = dyn_cast<ConstantFP>(C->getAggregateElement(I));
+      ConstantFP *CFP = dyn_cast_or_null<ConstantFP>(C->getAggregateElement(I));
       if (!CFP || !CFP->getValueAPF().isFiniteNonZero())
         return false;
     }
     return true;
   }
 
   return isa<ConstantFP>(C) &&
          cast<ConstantFP>(C)->getValueAPF().isFiniteNonZero();
 }
 
 static bool isNormalFp(Constant *C) {
   if (C->getType()->isVectorTy()) {
     for (unsigned I = 0, E = C->getType()->getVectorNumElements(); I != E;
          ++I) {
-      ConstantFP *CFP = dyn_cast<ConstantFP>(C->getAggregateElement(I));
+      ConstantFP *CFP = dyn_cast_or_null<ConstantFP>(C->getAggregateElement(I));
       if (!CFP || !CFP->getValueAPF().isNormal())
         return false;
     }
     return true;
   }
 
   return isa<ConstantFP>(C) && cast<ConstantFP>(C)->getValueAPF().isNormal();
 }

test/Transforms/InstCombine/fast-math.ll

 define <4 x float> @fmul3_vec(<4 x float> %f1, <4 x float> %f2) {
   %t1 = fdiv <4 x float> %f1, <float 2.0e+3, float 3.0e+3, float 2.0e+3, float 1.0e+3>
   %t3 = fmul fast <4 x float> %t1, <float 6.0e+3, float 6.0e+3, float 2.0e+3, float 1.0e+3>
   ret <4 x float> %t3
 ; CHECK-LABEL: @fmul3_vec(
 ; CHECK: fmul fast <4 x float> %f1, <float 3.000000e+00, float 2.000000e+00, float 1.000000e+00, float 1.000000e+00>
 }
 
+; Make sure fmul with constant expression doesn't assert.
+define <4 x float> @fmul3_vec_constexpr(<4 x float> %f1, <4 x float> %f2) {
+  %constExprMul = bitcast i128 trunc (i160 bitcast (<5 x float> <float 6.0e+3, float 6.0e+3, float 2.0e+3, float 1.0e+3, float undef> to i160) to i128) to <4 x float>  
+  %t1 = fdiv <4 x float> %f1, <float 2.0e+3, float 3.0e+3, float 2.0e+3, float 1.0e+3>
+  %t3 = fmul fast <4 x float> %t1, %constExprMul
+  ret <4 x float> %t3
+}
+
 ; Rule "X/C1 * C2 => X * (C2/C1) is not applicable if C2/C1 is either a special
 ; value of a denormal. The 0x3810000000000000 here take value FLT_MIN
 ;
 define float @fmul4(float %f1, float %f2) {
   %t1 = fdiv float %f1, 2.0e+3
   %t3 = fmul fast float %t1, 0x3810000000000000
   ret float %t3
 ; CHECK-LABEL: @fmul4(